Service Now integration

[providentpolska]

Hi All,

I looking for information regarding NagiosXi integration with SNOW. If is possible to open and close ticket in Snow when alert will auto solved? E.g CPU utilization is 100% - create one ticket in SNOW
utilization decreased to 50% - ticket will close in SNOW
Currently we are using ticket creation based on email however this approach creating 5 tickets and not close if issue is auto resolved.

There is actual documentation to create NagiosXI and SNOW integration?

[jsimon]

Hi @providentpolska,

ServiceNow actually provides documentation for integration with Nagios XI:

https://docs.servicenow.com/bundle/wash ... ector.html

Hopefully this helps, let us know if you have any questions, although contacting ServiceNow for support may be advisable as well.

[snapier3]

If you're wanting to integrate directly with the "Incident Table" in ServiceNow via the API.

There are two methods
1. Notifications (via notification command)
2. Event Handlers

Both methods use the same basic logic for scripting the integration with ServiceNow via an API post. I suggest to stay with notifications unless you're very familiar with NagiosXI and ServiceNow.

Your notification script will take the possible problem notification types.
PROBLEM
RECOVERY
FLAPPINGSTART
FLAPPINGSTOP
DOWNTIMESTART
DOWNTIMESTOP
ACKNOWLEDGMENT


State = 1, Create New Incident
URL = https://ServiceNowURL/api/table/now/incidents
HTTP POST
Your payload will need the required fields for the "ServiceNow Incident States"

Code: Select all

		"correlation_id": dedupe_key,
                "contact_type": "monitoring",
                "state": 1,
                "short_description": "shortdesc",
                "cmdb_ci":"hostaddress",
                "category": "category",
                "subcategory": "Server",
                "business_service":"Business Service",
                "description":"Incident Summary",
                "caller_id": "Caller",
                "timestamp": None,
                "impact": "1-4",
                "urgency": "1-4",
                "assignment_group": "ServiceNow Assignment Group"

To do the auto-resolve bit then you will need to capture the SysID of the incident that was created by the problem notification from XI. This SysID will be used when closing the incident in ServiceNow (I do this by storing the SysID in the problem acknowledge comment.)

State = 6, Resolved by Caller
URL=https://ServiceNowURL/api/table/now/incidents/<SysID>
HTTP PATCH

Code: Select all

		"correlation_id": dedupe_key,
                "contact_type": "monitoring",
                "state": 6,
                "close_code":"Closed/Resolved by Caller",
                "close_notes":"Monitoring Service Recovery",
                "short_description": "shortdesc",
                "cmdb_ci":"hostaddress",
                "category": "category",
                "subcategory": "Server",
                "business_service":"Business Service",
                "description":"Incident Summary",
                "caller_id": "Caller",
                "timestamp": None,
                "impact": "1-4",
                "urgency": "1-4",
                "assignment_group": "ServiceNow Assignment Group"

You will need full ITOM permissions in ServiceNow for the caller to resolve incidents and you should check with ServiceNow developers to make sure the proper rules are in place.

This can be done using python, python requests and basic http authentication.

[snapier3]

Hi @providentpolska,

ServiceNow actually provides documentation for integration with Nagios XI:

https://docs.servicenow.com/bundle/wash ... ector.html

Hopefully this helps, let us know if you have any questions, although contacting ServiceNow for support may be advisable as well.

This integration requires that you have licensed Event Management for ServiceNow.

[snapier3]

This is the Python that I use as the base of my notification integration with ServiceNow's Incident table.

NagiosXI ServiceNow Notification
https://github.com/SNapier/nagiosxi-sno ... /tree/main

Still working on the Wiki