OpenLM ACC Plugin for ServiceNow

If your organization already runs ServiceNow Agent Client Collector (ACC) on its workstations, the OpenLM ACC Plugin puts those agents to work for the OpenLM Platform. You choose the applications to track in OpenLM Process Manager. The plugin hands that list to your ACC agents, collects what they report, and sends it to OpenLM. You don't install the OpenLM Workstation Agent on those machines.

Finding this in the app

The plugin is a ServiceNow application. In your ServiceNow instance, open All and select OpenLM ACC Plugin. What your ACC agents report appears in the OpenLM Platform in Agent Activity Manager, Process Manager, Agents Hub, and Product Discovery.

Related: Workstation Agent · ServiceNow Connector

How it works

OpenLM decides what is tracked. Your ServiceNow agents collect and deliver the data.

1. You add the applications you want tracked in OpenLM Process Manager.
2. Every hour, the plugin retrieves that list from OpenLM and passes it to the ACC agents on the machines you enrolled.
3. The agents check each machine on a fixed schedule and return the results to your ServiceNow instance through your MID (Management, Instrumentation, and Discovery) Server, as ACC always does.
4. Every minute, the plugin sends the queued results from your instance to OpenLM. If OpenLM can't be reached, the plugin keeps the results and retries.
5. OpenLM receives the data as if it came from an OpenLM agent, so it appears in the same screens and reports as the rest of your OpenLM data.

Data flows one way, from ServiceNow to OpenLM. OpenLM doesn't write anything into your CMDB or other ServiceNow records. The plugin keeps its configuration and its send queue in its own tables.

What your agents report

What the agents report	How often	Where you see it in OpenLM
The machine and its signed-in user: host name, username, IP address, and plugin version	Every hour	Agent Activity Manager, as a ServiceNow ACC Agent row
A heartbeat	Every 5 minutes	The Online status in Agent Activity Manager
The tracked applications that are running, whether each one is idle, and the dynamic-link libraries (DLLs) it has loaded	Every minute	Process Manager Active Processes and Process Sessions
The software installed on the machine	Once a day	Product Discovery
The websites the user visits	Every 15 minutes	Agents Hub Discovered Web Services

The agents report the user who is signed in to each session. When no one is signed in, the username is empty. Each username reported from each machine counts as one agent, the same way OpenLM counts its own agents. An agent shows as online while its heartbeats arrive. It switches to offline when OpenLM receives nothing from that machine for 15 minutes.

Before you begin

You need the following:

• ServiceNow Agent Client Collector, with at least one MID Server and ACC agents installed and registered on the workstations you want to monitor. Each machine must appear under Agent Client Collector > Agents and be linked to its computer record in the configuration management database (CMDB).
• Supported operating systems on the monitored machines: Windows x64; macOS 10.15 or higher on Intel, or macOS 11 or higher on Apple silicon; Linux x86_64 with glibc 2.17 or higher.
• The OpenLM ACC Plugin installed on your instance. You install it from the ServiceNow Store. The OpenLM checks that run on each machine are included in it. The plugin is in the Store publication process; until it's listed, contact OpenLM to get it.
• The OpenLM signing files: sign.zip and sign.crt, plus trust-acc-signing-cert.sh for macOS and Linux machines. OpenLM provides these files. You deploy them in Deploy the signing certificate.
• Outbound HTTPS from your ServiceNow instance to your OpenLM Platform region. The plugin sends data from the instance itself, not through the MID Server.
• A ServiceNow role for the plugin. The x_oplm_openlm_ac_0.admin role sets up the connection, enrolls machines, and runs the on-demand actions. The x_oplm_openlm_ac_0.user role can open the plugin's lists.
• Process Monitoring activated in Products in the OpenLM Platform. Without it, OpenLM sends the plugin an empty process list and discards the process reports.
• OAuth client credentials from OpenLM: a Client ID and a Client Secret for your OpenLM account. The next section shows how to create them.

Get client credentials from OpenLM

The plugin authenticates to your OpenLM account with an OAuth client that you create in OpenLM Identity.

1. In the OpenLM Platform, open Navigation and select Identity.
2. In the Identity navigation menu, under Management, select Authorization.
3. Select Add Client.
4. Set Select Client Type to Agent.
5. Enter a Description, for example ServiceNow ACC Plugin.
6. Select Save.
7. Copy the Client ID and the Client Secret.

warning

The Client Secret is shown only once, when you create the client. Store it in a secret manager until you enter it in ServiceNow. If you lose it, reset the secret or create a new client.

