Solarwinds integration - values being received on the ServiceNow instance

[SNAdmin47]

Hi, 

I'm trying to resolve an issue with some unexpected behaviour on a Solarwinds integration (using the old 'SolarWinds Alert Integration' plugin) and what I specifically want to see is what field values are being pushed from Solarwinds into the ServiceNow instance. I can find the transactions but the only things included are the sysparm fields and not the actual values:

sysparm_fields=sys_id,number,impact,urgency,short_description,description,work_notes,close_notes,close_code,comments,state,cmdb_ci,category,subcategory,contact_type,correlation_display,correlation_id,sys_updated_on,sys_updated_by,assigned_to,assignment_group&sysparm_display_value=all

Is there any way to see what the actual values for those sysparm fields being pushed from Solarwinds are? I've been through transactions and instance logs but don't seem to be able to find them anywhere

[Kieran Anson]

I've not used the old plugin, only the store app. As you've found the transaction, is the transaction type REST, SOAP, or something else? REST & SOAP can be debugged via a property change and the content viewed within the node logs

[SNAdmin47]

Hi @Kieran Anson ,

Thanks very much for the response, appreciate the assistance. It's a REST message in the transaction logs, I had previously looked at this in the product docs area (https://www.servicenow.com/docs/bundle/zurich-api-reference/page/integrate/inbound-rest/concept/debu...) but it didn't seem to show much in the way of field values so I must admit I discounted that and didn't chase that down. Would this be the right path to go hunting for the kind of sysparm field values? 

Thanks in advance for your input, really appreciate it. 🙂

[Kieran Anson · Accepted solution]

glide.rest.debug is indeed the correct system property. However, if you've not looked at node logs before, tracking down the information can be a little tricky.

If possible, this should only be done in a sub-production environment as this logging can be resource intensive.

You can watch the logs in real-time by going to /channel.do?sysparm_channel=logtail in your instance, note this can become very 'chatty' so use your browser text search option (control + F) to search for '[REST API] RESTAPIProcessor'

You should then see all content.

The hardest part, I save for last. logtailing only shows logs for the current node, and ServiceNow instances are made of multiple nodes. Sub-productions generally only have 2 nodes, so you have a 50% chance of tailing on the same node the Solarwinds platform talks to.

Easier option might be to enable logging, trigger solarwinds, and then disable logging. Then, within ServiceNow search for 'Node log file download' and locate the most recent localhost file. Right click and use 'download logs from near nodes' which will allow you to then search the logs of all nodes 

[SNAdmin47]

Brilliant, thanks @Kieran , that really helps. Yup, definitely would be doing that on sub-prod and not prod! I'll go and have a play as soon as I can, thanks again. 🙂