CIS-DF Hub Part 3: Discovery MID Server Deep Dive
⬡ Part 3 · Topic 2

MID Server Deep Dive — Architecture, Configuration & Operations

You were introduced to the MID Server concept in Part 2 (SGC). Now that you understand how Discovery works, this topic goes deep: installation, the ECC Queue protocol, worker threads, cluster configuration, performance tuning, and every troubleshooting scenario the exam tests. The MID Server is the backbone of all on-premise integrations — mastering it is essential.

📋 10 sections ~35 min read 🎯 ~19% exam weight (INGEST domain) 🏷 MID Server · ECC Queue · Worker Threads · Cluster · Validation

MID Server Architecture — What It Is and How It Works

The Management, Instrumentation, and Discovery (MID) Server is a Java application that runs on a server inside your network. Its job is to act as a secure, bidirectional proxy between your ServiceNow cloud instance and resources that live inside firewalled private networks.

The critical insight — repeated from Part 2 because it's exam-tested so frequently — is that the MID Server makes outbound connections only. It reaches out to ServiceNow; ServiceNow does not reach in to the MID Server. This means:

  • No inbound firewall holes required
  • Only outbound HTTPS (port 443) to your ServiceNow instance must be allowed
  • The MID Server maintains a persistent polling connection to the ECC Queue

The Three Layers of MID Server Communication

Layer 1 — Cloud
ServiceNow Instance
The ServiceNow cloud platform. Sends instructions to the MID Server by writing records to the ecc_queue table. Receives results the same way. Never initiates an outbound connection to the MID Server directly.
Hosted by ServiceNow ecc_queue table (Input + Output)
Transport — Outbound HTTPS :443
MID Server Polls via HTTPS
The MID Server makes outbound HTTPS requests to the ServiceNow instance URL to pick up instructions and post results. Only outbound port 443 is required — no inbound firewall rules needed on the server running the MID process.
Layer 2 — DMZ or On-Prem
MID Server Process
A Java process installed on a server in your environment (on-prem, cloud VM, or DMZ). Executes the instructions from ServiceNow against target resources using local network access.
Java process (agent.jar) Installed in your environment Managed via ServiceNow MID Server module
Transport — Local Network
LAN / Private Network
Standard local network traffic between the MID Server and target resources. No special configuration required — MID Server has the same network access as any other server on the subnet.
🖥
Layer 3 — Private Network
Target Resources
The actual infrastructure the MID Server scans or communicates with. These can be anywhere on the network the MID Server can reach — no internet exposure required.
Servers (SSH / WMI) Network devices (SNMP) Databases (JDBC) Cloud APIs (REST)
💡
Key Concept — ECC Queue Is Inside ServiceNow The External Communication Channel (ECC) Queue is a table (ecc_queue) inside ServiceNow — not a separate service. It has an Input side (messages going TO the MID Server, such as "scan this IP range") and an Output side (results coming FROM the MID Server). The MID Server polls ServiceNow's ECC Queue regularly to pick up new instructions. This polling model is what makes it firewall-friendly.

MID Server Installation and Initial Setup

Understanding the installation process helps you answer "what is required for a MID Server to start working?" questions on the exam.

Prerequisites

  • Java 11 or later — MID Server is a Java application. Java must be installed on the host server.
  • 64-bit OS — Windows Server 2012 R2+ or RHEL/CentOS/Ubuntu Linux (64-bit)
  • RAM: Minimum 2 GB dedicated to the MID Server process; 4–8 GB recommended for high-load environments
  • Network: Outbound HTTPS (port 443) to your-instance.service-now.com must not be blocked
  • Service account: A dedicated Windows or Linux user account (not a personal account) to run the MID Server process

Installation Steps (Conceptual)

