SCOM integration problem. Service-Now to SCOM does not work

[tpulls]

Hello,

I have the Service-Now SCOM Connector configured on both my SCOM server and MID server. Alerts from SCOM are being sent to Service-Now and even updated from Service-Now with the Incident Number. However, when I resolve the Incident in SN it is not closing the SCOM alert. If I understand correctly, SN will send a request to the MID server to trigger update_alert.exe. I can't tell if this is happening or not. The MID server is specified under Properties in Service-Now

I'm looking through agent0.log on the MID server and don't really see any errors. How does the MID server know what my SCOM server is in order to close the alerts with update_alert.exe? How else can i troubleshoot this? Is there a step-by-step guide out there to follow incase I missed something?

[john_andersen]

If SN is having the MID Server trigger an executable, such as "update_alert.exe", then it would first post that command to the ECC Queue. I would look in your ECC Queue records for output to your MID Server that would be calling that command (I am guessing, but the topic may be "SSHCommand"). If there is an Output record sending that request, then there should also be an "input" record that shows you the response from the MID Server.

That is where I would start.

[john_andersen]

Also, you will want to make sure that "update_alert.exe" exists on your MID Server in the path that you reference in your SCOM properties (See screenshot below).

Also, the screen shot below shows the MID Server being the localhost. You should make sure that the name of the MID Server you installed within your firewall is the one that is listed there instead of "localhost".

[tpulls]

Where would I check for the ECC queue?
If I look at the agent0.log on my MID server I see messages such as:
"ECCSender.1 Sending ecc_queue.e53e0233ff201000071ab48e4acbee0c.xml"

The Integration Properties are set up correctly with the name of my MID server. update_alert.exe is also in the directory specified. Should the User be the username used to connect to the SN Instance? In our case "admin".

[john_andersen]

You get to the ECC Queue by browsing to the "ECC" application in your left navigation pane and clicking on the "Queue" module:



You will likely have a lot of records in the list that comes up, so you will want to filter on the records whose topic contain the word "Command":



These show records that are created to process a remote command to a MID Server.

If their "queue" field in the record is "Output" then it is a record that is meant for a MID Server to grab and process.

If the "queue" field is set to "Input" then it is a response from the MID Server on a particular action.

It helps to sort the ECC Queue list by created date/time so that you can get an idea of the order of events.

For more reading on the ECC Queue feel free to go to:
http://wiki.service-now.com/index.php?title=ECC_Queue