UIM alarms are not closing when the corresponding incident is close/resolved in ServiceNow.
The same can happen with any of the supported Service Desk applications which include the following at this time (May 2019):
Why are UIM alarms not closed when incidents created in ServiceNow by the sdgtw probe are closed/resolved in ServiceNow?
UIM: Any version
sdgtw: 1.40 and later releases
There are 4 possible reasons why UIM alarms are not closed when the corresponding incident is closed/resolved in ServiceNow:
1. The obvious answer is that the "Auto Close Alarm" option from the sdgtw node on the probe's Configure page opened from Admin Console was not selected. This must be selected for this to work.
2. The incident is created in ServiceNow by the user configured in the ServiceNow service desk connection profile. If you log into ServiceNow with that user and close/resolve the incident, the UIM alarm will not be close - this is the default behavior of the probe. If you want the UIM alarm to be closed when the corresponding incident is closed/resolved by the user that created the incident, then you need to change the setting of the acknowledge_alarm_when_incident_resolved_by_any_user key in the setup section to true from the sdgtw probe's Raw Configure GUI.
3. The Service Desk time is behind the sdgtw probe system time and you have not configured the time difference (in minutes) in the "Time difference between Service Desk and CA UIM(minutes)" field from the sdgtw node on the Probe's Configuration page opened from Admin Console. For example, if the Service Desk time is in the PST time zone and the sdgtw probe system time is in the EST time zone, then you need to configure the 180 minute difference.
4. This is not as common, but in some ServiceNow applications, the mapping of the incident state field in ServiceNow has been customized. By default, the probe uses the standard ServiceNow incident state value mappings:
If these values are customized to different values, it is necessary to configure the customized state field mappings in the probe. For example, if the incident state field mappings in ServiceNow are customized to the following:
Then, you must set the sn_customized_status key in the probe to match the customized incident state value mappings in ServiceNow for proper incident handling:
sn_customized_status = New=1,In Progress=2,On Hold=3,Resolved=6,Closed=7,Canceled=8
You will also need to set the value for the key sn_close_incident_state_value if you want to use a different incident state field value for closed incidents (other than Closed or Resolved). For example, using the customized state field mappings above, if you want to use Canceled as the closed incident state (status) value, then you would set the following key value in the probe:
sn_close_incident_state_value = Canceled
All of this is documented in the following sections of the sdgtw AC Configuration techdoc:
(For version 1.20 and later) Advanced Preconfiguration
(Optional) Configure General Properties
Note that the ServiceNow has an incident_state field in addition to the state field which holds the current status of the incident. The sdgtw probe uses the state field to check for closed/resolved incidents if you have the sdgtw probe configured to automatically close UIM alarms when the corresponding ServiceNow incident is closed/resolved.
Items #1 through 3 are applicable to any Service Desk application that you are integrated with from the sdgtw probe.
Item #4 is only applicable to ServiceNow service desk applications.