Nagios XI integration with Service Now (SNOW)

[pbsindian]

We integrated Nagios XI with Service Now (SNOW) ticketing tool.
Challenge we are facing is, If there is a parameter with 80% & above as “Warning” and 90% & above as “Critical”, we are only seeing one ticket either for the warning or for the critical. If a file system reaches 80% and slowly starts growing and crosses 90% after an hour or two, we are only getting ticket for 80% but a new ticket is not getting created for 90%.

How do we get 2 tickets generated in Service Now, one for Warning and one when if it reaches Critical state? Once we achieve this, we also want ticket to get auto-resolved in Service Now once utilization is below 80% threshold.

[cdienger]

How is it currently integrated? Is it using an notification event to update service now like in https://support.nagios.com/kb/article.php?id=552 ? If so, what do the notificatin settings look like? Or is it using an event handler(https://assets.nagios.com/downloads/nag ... ios-XI.pdf) ? Please provide details regarding the current implementation including any plugins that may be used.

[pbsindian]

Thanks for your reply. We have followed the procedure mentioned in https://support.nagios.com/kb/article.php?id=552 for integration.
For each host we have added a contact snow-critical-service-p1 are something similar depending on priority.

And for the contact snow-critical-service-p1 we have inserted a command like below.

snow-critical-service-p1 /usr/local/nagios/libexec/sn_ticketer.pl --page="u_nagiosincident.do" --service="$SERVICEDISPLAYNAME$" --host="$HOSTNAME$" --u_nagios_state="$SERVICESTATE$" --u_affected_end_user="Nagios System" --opened_by="Nagios int" --u_urgency="2" --u_short_description="$SERVICEDISPLAYNAME$ is $SERVICESTATE$" --u_description="\n$SERVICEOUTPUT$\n\n" --u_severity="$HOSTSTATEID$" --u_item="$HOSTNAME$"

[cdienger]

This is developed by third party so our ability to help may be limited, but it does look like it would send alerts for critical states as well. Do you see tickets created if they are critical right away(instead of starting as warning and then becoming critical) ? You'll want to check the contact's notification settings to make sure they receive critical alerts as well.

It's not clear from reviewing the code if an auto-resovling feature is available. I do see code for a "auto-close" option, but the author of the code or someone more familiar with perl would need to decipher what it is actually meant to do.

[pbsindian]

Yes. Tickets for critical alerts come if threshold quickly reaches critical mark. In any case you will see ticket either for warning or for critical, but not both.

Internally there an SNID created for each alert and this ID doesn't change when state changes between warning/critical. And on SNOW, you get one ticket per SNID.

Thanks,
Bhargava

[cdienger]

That makes sense. Unfortunately though the script is from third party and modifying it would be outside the scope of our support.