How Nodes Get Removed

It is important that the model of your network environment stays valid (current) over time and that it is maintained efficiently. This does not only involve creating new nodes to represent recently discovered data. Equally important to this is the removal of existing data which is no longer present in your environment. The way in which Tideway Foundation views the environment enables different kinds of nodes to be removed in different ways. Different methods are used to remove Inferred Nodes and Directly Discovered Data Nodes from the model.

Inferred Nodes Removal

There are five different ways in which you can remove inferred nodes from Tideway Foundation. See Inferred Nodes.

1. Authoritative Removal

Tideway Foundation has inferred the presence of a node from data such as an interface list, where there is clear evidence that the node exists. When Foundation cannot see any evidence of this node, it no longer exists. Foundation then removes the node automatically from the model. Aging is not applied to this type of removal.

2. Non-Authoritative Removal

Tideway Foundation has inferred the presence of a node from data such as a process list, where there is clear evidence that the node exists. However, in these cases when Foundation cannot see any evidence that the node still exists, it does not necessarily imply that the node no longer exists. There may be a number of reasons why the node appears to no longer exist.

An example of this is a process that relates to a Software Instance. A desktop application such as Adobe FrameMaker may be seen to be running during an initial scan and then not running on a subsequent scan. This does not necessarily indicate that Adobe FrameMaker no longer exists, it may be that the user has stopped running the application during the subsequent scan.

Aging is therefore applied to this type of removal in order to prevent frequent removals and recreates. When the node has been in the Aging state for a certain period of time, it is then removed from the model.

3. Secondary Authoritative Removal

This type of removal is authoritative, however it is based on different criteria than the original evidence for its existence.
An example of this would be a batch process, where a node creation (and therefore existence) is triggered from seeing the job running in the process list, but Tideway Foundation may check the timestamp of a log file to see if it believes it is running regularly.
This type will apply to any removal which involves actively seeking evidence about whether something exists.

4. Containment Removal

This type of removal applies when Tideway Foundation has inferred nodes which have a containment relationship to another node. These are generally nodes which model physical items such as network interface cards. If the non-authoritative removal process (Aging) has caused Foundation to remove a host, then the network interfaces that are contained in that host will also cease to exist. Therefore, Aging is not applied and the inferred node is removed.

5. Cascade Removal

This type of removal applies where further inferred nodes are constructed from first order or other inferred nodes. Any aging or specific removal will already have taken place at the first order nodes, so there is no need to apply any further removal strategies. In this case the removal should cascade up.

Directly Discovered Data Nodes Removal

The removal process for Directly Discovered Data Nodes, see Directly Discovered Data Nodes, is a much simpler process than it is for Inferred Nodes.
The five removal strategies for Inferred Nodes calculate that the entity in the real-world to which the data corresponds no longer exists and therefore the node is removed. Each time you run a discovery of DDD Nodes, a new set of data is retrieved. If the data is older than a certain cut-off point and Foundation discovers more recent data which refers to the same node, the node is removed.