VMware Aria Operations for Logs notifications blank on ServiceNow

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When configuring a ServiceNow Webhook integration in VMware Aria Operations for Logs, notifications may fail to send, or the alert description may appear empty.

Or similarly:

• Internal Server Errors: Runtime logs (/storage/var/loginsight/runtime.log) indicate ServiceNow responds with an "Internal Server Error" when an alert is triggered.

• Empty Descriptions: Test alerts sent from the UI show no description/Null in ServiceNow. 

• Parsing Failures: ServiceNow is unable to parse the message string if the payload is improperly formatted.

Environment

VMware Aria Operations for Logs (formerly vRealize Log Insight)

Cause

There are two primary causes for this behavior:

• Test Alert Limitation: The "Test Alert" function evaluates static content only and does not evaluate the dynamic content or metadata of the alert itself, resulting in an empty description field during testing.
• Payload Configuration: ServiceNow cannot consistently parse descriptions that contain multiple parameters combined with free-form messages. Including several parameters in the description field often leads to an internal server error on the ServiceNow side.

Resolution

To resolve this issue, you must simplify the alert payload and verify the configuration with a live trigger rather than a test notification:

Clean the Description Field: Modify the webhook payload to ensure the description contains only one parameter.

Remove Multiple Parameters: Avoid mixing multiple dynamic parameters with static text strings in the ServiceNow description field, as this is not a recommended configuration.

Clone and Re-verify:

• • Clone the existing alert.

  • Apply the simplified description format.

  • Trigger a real alert (not a test) to verify if the notification is successfully sent and parsed by ServiceNow.