ServiceNow Incidents Are Not Getting Resolved Upon Cancelation of Corresponding Alerts in Aria Operations

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When alerts configured within Notification Rules in Ops are canceled in Ops the corresponding incidents on ServiceNow side are not being resolved (marked as “Resolved”).

Environment

Aria Operations 8.x

Cause

The response time from ServiceNow instance is longer than the value set in ServiceNow Plugin configuration (Connection Timeout). 

Resolution

Problems can arise when the response time from ServiceNow instance is longer than the value set in ServiceNow Plugin configuration. Once the threshold is reached the connection will be closed with a timeout exception, thrown in analytics logs. 

It is recommended to increase/adjust the Connection Timeout from the default 30 sec within the ServiceNow Notification Plugin configuration (Configurations/Outbound Settings). Customer has to empirically figure out the least working timeout interval by starting from 90 sec and incrementing or decrementing the values as needed. Please note that the downside of having too long timeout is that incoming alert rate may surpass notification sending rate, thus making notification queue to be clogged. When this happens (and this happens if there are +10K incoming alert events per analytics node) further incoming alerts will be skipped and thus no notifications will be sent for them. 

Additional Information

It is required to create separate notification rule for alert cancelation since ServiceNow Notification rule uses a single template configuration. It is required to set “Resolution Code” only in alert cancelation notification (a rule accepting just “Cancel” status). New and Update Alert notifications are relayed using separate notification rule(s) that should be assigned “New” and/or “Update” status.