AWS transform documentation change
Summary
Updated data collection schedules to staggered UTC times, extended data retention from 28 to 30 days, added export customization options (date range/module selection), replaced 'bare metal' terminology with 'imported servers', and added private address network collection feature.
Security assessment
The change adds documentation for the 'private address network collection' feature, which enhances security visibility by allowing collection of connections to RFC 1918 private IP addresses not in inventory. This improves network dependency mapping for security monitoring, though no specific vulnerability is addressed.
Diff
diff --git a/transform/latest/userguide/discovery-tool-data-collection.md b/transform/latest/userguide/discovery-tool-data-collection.md index e4a756d49..ae54cb412 100644 --- a//transform/latest/userguide/discovery-tool-data-collection.md +++ b//transform/latest/userguide/discovery-tool-data-collection.md @@ -13 +13 @@ Collection scheduleDiscovered inventory OS-related data -After your initial discovery collection, the discovery tool continues to run on this schedule: +After your initial discovery collection, the discovery tool continues to run on a staggered schedule to avoid resource contention: @@ -15 +15 @@ After your initial discovery collection, the discovery tool continues to run on - * VMware discovery – every hour + * VMware discovery – every hour (at :00 UTC) @@ -17 +17 @@ After your initial discovery collection, the discovery tool continues to run on - * Hyper-V discovery – every hour + * Hyper-V discovery – every hour (at :20 UTC) @@ -22 +22 @@ After your initial discovery collection, the discovery tool continues to run on -The discovery tool also collects OS metrics through the following independent modules, each with its own schedule: +The discovery tool also collects OS metrics through the following independent modules, each with its own staggered schedule: @@ -28 +28 @@ The discovery tool also collects OS metrics through the following independent mo - * Server performance metrics – every 10 minutes + * Server performance metrics – every 10 minutes (at :03, :13, :23, :33, :43, :53 UTC) @@ -30 +30 @@ The discovery tool also collects OS metrics through the following independent mo - * Storage performance metrics – every 10 minutes + * Storage performance metrics – every 10 minutes (at :07, :17, :27, :37, :47, :57 UTC) @@ -32 +32 @@ The discovery tool also collects OS metrics through the following independent mo - * Server provisioning data – daily + * Server provisioning data – daily (at 00:05 UTC) @@ -34 +34 @@ The discovery tool also collects OS metrics through the following independent mo - * Storage provisioning data – daily + * Storage provisioning data – daily (at 00:35 UTC) @@ -36 +36 @@ The discovery tool also collects OS metrics through the following independent mo - * Network interfaces – daily + * Network interfaces – daily (at 01:05 UTC) @@ -38 +38 @@ The discovery tool also collects OS metrics through the following independent mo - * Running processes – hourly + * Running processes – hourly (at :40 UTC) @@ -66 +66 @@ After a collection failure, the discovery tool attempts to collect networking da -After you configure a discovery source, the **Number of discovered servers** value in the **Discovery tool status** frame begins to increment. The discovery status for the configured source changes to **Enabled** in the **Collection module** frame. The inventory page shows servers from all configured sources: VMware VMs, Hyper-V VMs, and imported bare metal servers. Each server shows its source and collection status per module. +After you configure a discovery source, the **Number of discovered servers** value in the **Discovery tool status** frame begins to increment. The discovery status for the configured source changes to **Enabled** in the **Collection module** frame. The inventory page shows servers from all configured sources: VMware VMs, Hyper-V VMs, and imported servers. Each server shows its source and collection status per module. @@ -68 +68 @@ After you configure a discovery source, the **Number of discovered servers** val -Navigate to the **Discovered inventory** page to see the servers that the discovery tool has found. From this page, choose **Download inventory** to download a ZIP file (`discovery_tool_export.zip`) that contains up to 28 days of collected data, including MPA files for all configured sources, performance utilization data, database information, and server-to-server communication information. +Navigate to the **Discovered inventory** page to see the servers that the discovery tool has found. From this page, choose **Download inventory** to download a ZIP file (`discovery_tool_export.zip`) that contains up to 30 days of collected data, including MPA files for all configured sources, performance utilization data, database information, and server-to-server communication information. @@ -71,0 +72,31 @@ You can download the ZIP file while the discovery tool continues to work, and ob +### Export options + +When exporting data, you can customize the export with the following options: + +**Date range** + +Select a start date and end date to export only data collected within that time period. Both dates are inclusive. The maximum date range is 30 days. + +###### Note + +The discovery tool stores up to 30 days of collected data. If you need data spanning more than 30 days, run incremental exports every 30 days to capture all data. + +**Module selection** + +Choose which data modules to include in the export. You can export all modules or select specific ones: + +Module | Description +---|--- +VMware