Create a separate client for the plugin, so that resetting its secret affects nothing else.

Choose which applications to track

Your agents report only the applications that are defined in OpenLM Process Manager. That's usually your most expensive or most license-constrained software. Add at least one before you connect the plugin: enrolled machines receive the OpenLM checks only after the plugin gets at least one process from OpenLM.

1. In the OpenLM Platform, open Process Manager and add each application as a process. See Add or edit a process.
2. To track an application by a DLL it loads, attach the DLL to the process.
3. To record when an application sits idle, turn on Track Process Idle/Active Periods for the process. Without it, the application is reported as in use for as long as it runs.

The plugin retrieves the list every hour, right after a successful Save and Test on Set Up Connection, and whenever you select Sync Now. To get it now, in ServiceNow open OpenLM ACC Plugin > Tracked Processes and select Sync Now. The sync runs in the background, so refresh the list after a few moments.

Each row in Tracked Processes shows the Monitoring Target from Process Manager, the Process Key the agents look for (the executable name, in lowercase and without .exe), any DLLs, and when the row was Last Synced. When the list changes, the plugin republishes its ACC monitoring policies and the agents pick up the new list. Nothing needs to change on the ServiceNow side. A process you remove in Process Manager disappears from Tracked Processes at the next sync.

note

If OpenLM returns an empty list, the plugin keeps the list it already has, so a temporary problem can't switch off monitoring. As a result, removing the last process in Process Manager doesn't stop the agents from tracking it. To stop all tracking, pause collection or remove the machines from Monitored Devices.

Connect the plugin to OpenLM

To let the plugin authenticate to your OpenLM account, enter the connection details once.

1. In ServiceNow, open All > OpenLM ACC Plugin > Set Up Connection.
2. In OpenLM Base URL, enter the root URL of your OpenLM Platform region, with no path or trailing slash:
   • prod-us: https://cloud-us.openlm.com
   • prod-eu: https://cloud-eu.openlm.com
3. In Client ID, paste the Client ID from OpenLM.
4. In Client Secret, paste the Client Secret.
5. Select Save and Test.

The plugin saves the values and immediately requests a token from OpenLM. The message Saved and verified — connection to … is working. Tracked-process sync has been started. means OpenLM accepted your credentials and the plugin is retrieving your process list.

The Client Secret is stored encrypted in the ServiceNow credential store. When you come back to the page, the Client Secret field stays empty. Leave it empty to keep the saved secret, or enter a new value to rotate it.

The top of the page also shows whether the plugin is collecting: Plugin is active or Plugin is disabled. See Pause or stop collection.

Message after Save and Test	What to do
Base URL and Client ID are required.	Fill in both fields.
Base URL must start with https://	Enter the full URL, including https://.
Saved, but authentication failed: …	Check the Client ID, the Client Secret, and that the base URL matches the region of your OpenLM account.
Saved, but no access token was returned. Check the credentials.	Check the Client ID and the Client Secret.
OAuth provider record not found (app not fully installed).	The plugin installation is incomplete. Ask your OpenLM contact to check it.

Deploy the signing certificate

ACC agents run a plugin only after they verify its signature, so each agent must be able to verify the OpenLM checks before you enroll its machine. Deploy the OpenLM signing certificate once:

1. Copy sign.zip to each MID Server that your agents connect through, and run the ACC certificate sync.
2. Trust sign.crt in the operating system trust store of each agent host.

For the commands for Windows, Linux, and macOS, and for how to check the certificate's fingerprint first, see Deploy the OpenLM ACC signing certificate.

Choose which machines to monitor

The plugin works only with the machines you enroll. Enrolling a machine is what sends it the OpenLM checks.

1. Open Agent Client Collector > Agents. You can also open OpenLM ACC Plugin > Monitored Devices and select Add from ACC Agents List.
2. Select the check boxes of the machines you want to monitor. To select every machine on the page, use the check box in the list header.
3. Select Add to OpenLM monitoring.

A message confirms the result, for example OpenLM: added 12, skipped 3 already monitored. Policy republishes within 2 minutes. Machines that are already enrolled are skipped, so selecting the button twice is safe. A machine whose agent isn't linked to a computer record is counted as "with no linked CI" and isn't added.

The enrolled machines appear in Monitored Devices. Within 2 minutes, the plugin republishes its ACC monitoring policies so the new machines start running the checks.

The plugin routes each machine to the policy for its operating system: Windows machines to Dynamic_process_monitor_policy, and macOS and Linux machines to Dynamic_process_monitor_policy_mac_linux. The Target Policy field of each device shows which one it uses. You don't need to choose.