  1. Download the installer from your ServiceNow instance: Navigate to MID Server → Downloads and download the Windows installer or Linux package.
  2. Run the installer on your host server. It installs the MID Server files and creates the base directory structure.
  3. Configure config.xml — This file inside the MID Server installation directory contains the connection settings:
    • url — Your ServiceNow instance URL
    • mid.instance.username — ServiceNow service account username
    • mid.instance.password — ServiceNow service account password (stored encrypted)
    • name — The MID Server name (must match what you register in ServiceNow)
  4. Start the MID Server as a Windows service or Linux daemon.
  5. Register and Validate in ServiceNow. The MID Server appears under MID Server → Servers as "Pending Validation." An admin must validate it.
Exam Trap — config.xml Contains the ServiceNow Credentials The MID Server's ServiceNow credentials (the username and password of the service account used to connect to ServiceNow) are stored in config.xml on the MID Server host. This is separate from the target device credentials (SSH keys, SNMP community strings) which are stored in ServiceNow's Credential Vault. Many candidates confuse these two types of credentials.

The MID Server Service Account in ServiceNow

The ServiceNow user account that the MID Server uses must have the mid_server role in ServiceNow. This role grants:

  • Access to read from and write to the ECC Queue
  • Access to read Credential records (so it can retrieve target device credentials)
  • Access to create and update CMDB records (via IRE, not direct writes)
  • Access to Discovery schedule and behavior configurations

Best practice: use a dedicated service account with only the mid_server role. Do not give it admin access.

MID Server Validation — The Gate Before It Can Work

After a MID Server starts and connects to ServiceNow, it enters a Pending Validation state. It cannot process any work until a ServiceNow administrator validates it. This is a deliberate security control — it prevents unauthorized MID Servers from being used to scan your network.

Validation Process

  1. Navigate to MID Server → Servers
  2. Find the new MID Server in the list (state = "Pending Validation")
  3. Open the record and verify: server name, IP, OS version, Java version, MID Server version
  4. Click Validate
  5. ServiceNow sends a validation challenge to the MID Server, which must respond correctly
  6. State changes to "Up" — the MID Server is now active and can receive work

Validation States

State Meaning Action Required
Pending Validation MID Server connected but not yet approved Admin must validate
Up Validated and actively polling ECC Queue None — fully operational
Down MID Server process stopped or lost connectivity Check MID Server process; check network connectivity
Skipped MID Server intentionally excluded from receiving work Admin set skipped — intentional
Upgraded MID Server was upgraded; requires re-validation Admin must re-validate after upgrade
Critical Exam Fact — Re-Validation Required After Upgrade When ServiceNow upgrades a MID Server (auto-upgrade), the MID Server must be re-validated before it can resume work. This is a common exam scenario: "After a scheduled upgrade, Discovery stopped running. What is the most likely cause?" Answer: the MID Server requires re-validation after the upgrade.

The ECC Queue — ServiceNow's Message Bus to MID Servers

The External Communication Channel (ECC) Queue is a table in ServiceNow (ecc_queue) that acts as the message bus between ServiceNow and all MID Servers. Understanding the ECC Queue is critical for debugging Discovery issues.

ECC Queue Input vs. Output

Queue Side Direction Contains Who Writes It
Input Queue ServiceNow → MID Server Instructions: "Scan this IP," "Run this probe," "Fetch this API" ServiceNow (Discovery schedule, SGC scheduler)
Output Queue MID Server → ServiceNow Results: raw probe data, connection logs, error messages MID Server (after executing instructions)

ECC Queue Record Fields

  • Agent: Which MID Server this message targets or came from
  • Topic: The type of instruction (e.g., "DiscoveryProbe", "REST")
  • Name: Specific operation name
  • Payload: XML or JSON payload containing the actual data or result
  • State: ready/processing/processed/error
  • Error string: If state is error, what went wrong

Monitoring the ECC Queue for Errors

When Discovery or SGC seems stuck or not producing results, check the ECC Queue: navigate to MID Server → ECC Queue. Look for:

  • Messages in "error" state — read the error_string field
  • Messages stuck in "ready" state for a long time — MID Server may be down
  • Messages stuck in "processing" — a probe is taking too long; may be a timeout issue
📬
Analogy — ECC Queue as an In/Out Box The ECC Queue is like a physical in/out box on a manager's desk. ServiceNow puts assignment slips (Input Queue) in the "in" box. The MID Server employee picks them up, does the work, and puts the results in the "out" box (Output Queue). If the out box overflows with "error" slips, you know something went wrong. If the in box piles up and nothing gets moved to the out box, the employee (MID Server) is absent or overwhelmed.

