SCOM integration problem. Service-Now to SCOM does not work

[tpulls]

Hello,

I have the Service-Now SCOM Connector configured on both my SCOM server and MID server. Alerts from SCOM are being sent to Service-Now and even updated from Service-Now with the Incident Number. However, when I resolve the Incident in SN it is not closing the SCOM alert. If I understand correctly, SN will send a request to the MID server to trigger update_alert.exe. I can't tell if this is happening or not. The MID server is specified under Properties in Service-Now

I'm looking through agent0.log on the MID server and don't really see any errors. How does the MID server know what my SCOM server is in order to close the alerts with update_alert.exe? How else can i troubleshoot this? Is there a step-by-step guide out there to follow incase I missed something?

[tpulls]

My ECC Queue says it contains 770 items but everything is blank. I've attached a picture.

Is it really empty as it seems or is it a security or rights issue?

[john_andersen]

That would likely be a rights issue. You will need someone to up your rights to something that has access to the ECC Queue to debug this integration.

[tpulls]

Ok, I have proper rights now. This is what I'm seeing when I resolve the incident.

Output from ECC to MID

<parameters><parameter name='name' value='C:\Progra~1\Service-now\update_alert.exe set 2f0a6daf-58c0-4a51-ace5-b3ba899e6b80 LPSCOMFRMS -Owner=user@company.com'/></parameters>

user@company.com being whoever closed the incident

Input from MID to ECC

<results probe_time="5085"><result command="C:\Progra~1\Service-now\update_alert.exe set 2f0a6daf-58c0-4a51-ace5-b3ba899e6b80 LPSCOMFRMS -Owner=User@company.com"><stdout>ERROR: No such host is known</stdout><stderr/></result><parameters><parameter name="topic" value="Command"/><parameter name="queue" value="output"/><parameter name="sys_id" value="a6fcbef75b6c14402a3024a43e4254ec"/><parameter name="state" value="ready"/><parameter name="agent" value="mid.server.htisnmid01"/><parameter name="processed" value=""/><parameter name="ecc_queue" value="a6fcbef75b6c14402a3024a43e4254ec"/><parameter name="source" value="SCOM"/><parameter name="sequence" value="131fdd38f290000001"/><parameter name="name" value="C:\Progra~1\Service-now\update_alert.exe set 2f0a6daf-58c0-4a51-ace5-b3ba899e6b80 LPSCOMFRMS -Owner=User@company.com"/><parameter name="table_name" value="ecc_queue"/></parameters></results>

What host is the error referring to?
I'm still curious as to how my MID server should know the name of my SCOM server or management group.

[tpulls]

So I'm getting closer, but I had to alter a few things. I've discovered "Script Includes" under the "Integration - MS SCOM" tab. I'm assuming this is the script used to generate the command line sent to the MID server. The script was set with improper information about another SCOM server/management group. So I corrected that and now I see some successful updates in ECC queue.

However, ECC is only sending Commands/updates when the incident owner is set or changed. There is no update sent when the incident is resolved. The script contains a couple functions, one for sendUpdate and another for sendOwnerChange. The sendOwnerChange works properly and updates the alert in SCOM with the incident owner. But when I resolve the incident nothing happens, no command is sent from ECC to MID server.

It's clear that sendUpdate is used for closing the alert. Would anyone be able to help me out with the script and why it isn't triggering when the incident is closed/resolved?

[john_andersen]

I took a look at the SCOM code and it looks like the business rule has the following "if" statement for sending an update:

else if (current.incident_state.changesTo(6)){
   scomUpdater = new SCOMUpdater(current);
   scomUpdater.sendUpdate();
}

This indicates that you will only send and update is the "incident_state" field changes to a choice value that has the value of "6".

There are two things that I would check with your instance:

1) Is your incident form using the "incident_state" field? There two state fields with incident forms. One is a "state" field and the other is "incident_state". Some people use "incident_state", others use "state". You need to verify which one you are using. If your form is using the "state" field instead of "incident_state" then you need to change the business rule to check if : current.state.changestTo(6)

2) Does your "Resolved" choice on the incident_state field have a value of "6". If not, you will need to change the number in your code to match the value of your "Resolved" choice item. Since these are customizable, the SCOM integration uses the default, OOB value. But you need to make sure it matches your system.

I hope this helps!