LM Servicenow Integration
We have integrated service now with LogicMonior and we see that the Auto resolution of Incidents is not happening even when the Alert is cleared in LogicMonitor.
We see that there is no clear even in logs of the integraion even after he alert is cleared which is causing the Incident in open state
venkat
Posted 1 year ago·Last reply 1 year ago
8 comments
Andy_C
·1 year agoI'm not aware of any system that sends a clear when an alerting object is deleted. I'm sure there might be some, but since a clear is based on a state change that will never arrive....
David Bond
·1 year agoIn a containerized environment with hundreds, if not thousands of resources, this will mean that the ticketing system will be constantly filled with alerts.
Source: we have Kubernetes and LogicMonitor.
Mike Moniz
·1 year agoTicketing systems I'm used has actually queried LM API to check if an alert is still active before it allows an engineer to close the ticket. We don't want active alerts to be missed/ignored and you can't 100% rely on LM to send clear messages.
venkat
OP1 year agoAlso for the incidents nott getting auto resolved LM is no sending he clear alert...but he alert is getting closed
Ajay Chacko
·1 year agoHi Venkat,
High chance the servicenow integration setup is not completed for the clear alert action. Please use this documentation in detail: https://www.logicmonitor.com/support/alerts/integrations/servicenow-integration
Check the HTTP delivery section
I recommend raising support cases for issues like this with full details and screenshots, so that specific guidance can be given for your particular portal case.
Hope that helps
venkat
OP1 year agoIt is happening for few incidents and not all incidents.Few are getting cleared and few are not
Mike Moniz
·1 year agoI think you should still work with support, but in the past there was a few situations where clear messages were not being sent out. I believe most of these have been fixed over time though. You may want to track how exactly the alerts are getting cleared to look for patterns. For example, if you "clear" an alert by deleting the device itself, perhaps that might not send a clear message. Or if the clear occurs during a SDT or by the instance being deleted. Might explain why sometimes it works and sometimes it doesn't. In the past I've never really relied on LM always sending a clear but it's gotten better at it.
Also, I wouldn't suggest auto-closing tickets when an alert clears. That can lead to flapping alerts that noone looks at or situations like alerts that occur every night but clear by morning and it doesn't get looked at. I generally suggest to just add a Note to the ticket that the alert cleared, but still have someone look at the alert.