Worker Threads — MID Server Concurrency

A MID Server doesn't process one Discovery job at a time. It has a pool of worker threads that allow it to handle multiple probe executions simultaneously. This is how a single MID Server can scan thousands of IP addresses efficiently.

How Worker Threads Work

When the MID Server polls the ECC Queue and finds work items:

  1. It picks up multiple items from the Input Queue at once (configurable batch size)
  2. Each work item is assigned to an available worker thread
  3. Worker threads execute probes in parallel
  4. Results are posted to the Output Queue as each thread completes
  5. Threads return to the pool and pick up more work

Configuring Worker Thread Count

The thread count is configured in the MID Server's system properties (not config.xml; these are set in ServiceNow under MID Server → Properties for that specific MID Server):

  • mid.discovery.script.max_count — Maximum concurrent Discovery probes
  • mid.perfmon.max_count — Maximum concurrent performance monitoring probes
  • Default is typically 100 threads; can be increased for high-volume environments
Warning — Too Many Threads Can Overwhelm the MID Server Host Each thread consumes memory and CPU. Setting thread count too high can cause the MID Server process to run out of heap memory (Java OOM errors) or cause the host OS to thrash. Rule of thumb: start with defaults, monitor CPU and memory under load, and increase gradually. More MID Servers (horizontal scaling) is often better than more threads per MID Server (vertical scaling).

Throttling and Rate Limiting

ServiceNow provides throttling mechanisms to prevent Discovery from overwhelming your network or target devices:

  • Max simultaneous probes per MID Server: Limits how many concurrent connections the MID Server makes to target devices
  • Discovery timing policies: Slow down scans during business hours
  • Per-IP rate limiting: Limit how quickly probes run against any single target

IP Range Assignment and Application Routing

Two key configurations control which MID Server handles which work: IP Range Assignment (for Discovery) and Application Assignment (for all work types).

IP Range Assignment

Every MID Server record has a related list of IP Ranges. When a Discovery Schedule fires for an IP range, ServiceNow looks at which MID Server "owns" that range and routes the job there.

Example:

  • MID-US-East owns ranges 10.0.0.0/16 and 172.16.0.0/24
  • MID-US-West owns ranges 192.168.0.0/16 and 10.100.0.0/16

When a Discovery Schedule runs against 10.0.5.0/24, ServiceNow routes it to MID-US-East automatically. If no MID Server owns a particular IP range, Discovery will fail for that range.

Exam Trap — Overlapping IP Ranges If two MID Servers have overlapping IP ranges, ServiceNow selects the MID Server with the most specific (smallest) range. If ranges are equal, ServiceNow may use either. Best practice: design IP ranges so they don't overlap. Overlapping ranges cause unpredictable routing and can result in the wrong MID Server trying to reach an IP it physically cannot access.

Application Assignment

Each MID Server can be assigned one or more Applications — the types of work it handles:

Application What It Enables Typical Use
Discovery Run Discovery probes and patterns against network devices All on-premise infrastructure scanning
Service Graph Connector Proxy API calls from SGC to on-premise data sources VMware vCenter, on-premise monitoring tools
Orchestration Execute workflow activities on remote systems (install software, run scripts) IT automation flows
Event Management Receive inbound alerts from monitoring tools (SNMP traps, REST alerts) AIOps / Event Management integration
IntegrationHub Execute spoke actions against on-premise systems Flow Designer integrations with internal systems

A single MID Server can have all applications enabled, or you can specialize MID Servers (one for Discovery only, one for SGC only) for performance isolation.

MID Server Clusters — High Availability and Load Distribution

A single MID Server is a single point of failure for all on-premise Discovery and integrations. If it goes down, Discovery stops, SGC stops, orchestration stops. MID Server Clusters solve this by grouping multiple MID Servers so they can share and distribute work.

