{"id":423,"date":"2022-04-12T01:59:23","date_gmt":"2022-04-12T01:59:23","guid":{"rendered":"https:\/\/ouritsource.com\/blog\/?p=423"},"modified":"2025-05-29T15:37:49","modified_gmt":"2025-05-29T15:37:49","slug":"troubleshooting-classification-phase-failure","status":"publish","type":"post","link":"https:\/\/ouritsource.com\/blog\/troubleshooting-classification-phase-failure\/","title":{"rendered":"Troubleshooting Classification Phase Failure"},"content":{"rendered":"\n

The classification phase is the first phase where Discover tries to use credentials specified in Discovery Credentials. Problems here are often associated with using the incorrect user account or incorrect user account and password combination. These also include:<\/p>\n\n\n\n

SSH authentication errors in Linux\/Unix<\/li>
Bad Powershell configurations on Window<\/li><\/ul>\n\n\n\n
The below example shows that during the classification phase on this Linux\/Unix device, we received an error: \u201cSSH authentication or connection failure\u201d which stopped Discovery. This message means that the MID Server was not able to log onto the target machine so the classification probe could not get any information from it. <\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
The device history shows that it did find device 10.11.15.151 and saw it as \u201cactive\u201d but could not log into it. This could be due to issues with network connectivity or incorrect credentials issues. In this case, since Shazzam was able to communicate with the machine but was unable to log on, the issue most likely may be caused by bad credentials.<\/p>\n\n\n\n
<\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
The ECC Queue shows that Discovery first launched a Shazam probe (output), received information from that probe (input), then it launched a Classification probe (output), then finally it received information back from that probe (input).<\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
If you look at the classification probe input record, you can see the result showing error \u201cSSH authentication or connection failure\u201d.<\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
In Windows, authentication failure looks similar to a Linux authentication failure except that Windows uses Powershell to login. The first error circled in red basically means that none of the Windows Credentials created, can be used to authenticate to the Windows target machine. The second error circled in blue basically shows Discovery trying to use the MID Server\u2019s \u201cservice\u201d account to login into the target credential but that too failed. <\/p>\n\n\n\n
<\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
The MID Server\u2019s service account is the account used to start\/stop the MID Server services on the MID Server. If you want, you can disable Discovery from using the service account from being used as a fallback so that PowerShell only uses credentials, specified in the ServiceNow instance.<\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
To disable Discovery from using the MID Server service account, on the ServiceNow instance, go to the MID Server record, go to Configuration Parameters, and click NEW to create a new Parameter:<\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
For the Parameter Name, select \u201cmid.powershell.local_miid_service_credential_fallback and set the value to \u201cfalse\u201d.<\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
If that parameter is configured, rather than seeing the Discovery log errors shown above, you instead will see the following error: Authentication failure(s) with available WIndows credentials from the instance. This means Discovery tried all Windows credentials specified in the instance but all credentials failed. It also no longer attempted to log on with the MID Server service\u2019s account. <\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
<\/p>\n\n\n\n
By looking at the classification phase\u2019s input record, you can find what went wrong during the classification phase. Below, you can see two errors: \u201cAuthentication failure with the local MID Server service credential\u201d and \u201cFailed to access Target System\u201d.<\/p>\n\n\n\n
$\"\"$ <\/figure>\n\n\n\n
When you see Errors in the input record of the classification probe Payload XML file showing \u201cauthentication failure\u201d or \u201cfailed to access target system\u201d, the cause is typically a failure in the authentication phase. The solution is to provide the proper credentials in the ServiceNow instance or in the Log On tab of the MID Server Services Properties page.<\/p>\n<\/body>","protected":false},"excerpt":{"rendered":"
The classification phase is the first phase where Discover tries to use credentials specified in Discovery Credentials. Problems here are often associated with using the incorrect user account or incorrect user account…<\/p>\n","protected":false},"author":1,"featured_media":495,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[26],"tags":[],"class_list":["post-423","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-servicenow","has-thumbnail"],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/ouritsource.com\/blog\/wp-content\/uploads\/2022\/04\/ChatGPT-Image-May-29-2025-11_34_02-AM.png?fit=1024%2C1024&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/posts\/423","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/comments?post=423"}],"version-history":[{"count":2,"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/posts\/423\/revisions"}],"predecessor-version":[{"id":437,"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/posts\/423\/revisions\/437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/media\/495"}],"wp:attachment":[{"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/media?parent=423"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/categories?post=423"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ouritsource.com\/blog\/wp-json\/wp\/v2\/tags?post=423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}