Service Patterns Auto-Discovery Guide

An admin screen that shows applications and processes actually observed in your network/DB connection telemetry (netstat, DB connections), and lets you enable or disable them as Normal Service patterns with a single click.

✨ Go to Service Patterns Auto-Discovery →

📋 Overview

The Service Patterns Auto-Discovery page aggregates the program/process names actually observed in the network connection (netstat) and DB connection (db_connections) telemetry collected by giipAgent. It shows whether each one is already registered on the Normal Service Patterns page, and unregistered items can be added as a pattern with one click. Patterns enabled here are used to color matching clients Cyan (sky blue) on the Network Topology (sql3d) screen.

⚠️ This is an admin-only screen. Access requires uLevel >= 50 (a prop-mode value hardcoded in the page). Users below that level are redirected to the home page.

🔍 Screen layout

1. Top header

• Page title: "✨ Auto-Discovery: Service Patterns".
• Intro text explaining that discovered applications come from actual network/database connections in your infrastructure, and clicking Enable adds them as Normal Service patterns.

2. Command bar

Element	Description
🔄 Refresh button	Reloads the discovery list from the server.
Search box	Filters the list in real time by pattern_value (application/process name).
📋 Manage Patterns button	Navigates to /admin/service-patterns to manage registered patterns directly.

3. Discovery table

Column	Description
Application/Process	The observed program name (program) or process name (process)
Type	program (seen via DB connections) or process (seen via netstat) badge
Seen Count	Number of times observed (occurrence_count)
Status	✅ Pattern (already registered) or Not enabled
Action	Enable if not registered, Disable if registered

The footer shows the total number discovered and how many of those are enabled (registered).

🛠️ How to enable/disable a pattern

1. Find the application/process in the list (use the search box to narrow down).
2. If it shows Not enabled, click Enable — it is immediately added as a Normal Service pattern scoped to the current project (csn).
3. If it shows ✅ Pattern, click Disable — the pattern is deactivated (soft delete).
4. While a request is in flight, all Enable/Disable buttons are briefly disabled; on completion a success message appears and the list refreshes automatically.
5. Condition: Disable only works for patterns registered from this csn. Global patterns (csn=0) or patterns owned by other projects follow the permission rules of the Manage Patterns page.

💡 Notes

• Discovery data primarily uses tKVS (netstat/db_connections) records collected within the last 30 minutes. If nothing was collected in that window (e.g. a new project, no agent installed, a test environment), the page falls back to showing the most recent 50 records with no time limit.
• Meaningless values such as unknown, System, and Idle are excluded from the list.
• Discovery only aggregates data from servers belonging to the target csn (tLSvr.CSn). A server must have giipAgent installed and sending netstat/DB connection telemetry for its processes to appear here.
• Enable/Disable take effect immediately via giipfaw (Azure Function) → SQL Server, and the list refreshes automatically afterward.

API Reference

This page talks to the backend through three dispatch commands (via fetchAzureCommand). There is no separate API guide, so the essentials are described here.

Command	Purpose	Key parameters
Net3dServicePatternDiscovery	List programs/processes discovered from tKVS netstat/db_connections, including registration status	csn
Net3dServicePatternPut	Register a discovered item as a Normal Service pattern (enable)	csn, nspId (0 for new), pattern_type, pattern_value, display_name
Net3dServicePatternDelete	Deactivate a registered pattern (soft delete)	csn, nspId

• All three commands may return an RstVal status field. RstVal = 200 means success, RstVal = 401 means an authentication failure (expired session), and RstVal = 403 means no permission for that project.
• A successful Net3dServicePatternDiscovery response is an array of rows with pattern_value, pattern_type, occurrence_count, is_registered, and nspId. When there is exactly one row, the backend (PowerShell ConvertTo-Json) may collapse it into a single object instead of an array — the client normalizes this case.

Troubleshooting

Symptom	Cause	Resolution
Redirected to home immediately	Your uLevel is below 50	Sign in with an administrator account (level 50+).
"Unexpected token '<' ... is not valid JSON" error	(Pre 2026-08-07) The page called a Next.js API route (/api/service-patterns/discovery) that never existed — fixed in giip-issue #938 by calling fetchAzureCommand directly.	Should no longer occur on the current deployment. If you still see it, verify the deployment is current.
"Unauthorized" error message	Session token expired or missing	Log in again, then press Refresh.
"No applications discovered yet."	No recent netstat/DB connection telemetry from servers in the target project (csn)	Verify giipAgent is installed and running on the servers, then retry after data collection.
No new items appear	Falling back to the latest 50 records because there is no data in the last 30 minutes	Expected behavior. Once data accumulates within the last 30 minutes, the page switches to that window.
Top guide button (📖) not visible	Guide mapping missing (older deploy)	It appears once this guide is deployed and indexed.

---

Version: 1.0 Last updated: 2026-08-07 Source file: giipv3/public/help/service-patterns-discovery.en.md