How Cluster Work Distribution Works

  • Cluster members share a common IP range assignment pool
  • ServiceNow distributes work items across available cluster members in round-robin or load-based fashion
  • If one member goes down, the others pick up its queued work
  • New cluster members can be added dynamically without disrupting ongoing work

Primary and Secondary MID Servers

Within a cluster, you can designate a Primary and one or more Secondary MID Servers. For work types that require consistency (like certain SGC connections that maintain session state), ServiceNow prefers the Primary. If the Primary is down, a Secondary takes over.

Cluster vs. Individual MID Server — When to Use Each

Scenario Recommendation
Small environment (< 500 CIs) Single MID Server is sufficient
Production environment requiring 99%+ uptime Minimum 2-node cluster (Primary + Secondary)
Large environment with many IP ranges and CI classes Multiple MID Servers per network segment; cluster within segment
Geographically distributed infrastructure One MID Server per site; IP ranges assigned by site
💡
Tip — MID Servers Must Be in the Same Network Segment to Be Useful Together Clustering two MID Servers that are on different network segments (e.g., one in US-East and one in US-West) doesn't help for Discovery — work distributed to the wrong-segment MID Server will fail to reach the target IPs. Cluster members for Discovery should share network access to the same IP ranges.

MID Server Auto-Upgrade and Version Management

ServiceNow instances are upgraded regularly (twice a year for major releases, plus patches). The MID Server version must stay compatible with the ServiceNow instance version. Auto-upgrade handles this automatically.

How Auto-Upgrade Works

  1. After a ServiceNow instance upgrade, it checks the version of each connected MID Server
  2. If the MID Server version is outdated, ServiceNow pushes the new MID Server installer to the host via the ECC Queue
  3. The MID Server process installs the upgrade and restarts
  4. After restart, the MID Server must be re-validated before it resumes work

Controlling Auto-Upgrade

  • Auto-upgrade enabled (default): MID Server upgrades automatically when the instance upgrades
  • Auto-upgrade disabled: Admin must manually upgrade each MID Server. Risky — an incompatible version may cause errors or disconnection
  • Upgrade window: You can configure when auto-upgrade is allowed to run (e.g., only during maintenance windows)
Exam Scenario — Discovery Stopped After Instance Upgrade "After the organization's ServiceNow instance was upgraded to the latest release, all Discovery schedules stopped producing results. The MID Server status shows 'Upgraded.' What must be done?" Answer: The MID Server was auto-upgraded and now requires re-validation. Navigate to MID Server → Servers → Validate.

MID Server Troubleshooting — Common Failure Patterns

MID Server Shows "Down" in ServiceNow

ServiceNow marks a MID Server as "Down" when it stops receiving heartbeat messages from the MID Server process.

  • Check if the MID Server process/service is running on the host (Task Manager on Windows, systemctl status mid-server on Linux)
  • Check network: can the host reach your-instance.service-now.com:443?
  • Check for proxy changes: many MID Servers run behind a corporate proxy — if the proxy changed, update config.xml
  • Check MID Server logs at INSTALL_DIR/logs/agent0.log.0 for Java stack traces or connection errors

MID Server Is Up but Discovery Produces No Results

  • Check IP range assignment: does the MID Server own the IP range in the Discovery Schedule?
  • Check Application assignment: is "Discovery" enabled for this MID Server?
  • Check ECC Queue for stuck messages
  • Check Discovery Behavior: are the correct probes included?
  • Check if firewall rules on the MID Server host allow it to reach the target IP range

MID Server Memory / Performance Issues

  • Java heap OOM: MID Server ran out of memory. Increase heap size in wrapper.conf: set wrapper.java.maxmemory=2048 (in MB)
  • High CPU: Too many concurrent worker threads. Reduce thread count or add another MID Server
  • Slow probe results: Target devices are slow to respond. Increase probe timeout in Discovery behavior settings

MID Server Logs

Key log files in the MID Server installation directory:

  • logs/agent0.log.0 — Main MID Server process log. Shows startup, connectivity, probe execution
  • logs/boot.log — Startup and JVM initialization
  • logs/mid-upgrade.log — Auto-upgrade events
💡
Tip — Enable Debug Logging for Difficult Issues MID Server log verbosity can be increased via the ServiceNow MID Server record by setting the log level to DEBUG. This captures much more detail about probe execution, ECC Queue communication, and target connection attempts. Remember to return it to INFO after debugging — DEBUG logging significantly increases log volume.