data | Virtual machine inventory from vCenter servers +Hyper-V data | Virtual machine inventory from Hyper-V hosts +Network data | Network connections between servers +Database data | SQL Server database inventory +Server inventory | Server hardware and OS information +Server performance metrics | CPU, memory, and network utilization +Server storage performance | Disk IOPS and throughput +Storage config | Disk and volume configuration +Network interfaces | Network adapter details +Process metrics | Running processes + +If you don't select any modules, the discovery tool exports all available data. + @@ -117 +148 @@ hypervisor | String | VM Info | "Hyper-V" -#### Bare metal data +#### Imported server data @@ -119 +150 @@ hypervisor | String | VM Info | "Hyper-V" -Bare metal servers are not auto-discovered. They are imported through a CSV file. The discovery tool does not collect hypervisor-level data for bare metal servers. Instead, it collects database, network, and OS metrics data by using the OS credentials associated with each server during import. +Imported servers are not auto-discovered. They are imported through a CSV file. The discovery tool does not collect hypervisor-level data for imported servers. Instead, it collects database, network, and OS metrics data by using the OS credentials associated with each server during import. @@ -171 +202 @@ disk_total_throughput_peak_mbps| Float| Storage Performance| 42.5 -CPU, memory, and network throughput utilization. Sampled every 10 minutes, aggregated over 28 days. +CPU, memory, and network throughput utilization. Sampled every 10 minutes, aggregated over 30 days. @@ -192 +223 @@ network_total_peak_mbps| Float| Network| 21.0 -Per-volume disk I/O and space utilization. Sampled every 10 minutes, aggregated over 28 days. +Per-volume disk I/O and space utilization. Sampled every 10 minutes, aggregated over 30 days. @@ -260 +291 @@ is_primary| Boolean| Interface Info| true -Snapshot of running processes. Collected every hour, deduplicated over 28 days. +Snapshot of running processes. Collected every hour, deduplicated over 30 days. @@ -274 +305 @@ The Network collection module helps you discover dependencies among servers in y -This module collects network data for servers from all configured sources, including VMware, Hyper-V, and bare metal. It uses WinRM to collect data from Windows servers and uses SSH, SNMPv2, and SNMPv3 to collect data from Linux servers. +This module collects network data for servers from all configured sources, including VMware, Hyper-V, and imported servers. It uses WinRM to collect data from Windows servers and uses SSH, SNMPv2, and SNMPv3 to collect data from Linux servers. @@ -301 +332,26 @@ These data points are collected for each connection: -To maximize the completeness of your network dependency map, configure all discovery sources (VMware, Hyper-V, and bare metal CSV import) and add OS credentials before reviewing network data. The more servers in your inventory, the more connections the network module can capture. +To maximize the completeness of your network dependency map, configure all discovery sources (VMware, Hyper-V, and server CSV import) and add OS credentials before reviewing network data. The more servers in your inventory, the more connections the network module can capture. + +#### Private address network collection + +By default, the Network collection module only captures connections where both endpoints are servers in your discovered inventory. You can enable private address collection to also capture connections to and from RFC 1918 private IP addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are not in your inventory. + +###### To start private address collection + + 1. On the **Collector configuration** page, locate the **Collection modules** section. + + 2. Find **Network connections discovery** under **Application discovery**. + + 3. Open the **Actions** dropdown. + + 4. Choose **Start private address collection**. + + 5. If the module status was **Enabled** , you can see it change to **Enabled · Private Address on**. + + + + +To stop private address collection, open the **Actions** dropdown and choose **Stop private address collection**. Previously collected private address data is retained even after stopping. + +Private address connections appear only in the full CSV export (inside the ZIP file), not in the MPA CSV files. If an IP address belongs to a server already in your inventory, it is always identified by its discovered server ID regardless of this setting. + +This setting persists across restarts. You can start or stop private address collection at any time. Previously collected private address data is exported regardless of the current setting. @@ -305 +361 @@ To maximize the completeness of your network dependency map, configure all disco -The Database collection module gathers database (SQL Server) information from Windows servers across all configured sources, including VMware, Hyper-V, and bare metal. The module uses the WinRM protocol to remotely connect to each Windows server and run PowerShell queries to get information about all installed SQL Server services (components) on the server by using WMI namespaces, registry, and file properties. +The Database collection module gathers database (SQL Server) information from Windows servers across all configured sources, including VMware, Hyper-V, and imported servers. The module uses the WinRM protocol to remotely connect to each Windows server and run PowerShell queries to get information about all installed SQL Server services (components) on the server by using WMI namespaces, registry, and file properties.