During Pattern-based Discovery, IP Address values of the main CI may change and then change back immediately in a subsequent update.
Unwanted side-effects of the value flapping include:

  • hundreds/thousands of unwanted update records in Audit History and History Line tables
  • Triggers update business rules twice
  • adds lots of flapping clutter to activity streams, baselines and timelines.
  • unauthorized change request may be created due to this unplanned CI activity

Problem PRB1343838 has been fixed in Madrid Patch 9, New York Patch 3 and Orlando with the purpose: to preserve the first IP address used when discovering a CI using Pattern. If user input different IP address for the same CI in the discovery, the CI's old IP address should not be modified.

The fix was implemented as a second non-IRE update to repair the IP Address value after the main IRE update, rather than to avoid changing it in the first place. The flapping remains, and the only difference is that we flap back immediately rather than on the next scan.

Steps to Reproduce

  1. Create a device with multiple IP address (A and B), for instance: a Cisco switch.
  2. Discover the CI for the first time with IP address A.
  3. Observe that this CI has <ip_address> filled in with IP address A.
  4. Create new discovery with IP address B.
  5. Observe that the CI in step 2 still has <ip_address> filled in with IP address A.
  6. Check the Audit History for this CI to see what actually happened in the background. You can see that the CI was updated with IP address B and immediately updated back again to IP address A.


This problem is currently under review. You can contact ServiceNow Technical Support or subscribe to this Known Error article by clicking the Subscribe button at the top right of this form to be notified when more information will become available.

Related Problem: PRB1380126

Seen In

SR - IRM - Audit Management - New York 2019 Q3
SR - IRM - GRC Profiles - Madrid 2019 Q2
SR - IRM - Policy and Compliance - Madrid 2019 Q2
SR - IRM - Risk Management - New York 2019 Q3
SR - ITOM - CMDB CI Class Models - 201909
SR - ITOM - Discovery and Service Mapping - 201908
SR - SecOps - Configuration Compliance - New York 2019 Q3
SR - Security - Integration Framework - Madrid 2019 Q2
SR - Security - Support Common - Madrid 2019 Q2
SR - Security - Support Orchestration - Madrid 2019 Q2
SR - SIR - Security Incident Response - Madrid 2019 Q2
SR - SIR - Splunk Sighting Search Integration - Madrid 2019 Q1
SR - SIR - Store SecOps Setup Assistant - Madrid 2019 Q2
SR - SIR - Store Threat Core - Madrid 2019 Q2
SR - SIR - Store Trusted Security Circles Client - New York 2019 Q3
SR - VR - Vulnerability Response - New York 2019 Q3

Associated Community Threads

There is no data to report.

Article Information

Last Updated:2020-01-30 12:51:43