SolarWinds Two-Way integration with Ticketing Systems

Hello

I have a couple of questions:

Q1: Does Orion recommend (even unofficially) any fully automated (without manual coding) 3rd party tool that allows smooth Two-Way integration with Major Ticketing systems like :

- BMC: Remedy

- HP: ITSM / HPSD / HPSM /HPSC, etc ... ?

- CA: IT Service Desk

Must guarantee closing Ticket when Node/Interface is Up without delay

Q2: If not, which one would you guys recommend ? Something that really works without push

Thank you

Find more posts tagged with

Accepted answers

All comments

RichardLetts

They have integration with ServiceNow -- I don't know if it will do what you want, but I think it will.

We have service now, but do not use the API because:

a) we had something years before Solarwinds built their API

b) we don not resolve incidents automatically when service is restores.

I am the ITIL Event and the Incident process manager in my department; I feel that resolving incident tickets immediately that an interface or node restores may be a bad idea process-wise. It might be a good idea to note the time that service is restored in the incident record automatically or update a public status board, but I feel NOC staff ought to be looking at these records, e.g. to request a RFO from a carrier, create a problem record to have UPS installed, power recabled, busted switch replaced, or a myriad of other things that could prevent future incidents.

[My team works about 2000 incidents/ month, of which at least 2/3rd were created automatically by Orion NPM]

I feel Every Alert / incident should have actions performed by the NOC, even if the action is to turn down the alert.

dodo123

Im looking at API using the get and post in the actions of an alert.

Using Manage engine as the ticket system.

So would see if any of them have instructions for there api

pratikmehta003

i believe two way should be possible now as well. If solarwinds sends down alert and then and Up alert for reset, the ticketing system should have the rules to understand that and close it...in my experience this is what i have seen it. Not only Solarwinds but it could be any other tool.. The monitoring tool send the traps/email or through API and the ticketing system has some rules or there will be a Manager Of Manager(MoM) which correlates in its bucket and then sends to ticketing tool....

austinjpoirier

The company I am currently at uses the Service Now integration. It works pretty well but has some bugs.

At a previous gig. We sent all Solarwinds tickets to our helpdesk's queue. Then literally through custom SQL and our naming standard having all nodes in 'x' site with the same naming standard (CHICAGO) for example we would auto-route the ticket to the Chicago queue. We added a custom property for the 'app' a device supports and gave the helpdesk a key for datacenter servers. The helpdesk would then reference the key and assign the ticket to 'x' team. (IE: Application = AutoCad. AutoCad = IT Engineering team). It wasn't perfect and we didn't get all the way there but it was good enough to resolve issues as if we saw a server go down or something it was all hands on deck

sdubick

I'm having issues with the integration. I have solarwinds creating an incident ticket when a node goes down. The ticket is in NEW status. I don't want Solarwinds to update the ticket when the device is back up as you mentioned...there are several reasons why the device went down to begin with and the NOC will need to answer those in the ticket manually. My problem is that when the same device goes down the original ticket is being updated and I need a NEW ticket created. Solarwinds support thinks it's something on the Servicenow side that is preventing this but not sure. I see a correlation ID on the ticket which I assume is sued to talk back to Solarwinds. I tried various ways to mark the state management side of things in Solarwinds and can't resolve this. My current alert triggers an email each time a device goes down (regardless how many times) which works as designed. Appreciate if you can provide some insight. I just want a new ticket opened and not worry about having solarwinds close it when an alert is reset. Thank you

pratikmehta003

are you using default integration which Solarwinds provide OR different method?

sdubick

How can I tell...I'm on NPM 12.1.....I don't have access to the Servicenow side of things...I thought when you don't check the box on the summary page of my alert to not integrate then solarwinds would have servicenow create a new ticket each time my device goes down. I have tried both ways unsuccessfully (checked or unchecked). I don't want the incident ticket closed/resolved/put in active status...I only need to create a ticket in NEW status each time the alert triggers (an email is sent each time the alert is triggered already today).....something with the correlation id i think is messing me up but not sure....I would think when the device is back up the alert would not show up in the active alerts view which signals solarwinds database to clear the entry and removed the old incident ticket from the database. Appreciate your feedback and insight. thank you

vinay.by

Hi sdubick,

I just read the entire thread and there are 2 ways to handle this scenario either reopen the ticket or get a rule set on SNOW as mentioned below (I dont think this is an issue, it looks me as a generic standard rule and functionality which is causing this to happen between SolarWinds and SNOW).

