ScienceLogic Integration Correlation ID

[swaminarne]

Hello Community,

We recently integrated service now with Science Logic monitoring tool for incidents. This integration is re opening the resolved tickets if the alert is repeated. We have set the correlation ID as 5.

Can we prevent this from happening, I mean the resolved incident should not re open.

Thanks in advance!

[AnveshKumar M · Accepted solution]

HI @swaminarne 

You can adjust this incident re opening property by changing the correlation ID to type 7. But the side effect is it will create an Incident for every event instead of updating the existing ticket, which will increase the load on your resources. Please see the behavior of different correlation ID types for ScienceLogic integration.

1. Correlate all duplicate incidents by SL1 ID only.
2. Correlate all duplicate incidents by event policy ID only.
3. Correlate all duplicate incidents by device ID only.
4. Correlate all duplicate incidents by Interface ID only. This correlation requires that the SL1 event has an interface aligned. If there is no interface aligned to the event, the returned Interface ID will be 0
5. Correlate all duplicate incidents by device ID and event policy ID. This is the default Correlation Type value.
6. Correlate all duplicate incidents by device ID, event policy ID, and event sub entity ID.
7. Correlate all duplicate incidents by device ID, event policy ID, region, and event ID. Please note that using this correlation type will result in all events triggering new incidents

Please mark my answer helpful and accept as solution if it helped you 👍✔️

[swaminarne]

Thanks Anvesh for the detailed explanation. It seems I have to live with this behaviour otherwise need to customise it.

[AnveshKumar M]

@swaminarne Yup! Kind of. You can experiment with different correlation ID types in your Dev environment.

[rahulgupta38]

Hello Anvesh,

Can you please guide me how you have integrated Sciencelogic.

Thanks.