MID Server — Key Facts

  • MID Server = Java app installed on-premise. Makes outbound HTTPS to ServiceNow only. No inbound ports needed.
  • ECC Queue = message bus. Input = instructions from ServiceNow to MID. Output = results from MID to ServiceNow.
  • config.xml = connection config file on MID Server host. Contains ServiceNow URL and service account credentials.
  • Service account needs mid_server role in ServiceNow. Not admin.
  • Validation required before any work can be processed. State: Pending → Up.
  • Re-validation required after upgrade. MID Server goes to "Upgraded" state — admin must re-validate.
  • IP Range assignment routes Discovery work to the correct MID Server.
  • Application assignment controls which types of work (Discovery, SGC, Orchestration) the MID Server handles.
  • Clusters provide HA. Members share IP ranges and distribute work. Cluster members must be in same network segment for Discovery.
  • Worker threads = concurrency. Too many → OOM. Too few → slow. Default 100 threads.
  • MID Server logs are in INSTALL_DIR/logs/agent0.log.0.

Term Grid

config.xml
MID Server configuration file. Contains ServiceNow instance URL, service account credentials, and MID Server name. Lives on the MID Server host.
ECC Queue Input
Messages from ServiceNow to MID Server. Contains instructions: scan this IP, run this probe, call this API.
ECC Queue Output
Messages from MID Server to ServiceNow. Contains probe results, raw data, error messages.
Worker Thread
Concurrent execution unit within the MID Server process. Each thread handles one probe execution at a time. Default pool: ~100 threads.
MID Server Validation
Admin approval step that changes MID Server state from "Pending Validation" to "Up." Required after installation and after each upgrade.
mid_server Role
ServiceNow role assigned to the MID Server's service account. Grants access to ECC Queue, Credential Vault, and CMDB write operations.

Practice Questions

Click any question to reveal the answer and explanation.

