ServiceNow Incidents will not close. They keep reopening.

I am having an issue with 7 or so incidents that will not close out in my ServiceNow Integration with NPM. I've checked NPM for active alerts related to these incidents and there are none. I have also checked the alert in question(seems to be the same alert - basic up/down alert) that is triggering.

Any suggestions on where to look next?

Find more posts tagged with

ServiceNow

incidents

Alerts

Accepted answers

All comments

shack

Message that is displayed in ServiceNow Incident

"Alert is still active"

dev.null

Same thing happened in our instance. Ended up being a known 'bug' due to NPM version. We're on 12 - apparently this is fixed in a newly(?) released hotfix/patch.

What we did to remediate, since we want the tech to be manually closing INCs anyway, is change the settings on the action under "State Management". Flipped the Reset, Reopen, and Acknowledge State fields to "-- None -- " so Orion doesn't try to take action on the alert. Other items will still populate the work notes, but it doesn't keep flipping the resolved INC back to active/reopened.

Haven't had the problem since.

-R

edit: fixed typo.

shack

We are on NPM 12.1 HF2 that was supposed to of fixed this issue but has not. The steps above were also given to me as a workaround but it is not how the product was designed to function. This is a bug that developers are working on.

dev.null

No worries. Just wanted to offer what worked for us, at least in the short term. Useful to know that when we update it still won't be fixed though, we too were assured a later patch/HF had corrected it.

-R

glsmith67

Do you know has this been resolved? I'm seeing the same issue it does open a new incident for server A and server B. But if server A triggers an alert again it reopens its same old incident again.

All the Reopen state appears to do for me is when an alert resets it sets the Incident to 'Resolved'. If that same object re triggers for that same alert it links the alert to that same incident but leaves the state as 'Resolved' since my Reopen state is set to none. What I would expect is each triggered instance of an alert even on the same object is create a unique Incident number.

zambare.swapnil007

Hi Dev Null,

Regarding your solution for techs to manually close, can you please let me know what are values selected in close code? For me Close code is appearing as None.