ServiceNow Incident Creation Reopens Ticket

Just trying to figure out if anyone else has found away around this with the ServiceNow integration feature.

I'm having trouble trying to generate a new incident each time an alert in Solarwinds is generated for a specific event. Even if the alert is for a repeating offender.

Example: Switch (A) goes offline and and alert gets generated and Incident is created in ServiceNow. Well if that incident gets closed, and Switch (A) goes offline again a couple of days later, it reopens the original incident instead of logging a new one.

Find more posts tagged with

Alert

solarwinds

ServiceNow

npm

Accepted answers

llemieux

The information provided by LadaVarga about adding the proper close codes within the Solarwinds properties of the SeviceNow integration, along with making sure that you have the "Reopen State" set to "None" within the trigger condition of the Solarwinds incident creation alert, resolved my issue.

All comments

LadaVarga

Hello llemieux,

could you please check your closing states in ServiceNow:

2017-04-05 10_37_42-ServiceNow.png

there should be all states which you consider as "Closing states".

If you dont have rights to this, please ask your ServiceNow admins to fill what is neccesary.

When incident will be in "Closing state" it will not update the old one but create new one.

Lada

shack

Do these closing states in the picture below correlate with the closing states above that are mentioned as being 7, 8?

The picture below was taken from the service now alert trigger action.

Closing States.png

llemieux

Hey Shack,

Yes, they do. I'm not sure which specifically codes 7 and 8 reference, but for my particular situation, I was using the "Solved (Permanently)" so our ServiceNow Administrator needed to add the close code of (3) in the SolarWinds Integration Preferences as shown by LadaVarga.

I then have our ServiceNow alert trigger set to the following. Obviously, set yours to how you need them, but for us we wanted to have a new incident generate each time this alert triggered, even if it was the same node. So it was crucial we found to leave the "Reopen State" set to "None". The wording SolarWinds used underneath this action is very misleading. They should remove the "and the incident is not yet closed".

SolarWinds Incident.JPG

shack

I think when I created all of the alert actions for ServiceNow they all defaulted to Solved(Permanently) like you mentioned. I am working on getting access to look at those codes in my SN instance but I bet this is where my problem is.

Thanks for getting back quickly.

lsalinas

I have this same issue.

So where does ServiceNow/SOlarwinds start counting?

Is "None" = 0 , or 1?

llemieux

Hi Isalinas,

As far as what the close code numbers specifically reference is beyond me as I don't have access to this portion of our Service-Now instance. What I do know is that what ever the closing state you specify in the state management section of the incident creation trigger of SolarWinds must match the close code used within the SolarWinds integration piece in ServiceNow. Specifying "None" within the incident creation trigger should prevent any incidents from reopening should the same node trigger the same alert.

nseth

Hi LadaVarga,

Firstly, Thanks for resolving the issue of reopening incidents.

After the change in the closing states of service now, i am now able to resolve the issue of reopening incidents. Just FYI, I am now using 6,7,8 as closing states in service now. Before the change, it was 7,8 in closing states which was not allowing me to create different incident for each alert.

But I came across one more issue after the change in states field which is that if anybody resolves the incident accidentally or purposely even when the alert is active on solarwinds, it resolves the incident and does not reopen stating that alert is active. It used to do this before but not after the change which is not good because the team will never work on this incident assuming that the alert is cleared and ticket is also getting resolved successfully.

Can you please me help me this issue ASAP.

smalasani299

Hello nseth,

Did you find any workaround or solution for this issue ?

we also having the same issue , incident state is setting to resolved even their is active alert in solarwinds.

Thanks

Sandeep

axg4437

Hi ,

Am facing the same issue any fix for this ..

The ticket reopen stopped using the property 6,7,8...

But if any one close the ticket without fix it is not getting re-open ..

axg4437

Any update on the above issue