Service Now incidents created by vROps not getting closed after the alert is cancelled
Article ID: 391375
Updated On:
Products
VCF Operations/Automation (formerly VMware Aria Suite)
Issue/Introduction
Service Now plugin in Aria Operations is supposed to automatically close SNOW incidents if configured correctly, however this might not work
Environment
Aria Operations 8.x
Cause
When resolving/closing an incident in Service-Now UI there are certain required fields to be filled in such as Caller and State.
Without specifying those required values, Service Now UI won't allow the user to resolve/close an incident.
The same is true for Service Now API that Aria Operations Service Now plugin calls to resolve/cancel an incident.
Resolution
Caller value should be specified for the default Dev instance of Service Now (see the Caller field in vROps Service Now configuration).
E.g. If the value of the Caller is not specified or the specified value doesn't correspond to an existing user in SNOW database then the API call will return http 403 (Forbidden) failure status and not cancel/resolve SNOW incident (but the alert will be canceled in Aria Operations, because alert cancelation happens unconditionally before notifying Service Now plugin to cancel matching incident at SNOW).
State value should be specified in Service Now plugin configuration.
E.g. If the State is 0 then API call will succeed (return HTTP status 200), but SNOW incident will just get activity update and will not get status update. State value must be 6 to resolve/close SNOW incident.
In order to cancel SNOW incidents using Aria Operations Service Now plugin, the user has to define two notification rules:
1. a rule for New and Update events, containing required config values for New and Update flow (set of required values varies from customer to customer)
2. a rule for Cancel event containing all the required config options for cancel flow. On top of specifying required values, State value must be 6 and provided SNOW-user reference values must match to existing users in SNOW database at a time of alert being canceled.
E.g. If the value of the Caller is not specified or the specified value doesn't correspond to an existing user in SNOW database then the API call will return http 403 (Forbidden) failure status and not cancel/resolve SNOW incident (but the alert will be canceled in Aria Operations, because alert cancelation happens unconditionally before notifying Service Now plugin to cancel matching incident at SNOW).
State value should be specified in Service Now plugin configuration.
E.g. If the State is 0 then API call will succeed (return HTTP status 200), but SNOW incident will just get activity update and will not get status update. State value must be 6 to resolve/close SNOW incident.
In order to cancel SNOW incidents using Aria Operations Service Now plugin, the user has to define two notification rules:
1. a rule for New and Update events, containing required config values for New and Update flow (set of required values varies from customer to customer)
2. a rule for Cancel event containing all the required config options for cancel flow. On top of specifying required values, State value must be 6 and provided SNOW-user reference values must match to existing users in SNOW database at a time of alert being canceled.
Feedback
Yes
No
Powered by