1. After setting up a new MID Server, an administrator starts the MID Server process. It shows as "Pending Validation" in ServiceNow. No Discovery jobs are running. What must the administrator do next?
A) Assign IP ranges to the MID Server
B) Restart the MID Server service on the host
C) Validate the MID Server in ServiceNow under MID Server → Servers
D) Update config.xml with the Discovery schedule name
💡 What gates the MID Server from processing any work?
Answer: C — A MID Server in "Pending Validation" state cannot process any work. The administrator must navigate to MID Server → Servers, open the record, and click Validate. This is a required security step to approve the new MID Server before it can run Discovery or any other jobs.
2. Where are the ServiceNow instance URL and service account credentials for a MID Server stored?
A) In the ServiceNow Credential Vault (mid_credential table)
B) In config.xml on the MID Server host server
C) In the Discovery behavior record in ServiceNow
D) In the MID Server record's properties tab in ServiceNow
💡 These are credentials for the MID Server to connect TO ServiceNow, not credentials for scanning targets.
Answer: B — The MID Server's connection credentials (the ServiceNow URL and the service account username/password) are stored in config.xml on the MID Server host. These are separate from target device credentials (SSH keys, SNMP strings) which are stored in ServiceNow's Credential Vault and retrieved by the MID Server at scan time.
3. A MID Server that was previously working shows "Down" in ServiceNow. The MID Server host is online and network connectivity appears normal. What should be checked first?
A) Whether the Discovery schedule is set to Active
B) Whether the MID Server Java process/service is still running on the host
C) Whether the ServiceNow instance has been upgraded
D) Whether the ECC Queue is full
💡 "Down" means ServiceNow stopped receiving heartbeats. The most basic cause is the process stopped.
Answer: B — ServiceNow marks a MID Server as "Down" when it stops receiving heartbeat messages. The first thing to check is whether the MID Server Java process/Windows service is actually running on the host — it may have crashed, been stopped by someone, or failed to start after a reboot. Check with Task Manager (Windows) or systemctl (Linux).
4. An organization has MID Servers in US-East and US-West data centers. A Discovery Schedule for the IP range 10.10.0.0/24 (located in US-East) runs, but the MID-US-West server processes it. The scan fails because it cannot reach those IPs. What is the root cause?
A) The Discovery behavior is misconfigured
B) The IP range 10.10.0.0/24 is assigned to MID-US-West instead of MID-US-East
C) The MID-US-East server is not validated
D) The Discovery Schedule has the wrong MID Server specified
💡 Which configuration tells ServiceNow which MID Server handles which IP range?
Answer: B — IP Range assignment on the MID Server record controls routing. If 10.10.0.0/24 is assigned to MID-US-West (incorrectly), ServiceNow routes that work to MID-US-West, which physically cannot reach those IPs. The fix: remove the IP range from MID-US-West and assign it to MID-US-East.
5. An organization wants their MID Server to handle Discovery AND receive inbound SNMP alerts from monitoring tools. What configuration change is needed?
A) Install two separate MID Servers — one for each function
B) Enable both the "Discovery" and "Event Management" applications on the MID Server record
C) This is not possible — a MID Server can only handle one application type
D) Configure two separate ECC Queues for the MID Server
💡 A single MID Server can handle multiple application types.
Answer: B — A single MID Server can have multiple Applications enabled. Navigate to the MID Server record and add both "Discovery" and "Event Management" to the Applications related list. This allows the same MID Server to run Discovery probes AND receive SNMP alerts from monitoring tools in your network.
6. After a major ServiceNow upgrade, all MID Servers show state "Upgraded" and no Discovery jobs are running. What is the correct sequence of actions?
A) Reinstall all MID Servers from scratch — the upgrade corrupted them
B) Restart the Discovery schedules manually
C) Validate each MID Server in ServiceNow under MID Server → Servers
D) Increase MID Server worker thread count to compensate for the backlog
💡 "Upgraded" is a specific MID Server state that requires one specific admin action.
Answer: C — After an auto-upgrade, MID Servers enter "Upgraded" state and require re-validation before resuming work. The administrator navigates to MID Server → Servers, selects each MID Server showing "Upgraded," and clicks Validate. This is expected behavior after every upgrade — not a bug. Re-validation is the gate.

Practice Questions

4 questions · Select an answer to see the explanation immediately.

MID Server Quiz 1 / 4

How does a MID Server communicate with the ServiceNow instance?

💡 Explanation

B is correct. The MID Server is a Java application deployed inside the corporate network that makes outbound HTTPS connections to ServiceNow. No inbound firewall holes to the MID Server host are required. This design allows it to operate behind strict enterprise firewalls. A describes inbound connections which is the opposite of how MID Server works. C and D are incorrect.

What is the ECC Queue in the context of MID Server communications?

💡 Explanation

B is correct. The ECC (External Communication Channel) Queue is the message bus between ServiceNow and MID Servers. Input queue records = instructions from ServiceNow to the MID Server (e.g., scan this IP). Output queue records = results from the MID Server back to ServiceNow (e.g., probe results). A, C, and D are unrelated to ECC Queue.

A MID Server is upgraded to a new version. What must happen before it can resume processing Discovery jobs?

💡 Explanation

B is correct. After an upgrade, the MID Server transitions to an "Upgraded" state and requires re-validation by an admin in ServiceNow before it can process any work. Validation confirms the MID Server is healthy and trusted. A, C, and D are not required steps after a MID Server upgrade.

What ServiceNow role does the MID Server's service account require in the ServiceNow instance?

💡 Explanation

C is correct. The MID Server service account requires the mid_server role in ServiceNow. This provides the minimum required permissions for the MID Server to poll the ECC Queue and upload results. The admin role would be over-privileged and a security risk. discovery_admin is for human Discovery administrators. itil is for service desk users.

← Discovery Architecture Patterns, Probes & Credentials →