To stop monitoring a machine, open it in Monitored Devices and clear Active. The plugin republishes the policies within 2 minutes.

Enroll every machine automatically

To enroll every machine that has an ACC agent, set the system property x_oplm_openlm_ac_0.auto_enrol_agents to true. The plugin then adds any new ACC machine to Monitored Devices every hour. The property is false by default, so you choose the machines yourself.

Verify the setup

After you connect the plugin and enroll machines, check each link in the chain:

1. The machines are healthy. In OpenLM ACC Plugin > Monitored Devices, each machine shows Health Status Healthy. To check a machine again now instead of waiting for the 15-minute check, open it and select Health Check Now.
2. Results are reaching OpenLM. In OpenLM ACC Plugin > ACC_Payloads, new rows move to the processed state within a minute or two.
3. The agents appear in OpenLM. In Agent Activity Manager, filter Agent Type to ServiceNow ACC Agent. The enrolled machines appear within about 5 minutes, when their first heartbeat arrives.
4. Usage is recorded. Start a tracked application on an enrolled machine. It appears in Process Manager Active Processes within a few minutes.

Check device health

To see which enrolled machines aren't reporting, and whose job it is to fix each one, open OpenLM ACC Plugin > Monitored Devices. The plugin evaluates every active machine every 15 minutes and fills in these fields:

• Health Status: the result, explained in the table below.
• Health Issue: what's wrong, in plain words.
• Suggested Action: what to do about it.
• Owner Layer: where the problem sits: ACC Agent, OpenLM Plugin, or ServiceNow(ECC).
• Agent Last Seen and Health Checked At: when the agent last checked in, and when the plugin last evaluated the machine.

Health Status	What it means	What to do
Healthy	The agent is running and the machine receives the OpenLM checks.	Nothing.
No Agent	No ACC agent is installed or registered on the machine.	Install and register Agent Client Collector on the machine, confirm that it appears under Agent Client Collector > Agents, and then make the device active again.
Agent Offline	The agent is down, disconnected, or not operational, reports faults, or hasn't sent a keepalive for more than 15 minutes.	Check that the machine is on, restart the Agent Client Collector service, confirm that the agent can reach its MID Server, and review any faults on the agent record.
Not Published, with Health Issue "Waiting for configuration from OpenLM…"	The plugin hasn't received a tracked-process list from OpenLM yet, so it holds every enrolled machine back.	Complete Connect the plugin to OpenLM, or select Sync Now on Tracked Processes. If the list stays empty, add at least one process in Process Manager.
Not Published, other cases	The machine isn't among the targets of its OpenLM monitoring policy, so it doesn't receive the checks.	Make sure the device is Active and linked to the correct computer record. If it's still missing after 2 minutes, check the publish status of the device's Target Policy under Agent Client Collector > Policies.
Transport Error	The ECC queue has errors for this agent (topic MonitoringProbe) from the last 60 minutes.	Review the ECC queue records in the error state for the agent, and check the MID Server's capacity and connectivity.

Check delivery to OpenLM

Every result an agent returns is queued in the plugin before it is sent. To see whether results are reaching OpenLM, open one of these lists under OpenLM ACC Plugin:

• ACC_Payloads: every queued result.
• Egress – Pending/Retry: results waiting to be sent, soonest first.
• Egress – Failed (dead-letter): results that couldn't be delivered, newest first.

Each row has a state:

State	What it means
pending	Waiting to be sent. The plugin sends queued rows every minute.
sending	Being sent right now.
retry	Sending failed because OpenLM couldn't be reached or returned a server error. The plugin tries again later.
processed	OpenLM accepted the result.
failed	The result couldn't be delivered. The last_error and last_response fields say why.

When a send fails because OpenLM can't be reached or returns a server error, the plugin retries with a longer wait each time: about 2 minutes, then 4, 8, 16, and 32. After the sixth failed attempt, the row is marked failed. When OpenLM rejects a result as invalid, for example because it is too old, the row is marked failed right away, without retries. After 10 failed sends in a row, the plugin pauses sending for 5 minutes and then tests the connection again by itself.

To send failed or waiting results again:

• To resend one failed result, open it and select Re-queue.
• To retry everything that is waiting now instead of at its scheduled time, select Resume egress on the list.

The plugin deletes processed rows after 10 days and failed rows after 30 days.

warning

OpenLM rejects results that are more than 48 hours old, or more than 5 minutes in the future. If the pending queue keeps growing, raise x_oplm_openlm_ac_0.egress_batch (see Plugin settings) before the backlog ages past that window.

