Introduction
In the last blog, we built a Flow Action to get current service status and restart it if it is stopped. In this blog, we will create a Flow and integrate the action we created into that flow. The end goal of this blog would be to orchestrate and automate the Service Restart process. Let us now build the flow together!
Building the Flow
To create a New Flow, we will go to Workflow Studio and click New -> Flow. We will give this flow a logical name like "Restart Stopped Service" and ensure that Flow Run as is set to System User. Next, we will click on Build Flow button to create the flow.
For this blog, we will assume that an incident is being created whenever a service is stopped thus, we will put the trigger of our flow to Record Created in incident table and Short Description Starts With Service Stopped. This will ensure that our flow is only triggered whenever an auto-incident is being created for a stopped service (We assume that a Monitoring tool is responsible for this auto-incident creation and thus, the short description is standardized).
Next, we will need the exact name of the service which has went down, the server on which the service has stopped and it needs to be extracted from the short description, for example, one of the possible short description could be "Service Stopped - spooler on WINVM1". Here, after the -, we have our service name spooler which is the Print Service and it has stopped on the host WINVM1. To get these details, we will first create 2 Flow Variables to hold these values.
We will now make use of Set Flow Variables Action to set these flow variable values. We have two ways to get the Service Name and Server values - either we make use of a RegEx to extract them or we make use of transformation functions. For this blog, we will make use of transformation function. We will first split on "-" followed by Get Item from Array function to get the later part of the string where our service and server name resides followed by a trim to get rid of any whitespaces. Then, we will again split on "space" to followed by Get Item from Array function to get the Service Name. At the end, we will make use of trim function to get rid of any whitespaces.
We will repeat similar steps to get server name as well but in the last Get Items from Array function, we will get the data on position 2 instead of 0.
Once we have all the required inputs for our Restart Service action, we will integrate it by clicking on Add an Action button and selecting our action under Global Scope.
We will map our Flow Variables to the required inputs for this action and click Done.
Our Action gives us the current status of the service and we would like to have an additional check in the end of our flow so that if our flow is not able to restart the service, the operational engineers could look into it. To achieve this, we will make use of an if flow logic. If the service status is still stopped, we will make use of Send-Email action to inform operations team about the issue and ask them to remediate it. If the service is up and running, we will end the flow.
We are now ready to test our flow. To test it, we need to create an incident first as the trigger for our flow is any incident created with a particular trigger condition. Let's create an incident as shown below:
Here, spooler service has been stopped on a server (Mid Server hostname in this case). Let us run our flow against this incident and see it in action. When we click on Test and give this incident as an output, we will get the output as shown in below flow context:
As the flow is working as expected, we can go ahead and Activate it. Hit the Activate button to make the flow available for all the incoming Service Stopped incidents.
Conclusion
In this final blog, we learnt how to design a flow, how to integrate a flow action into a flow and how to take remediation action via flow. The flow designed above could be extended to update or close the incident as well if the service has been restarted. Also, instead of the incident being created at the first place, the flow could be triggered on the reception of incoming alert via email which can prevent the incident to be created.
If you find this blog useful, please like and bookmark it for future reference. Also, you can read my earlier blogs in this series with the below links:
