What is the definition for Software Instances and Packages? What are the differences between these CIs? Why are these CIs categorized differently for seemingly similar information?

Foundation works by collecting data together and then making inferences based on the collected data.

For example, Discovery logs on to a host and collects information about the processes that are running on it. It stores the gathered information as nodes in the datastore. If it subsequently sees a node for “/usr/apache/bin/httpd”, then it may (after some more investigation) conclude that the software called “Apache Webserver” is installed on that host and create a Software Instance node.

That’s the difference in a nutshell – a package is a node that discovery creates when it scans a host and retrieves its package list, whereas a software instance is a node that is created because Foundation decided that a piece of software is installed on a host. The former is “directly discovered data”, or DDD, and the latter is “inferred data”.

In the Foundation UI, you can click on the “show provenance” button on any inferred data (Software Instance, Business Application Instance, etc) page to see how Foundation came to its conclusion.

Thanks for the explaination. I understand the difference between discovered and inferred data, but I guess the question now is, how can this distinction be useful? Out of the few servers that I have discovered, there are only a very small handful of Software Instances listed, while there are numerous Packages listed. How can this data then be reported on or aggregated to show meaningful information?

It seems that the list of Packages contains many duplicates either from various versions or different locations. The Software Instance list also contains duplicates, but excludes most of the software actually installed each server. What is the best way to create a report of distinct applications across these discovered servers?

Typically the Software Instances represent a running instance of software discovered when scanning a host, whereas the packages represent installed software components.
For example: – if you wanted to answer the question “Do my Solaris hosts all have security patch 112 installed?” you would use the packages. – if you wanted to answer the question “Do I have Oracle installed on the host, running or not?” you would use packages – (note that this approach assumes the software was installed using the OS packaging system) – if you want to answer the question “What Oracle databases are running on my network?”, which is the more common, then you would go to the Software Instances.

Another example: knowing that VMware is installed can be achieved via packages; but knowing that there are 11 VMs running cannot. Equally it’s much easier to derive the version of VMware from the package information that from a running process. Join together the knowledge of running processes and package information and we can infer that there are 11 VMs running under VMware version X.

So Software Instances are a way of collating discovered processes, packages and other information together, to infer something that does not have a one to one relationship with any of it’s constituent parts – you could think of it as the “and therefore…” layer.