Pause or stop collection

To stop the plugin from queueing and sending anything, set the system property x_oplm_openlm_ac_0.plugin_active to false. An administrator can open the property from the Change setting link on the Set Up Connection page. Set it back to true to resume.

The plugin also discards results in two other cases:

• When no machine in Monitored Devices is active. That way, an agent that still runs an old check can't send data about a machine you removed.
• When the connection details are removed, because there is nowhere to send the results.

Plugin settings

The plugin reads these ServiceNow system properties. The defaults suit most instances.

Property	Default	What it controls
x_oplm_openlm_ac_0.plugin_active	true	The main switch. When false, the plugin queues and sends nothing.
x_oplm_openlm_ac_0.auto_enrol_agents	false	When true, every machine with an ACC agent is added to Monitored Devices every hour.
x_oplm_openlm_ac_0.egress_batch	1000	The number of queued rows the plugin sends per minute. As a guide, set it to about 1.3 × the number of monitored agents. The default supports about 780 agents.
x_oplm_openlm_ac_0.egress_max_events	900	The most results the plugin sends to OpenLM in one request.
x_oplm_openlm_ac_0.egress_max_bytes	4000000	The largest request the plugin sends to OpenLM, in bytes.
x_oplm_openlm_ac_0.egress_max_retries	6	How many times the plugin tries to send a row before it marks the row failed.

Limitations

• No automatic license release. ACC agents report usage, but they can't close idle applications. The Automatic Process Release rules in Process Manager don't act on machines monitored through the plugin.
• Some details aren't sent. OpenLM doesn't receive CPU or memory use, MAC addresses, operating-system versions, domains, software install dates, or website visit counts from ACC agents.
• Agent management stays in ServiceNow. You install, update, and restart ACC agents with your ServiceNow tools. The upgrade and restart actions in Agent Activity Manager apply to Workstation Agents only.

Troubleshooting

Problem	Cause and fix
Save and Test reports an authentication failure.	The Client ID or Client Secret is wrong, or the base URL points to a different region from your OpenLM account. Check all 3 values. Make sure the client's type is Agent.
Every machine shows Not Published with "Waiting for configuration from OpenLM…".	The plugin hasn't received a process list yet. Add at least one process in Process Manager, and then select Sync Now on Tracked Processes.
A machine never appears in Agent Activity Manager.	Check its Health Status in Monitored Devices and follow the suggested action.
The machine's ACC log shows couldn't verify asset or x509: certificate signed by unknown authority.	The agent can't verify the OpenLM checks. Deploy the signing certificate to the MID Server and the agent host.
A tracked application doesn't appear in Active Processes.	Open Tracked Processes and confirm that the application is listed. If it isn't, select Sync Now. Make sure the machine is Healthy in Monitored Devices, and that Process Monitoring is activated in OpenLM.
An application never shows idle time.	Turn on Track Process Idle/Active Periods for the process in Process Manager.
Tracked Processes doesn't change after you edit Process Manager.	The sync runs every hour. Select Sync Now to get the list immediately.
Rows pile up in Egress – Pending/Retry.	OpenLM can't be reached from your instance, or the send rate is too low for your fleet. Check the last_error field, and raise x_oplm_openlm_ac_0.egress_batch if the queue keeps growing.
Rows land in Egress – Failed (dead-letter) with HTTP 401 or HTTP 403.	OpenLM rejected the credentials. Run Save and Test again on Set Up Connection, and create new credentials if needed.
Rows land in Egress – Failed (dead-letter) with rejected (hard).	OpenLM rejected some of the results. Check last_response for the reason. TIMESTAMP_OUT_OF_RANGE means the results were more than 48 hours old or the machine's clock is wrong.

Common questions

Do I still need the OpenLM Workstation Agent? No. The ACC agents replace it for the data listed in What your agents report. You can still run the Workstation Agent on some machines, for example where you need automatic license release. Each agent then appears as its own row in Agent Activity Manager.

Where do I choose what gets tracked? Applications are defined in OpenLM Process Manager. Websites to monitor are managed in Agents Hub: review what the agents discovered in Discovered Web Services, and approve the ones you want as Touch Point Event Sources.

Does OpenLM change anything in my ServiceNow instance? No. OpenLM doesn't write into your ServiceNow records. The plugin stores its own settings, the tracked-process list, and its send queue in its own tables, and publishes its own ACC monitoring policies.

Is my data kept separate from other customers' data? Yes. Every request from the plugin is authenticated with your OpenLM account's credentials, and OpenLM decides which account the data belongs to from those credentials alone.