SolarWinds fires a alert -> createSNIticket (action) -> SNOW (receives it and as well receives the state of the ticket say NEW for example) -> SNOW assigns this to an assignment group and changes the state of the ticket to IN PROGRESS and as well sends back the ticket id to SolarWinds.

1. Now this is the part that you are looking for, in case SolarWinds sends a clear alert (the status of the ticket is changed to RESOLVED), if a new alert is fired on SolarWinds immediately (this is actually based on CLOSED rule on SNOW) it would still think the ticket exists with SNOW and will update the same ticket without changing the state from RESOLVED to NEW/something else, if you want to change the state from RESOLVED to INPROGRESS use the REOPEN section in SolarWinds createSNIticket action where you can tell SNOW to change the state from RESOLVED to INPROGRESS etc when an new alert is fired within SolarWinds immediately (but remember this will affect the SLA of the ticket - you have already mentioned this isn't your requirement hence we could move on to point 3).

2. Note: SolarWinds will not create a NEW ticket in SNOW, unless the old ticket state is changed to CLOSED. I am assuming this is how it works, please correct me if I am wrong and this is the same scenario that you encountered. (SNOW team could have set a generic rule like say RESOLVED TICKETS > 5 days = CLOSED sate on the tickets, all resolved state tickets which are greater than 5 days will be moved to CLOSED state).

3. If you want to implement what you are looking for ('create a NEW ticket each time a node goes down'), you should ask SNOW folks to write a rule on their end to change the state of the ticket to CLOSED as soon as the ticket state is RESOLVED on SNOW (they can write a new rule for solarwinds-integration-user alone and keep it specific for the tickets that are created by SolarWinds, this would not affect their integration with other tools/applications).

Hope it helps

nks7892

Yes It is possible - and it depends what type of integration method you are going to use.

1. Email to Event (Incident) - Where Solarwinds Sends Email alerts for Up and Down events and then ticketing system picks them up based on email content.

2. API/Ticketing System native utilities - Where solar winds generates events in its own system then either Ticketing system pulls those events or Solarwinds Oushes those events to third party ticketing system.

In both the scenarios it is possible to get tickets opens and closed as an when desired condition is met like in BMC you can use Email to Event Integration method for opening a ticket when Node Down Alert comes and close the ticket when Node Up Alert comes. But this will require manual coding efforts in BMC to handle those scenarios. You take any tool some sort of configurations will be required to start this.

Solarwinds support Service-Now and has given direct integration method but again this will require manual configurations in Service now and this will give you most of the things done but I am sure that you will need more further since it is just basic feature they have provided with in built feature so to make best use of integration you need more configurations in Solarwinds and Service Now both, like going with API method instead of inbuilt feature that will again need logics to be built at both ends.

Good luck.

sdubick

Your best method would be to have your Servicenow Incident ticket appear as if it was closed in Solarwinds SNIalerts table (code=3) when someone moves a ticket from NEW to Active. You always want a new ticket opened each time the device goes down (unless it goes up/down multiple times in a short time frame before someone had a chance to move the ticket to ACTIVE). This can be accomplished on the Servicenow side. Get access to Solarwinds alert Integration tab in Servicenow and there is a configuration item for closed states. Currently it will be set to 7,8 and you need to add all states from active to closed in this item (i.e. 2,3,4,5,6,7,8). Remember, servicenow thinks the ticket is active but, solarwinds will consider it closed so it wont reopen the same ticket. Works good. Let me know if this helps