cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 12

Solarwinds-ServiceNow Integration Issues (Sometimes old Incident gets reactivated)

Hi All, We are experiencing an issue in Solarwinds-ServieNow Out Of the Box integration method i.e. via Service Now Create Incident Action.

Below are the configurations we have done -

1. Service Now Create Incident Action is configured in Trigger Action.

2. No action is configured in RESET Action since we do not want to close ticket automatically (It needs to be closed manually).

Issue -

Sometimes when any device goes in down state - instead of creating of a new incident we get the old incident updated in Service even though ticket is already in closed state.

In that case - Incident state remains in Close State while we get work notes updated as - Incident has been re-activated and we can same old incident in Solarwinds Active Alerts.

Has anybody seen this issue before and if yes then what is the resolution for the same.

0 Kudos
47 Replies
Level 8

Hi Community,

We too have the problem with SolarWinds opening Closed tickets.  We are having major issues with P1 and P2 incidents and our SLAs. We have opened a ticket with SolarWinds support (last Wednesday (NZDT)) and told them it was urgent... we are yet to have any meaningful interaction with them.  Given the gravity of the situation we are having to reverting to sending email to ServiceNow.

Note: our requirement is for manual ticket resolution and closure.  SolarWinds can create and acknowledge a ticket only.

0 Kudos

Hi @zeb146,

From your inputs, I can understand that, SolarWinds should create & acknowledge an alert. But the resolving & closing aspects can be done manually. 

My questions to better understand this are,

1. Once the ticket is resolved or closed, did you feed SolarWinds the same from ServiceNow..?

2. Also, have you tried my previous comments on your infra..? I mean index values & closing state options. 

 

If these two are fixed from SolarWinds, then the problem should be on ServiceNow Business Rules. As the integration is now an API connectivity, we have to check from both the ends on this aspect. 

 

Thank you..!!

 

Regards,

Solaiy.

0 Kudos
Level 7

Even i too have same issue

Hi Solarwinds Team,

 

Kindly have a solution for this asap since we are getting trouble in workflows what we defined in our organization and our  Operation teams completely depends on SN tickets for  alerts.

0 Kudos

Hi @shiv17994 ,

You need to check the choice values for "Close" option on ServiceNow Incident table & input the same under SolarWinds Alert Integration-->Configuration-->Properties-->Closing states.  (By this you are feeding the Close state value/information to SolarWinds).

Let me know if further information needed.

 

Regards,

Solaiy.

0 Kudos

Yeh, we have a state defined according and it working perfect for most of the incidents but few have this issue

shiv17994_0-1603810744945.png

 

i opened the case as well

00642576

0 Kudos

Hi @shiv17994,

Eventhough, you have defined as per your screen-shot, you need to check this index values as well. 

 

This index values, plays a major role in re-activating the old incidents. 

You need to check the choice index values for "Close" option on ServiceNow Incident table & input the same under SolarWinds Alert Integration-->Configuration-->Properties-->Closing states.  (By this you are feeding the Close state value/information to SolarWinds).

Regards,

Solaiy.

0 Kudos
Level 8

have you solve this ..i am getting same issue in 2019.4 version
0 Kudos

Hello @dharmbodh,

Sorry for the delay in reply. Haven't noticed it. 

To answer your question, YES, we have managed to solve it. Please let me know if further info needed.

Regards,

Solaiy.

0 Kudos
Level 7

Hi,

i want my incidents to get closed autolmatically when alert is reset. Kindly help me with configuration to be done from solarwinds end to have the INC closed automatically.

 

0 Kudos

Hi @jaspr ,

 

Closing the INC when the alert got reset is a default behavior. In this case, do not feed any reset & reopen options under "State Management" on Create Incident Action Tab. Direct it to the Closure code. 

 

If the above is not working, you need to check the choice values for "Close" option on ServiceNow Incident table & input the same under SolarWinds Alert Integration-->Configuration-->Properties-->Closing states.  (By this you are feeding the Close state value/information to SolarWinds).

Let me know if further details needed.

 

Thank you..!!

 

Regards,

Solaiy.

0 Kudos
Level 9

Hi. We are also facing this issue in our environment and wanted to know resolution of this issue. working with solarwinds support on case 00541341. 

 

Any help will be appreciated. 

0 Kudos

Hi devrajs,

 

Even we have been facing the same issue. INC# that are closed are getting updated stating "Orion alert re-activated".

Did you got any solution for this..?

 

Regards,

Solaiy.

 

 @devrajs @nks7892 

0 Kudos

 

Yes @nks7892 , We did those changes in alert integration settings in service now to properly mention closing states but it didn't resolve the issue. we still have closed incidents that get updated

We are facing another issue now that incidents are not getting auto resolved when alert resets in solarwinds. 

Both the above problems are being faced intermittently. some days it works fine and some days it doesnt. That has bought reliability issues with the platform. 

 

@Solaiy  - Not yet, we had a call with application engineer at solarwinds yesterday. he will be taking this to the development team to work on the issue. 

0 Kudos

Thanks @devrajs for your quick response. 

It would be really helpful, if you keep us updated here in Thwack. I too have opened an support case for the same issues you have been facing. I'll update too if I get any solution.

 

Regards,

Solaiy.

0 Kudos

My production is deeply impacted all our P1 and P2 alerts are now being updated on the old incidents. This has raised questions with the credibility of the functioning of solarwinds as reporting of alerts and incidents to support teams is as important as the monitoring of health of infrastructure. No matter what we monitor in our infrastructure if we cannot report it in right way, i will not matter. 

 

To fellow thwackers, i am checking if you got any serious fix on this issue as its open since year 2018. Your experience in handling this matter can help me resolve issues in my environment.

Request @nks7892  @ray_omp  @jameslindsay  @rajeshagnihotri  @shack  to share there experience in handling this issue.

0 Kudos

Hi Devrajs,

We were able to fix this issue by modifying the logic at payload processing. If you are using out of the box integration then better ask Servicenow team to redefine payload configuration from scratch (take reference from solar winds by-default) as per your need instead of using by-default.

0 Kudos

Hi

Can you please guide what business logic need to change to fix the issue 

0 Kudos

Hi @ray_omp,

Just go with default values at first. Both Snow API & SolarWinds are purely intended towards default values. I mean the index values on the ServiceNow. Also, you need to update the index values on Snow as in SolarWinds.

Regards,

Solaiy.

0 Kudos

Can you please elaborate more on index

0 Kudos

Hello,

You need to check the choice values for "Close" option on ServiceNow Incident table & input the same under SolarWinds Alert Integration-->Configuration-->Properties-->Closing states.  (By this you are feeding the Close state value/information to SolarWinds).

 This index values, plays a major role in re-activating the old incidents. 

 

Regards,

Solaiy

0 Kudos