Nagios XI / Service Now Integration

[bsanjay]

Hello Team,
I am trying to setup Nagios XI & Service Now integration to receive an incident whenever some alert is generated. I am following below link and i am able to generate an incident on SNOW whenever some service goes into Hard State.
https://support.nagios.com/kb/article/n ... w-552.html

Now, the problem is, suppose i am closing/deleting that incident and some time later state of this service again goes into problem state then an incident is not getting generated for the service if that is already created in past and i can see the below message in log file /var/log/sn_ticketer.log.

20/5/2020 18:27:38 Cleaning up archived DB entries older than TTL
20/5/2020 18:27:38 Config loaded.
20/5/2020 18:27:38 Message hash for this alert is: 169d1644a83a4f1835dc172b498f2c55
20/5/2020 18:27:38 Ticket track enabled using database.
20/5/2020 18:27:38 Existing ticket found, updating.
20/5/2020 18:27:41 Ticket related to SN ID: 397197cf1b781010556d40c6cc4bcb20 has been updated.
20/5/2020 18:27:41 Completed succesfully.

Please find the attached Log FIle & System Profile.

Moderator's Note: The profile has been shared with the support team but has been removed from the public forum.

[benjaminsmith]

HI @bsanjay,

While I'm not that familiar with all of the settings in ServiceNow, once you close a ticket it should move that to an archive table, so incoming messages will not be assigned to the closed ticket.

Looking at the message posted, it looks like it is updating the existing ticket instead of opening a new one. Can you verify that the previous ticket status is closed, and not another setting such as closed incomplete?

What about the inbound actions settings, have you checked the rules to make sure it's set to create a new incident?

Let me know.

Benjamin

Reference:
https://docs.servicenow.com/bundle/lond ... overy.html
https://docs.servicenow.com/bundle/orla ... tions.html

[bsanjay]

Hello Benjamin,
I have this incident closed complete and even I tried deleting the incident. What I mean to say is, if incident for service CPU Usage in HOST1 is created once and if the issue is resolved and I close or delete this incident from SNOW, then in future incident for the same service CPU Usage in HOST1 is not creating and I can see the below message in log file,

20/5/2020 18:27:38 Cleaning up archived DB entries older than TTL
20/5/2020 18:27:38 Config loaded.
20/5/2020 18:27:38 Message hash for this alert is: 169d1644a83a4f1835dc172b498f2c55
20/5/2020 18:27:38 Ticket track enabled using database.
20/5/2020 18:27:38 Existing ticket found, updating.
20/5/2020 18:27:41 Ticket related to SN ID: 397197cf1b781010556d40c6cc4bcb20 has been updated.
20/5/2020 18:27:41 Completed succesfully.

Best Regards,
BSanjay

[benjaminsmith]

Hi @bsanjay,

Looking over the log message, the notifications are definitely getting sent by Nagios and processed by ServiceNow.

20/5/2020 18:27:38 Message hash for this alert is: 169d1644a83a4f1835dc172b498f2c55
20/5/2020 18:27:38 Ticket track enabled using database.
20/5/2020 18:27:38 Existing ticket found, updating.
20/5/2020 18:27:41 Ticket related to SN ID: 397197cf1b781010556d40c6cc4bcb20 has been updated.

In the /usr/local/nagios/libexec folder, there will be a file called config.ini, can you look in this file let me know what the following option is set to or just PM the file and I can take a look.

Code: Select all

; Enable ticket track.
enable_tickettrack = 0

Also, what is the following set at, you may need to adjust this option.

Optional settings: tt_type - Currently the only available ticket-track type is db (database). tt_ttl - This is how many days a ticket will remain in archive status in the database after an OK status has been received for a host/service. tt_dead_ticket - This is how many days a ticket will remain in the database before being moved to archive status if an OK status is never received for a host/service. tt_strip_passive_hash_numbers - Strip numbers from passive checks before hashing to help determine "like messages" tt_strip_active_hash_numbers - Strip numbers from active checks before hashing to help determine "like messages"

Reference:
https://github.com/js-murph/nagios-service-now-ticketer

[bsanjay]

Hi Benjamin,
enable_tickettrack value is set to 1.
I have attached the config files for your reference.

Best Regards,
BSanjay

Moderator's Note: The files has been shared with the support team but has been removed from the public forum.

[benjaminsmith]

HI @bsanjay,

Can you edit the config.ini file on the Nagios XI and disable the ticket tracking. When that off, it will create a new ticket instead of updating the previous one.

Code: Select all

; Enable ticket track.
enable_tickettrack = 0

Let me know if you're now getting the behavior you'd like. The other option is to decrease the period of time allotted for updating existing tickets by the ticket tracking feature.

Code: Select all

; Ticket track will allow sn_ticketer to update tickets if a relevant incident is already open.
[ticket_track]
tt_type=db
tt_ttl=7
tt_dead_ticket=30

[bsanjay]

Hello Benjaminsmith,
I am not looking to create new incident for the service for which there is an existing incident in Service Now. Instead, i want to update the existing incident if created for the same service.
So, as per the above logs, its showing that it is updating the existing incident but i cannot see that incident is updating in any manner. Not in terms of state or status information.
I am not sure, if i am making any mistake in configuration settings or in check commands.

Hope, i am able to explain the requirement here. Please let me know if you need more info from my end.

Thanks For Help...

Best Regards,
BSanjay

[benjaminsmith]

Hello Bsanjay,

So, as per the above logs, its showing that it is updating the existing incident but i cannot see that incident is updating in any manner. Not in terms of state or status information.

Thanks for the clarification. I understand what is happening, but at this point, it looks to be a setting or policy rule in ServiceNow, the logs show the ticket is updated, but you're not able to view the update.

Have you reached out to ServiceNow for clarification on why the incident update is not visible? We know the notifications are being sent by Nagios XI and received by ServiceNow.

[bsanjay]

Hello Benjaminsmith,
So, are you suggesting to check with Service Now as this part of updating the existing ticket should be taken care at Service Now end ?

Let me go and check with Service Now team and update you ..
Meanwhile, if you find anything that i should summarize to Service Now team while discussing this issue.

Best Regards,
BSanjay

[benjaminsmith]

Hi Bsanjay,

I've reviewed all the configuration options in the program and not sure what else what is affecting this, did you try to decrease the following value if you have ticket track enabled as mentioned.

tt_ttl - This is how many days a ticket will remain in archive status in the database after an OK status has been received for a host/service.

I'm not an expert in how Service Now, but if the service is still in archive status, that may be having the impact here. If that doesn't resolve the issue, I would suggest reaching out to Service Now for clarification.