AZURE / EVENT Management

[Jonny Lord]

Hey Guys,

We have integrated many monitoring tools successfully into our new ServiceNow instance.

I'm stuck with my Azure Events coming into ServiceNow - i have them coming in via a web hook with the configuration suggested here: https://docs.servicenow.com/bundle/london-it-operations-management/page/product/event-management/task/azure-events-transform-script.html

I can confirm that Azure alerts are coming into ServiceNow but are not populating the Event table.
They are infact populating the logs files with the event message...immediately followed by another log entry with the same timestamp with the source as "com.glide.ui.ServletErrorListener"  and payload as;

JavaScript evaluation error on:
(function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
var body = GlideStringUtil.getStringFromStream(request.body.dataStream);
 var queryParams = request.queryParams;
 var source = queryParams['source'] ? queryParams['source'][0] : '';
 var headers = request.headers;
 delete headers["authorization"]; // dont save the base64 user/password
 var gr;
 if (gs.getProperty('cloud.event.debug') == 'true') {
  gr = new GlideRecord('em_connector_push_debug');
  gr.body = body;
  gr.source = source;
  var hstr = JSON.stringify(headers);
  gr.headers = hstr;
  gr.query_params = JSON.stringify(queryParams);
  gr.url = request.uri;
  gr.insert();
 }
 
 gr = new GlideRecord('em_connector_push');
 gr.addActiveQuery();
 gr.addQuery('type', 1);
    gr.addQuery('source', 'azure');
 gr.orderBy('order');
 gr.query();
 var results = {};var exception;
 while (gr.next()) {
  var procSource = gr.getValue('source');
  var procName = gr.getValue('name');

   var script = gr.getValue('script');
   gs.debug('Executing event processing script: ' + procName);
   var evaluator = new GlideScopedEvaluator();
   evaluator.putVariable('request', request);
   evaluator.putVariable('body', body);
   evaluator.putVariable('status', 200);
    var res = evaluator.evaluateScript(gr, 'script');
   if(evaluator.getVariable('status')!==200){
    exception=new sn_ws_err.ServiceError().setStatus(evaluator.getVariable('status'));
    exception.setMessage(procName+" : "+ res);
    throw exception;
   }
   
    
    results[procName] = res;
   return results;
   //}
 }
 
 exception=new sn_ws_err.ServiceError().setStatus(400);
 exception.setMessage('No Transform script found for given header or source ');
 throw exception;
})(request, response);
: org.mozilla.javascript.JavaScriptException: [object ServiceError] (sys_ws_operation.648f0381672132001e91c44d2685ef6e.operation_script; line 40): org.mozilla.javascript.gen.sys_ws_operation_648f0381672132001e91c44d2685ef6e_operation_script_4974._c_process_1(sys_ws_operation.648f0381672132001e91c44d2685ef6e.operation_script:40)
org.mozilla.javascript.gen.sys_ws_operation_648f0381672132001e91c44d2685ef6e_operation_script_4974.call(sys_ws_operation.648f0381672132001e91c44d2685ef6e.operation_script)
org.mozilla.javascript.ScriptRuntime.doCall2(ScriptRuntime.java:2650)
org.mozilla.javascript.ScriptRuntime.doCall(ScriptRuntime.java:2590)
org.mozilla.javascript.optimizer.OptRuntime.call2(OptRuntime.java:42)
org.mozilla.javascript.gen.sys_ws_operation_648f0381672132001e91c44d2685ef6e_operation_script_4974._c_script_0(sys_ws_operation.648f0381672132001e91c44d2685ef6e.operation_script:1)
org.mozilla.javascript.gen.sys_ws_operation_648f0381672132001e91c44d2685ef6e_operation_script_4974.call(sys_ws_operation.648f0381672132001e91c44d2685ef6e.operation_script)
org.mozilla.javascript.ContextFactory.doTopCall(ContextFactory.java:563)
org.mozilla.javascript.ScriptRuntime.doTopCall(ScriptRuntime.java:3428)
org.mozilla.javascript.gen.sys_ws_operation_648f0381672132001e91c44d2685ef6e_operation_script_4974.call(sys_ws_operation.648f0381672132001e91c44d2685ef6e.operation_script)
org.mozilla.javascript.gen.sys_ws_operation_648f0381672132001e91c44d2685ef6e_operation_script_4974.exec(sys_ws_operation.648f0381672132001e91c44d2685ef6e.operation_script)
com.glide.script.ScriptEvaluator.execute(ScriptEvaluator.java:279)
com.glide.script.ScriptEvaluator.evaluateString(ScriptEvaluator.java:118)
com.glide.script.ScriptEvaluator.evaluateString(ScriptEvaluator.java:82)
com.glide.script.fencing.GlideScopedEvaluator.evaluateScript(GlideScopedEvaluator.java:309)
com.glide.script.fencing.GlideScopedEvaluator.evaluateScript(GlideScopedEvaluator.java:214)
com.glide.script.fencing.GlideScopedEvaluator.evaluateScript(GlideScopedEvaluator.java:201)
com.glide.rest.service.custom.CustomService.runScript(CustomService.java:95)
com.glide.rest.service.custom.CustomService.execute(CustomService.java:82)
com.glide.rest.handler.impl.ServiceHandlerImpl.invokeService(ServiceHandlerImpl.java:36)
com.glide.rest.processors.RESTAPIProcessor.process(RESTAPIProcessor.java:271)
com.glide.processors.AProcessor.runProcessor(AProcessor.java:483)
com.glide.processors.AProcessor.processTransaction(AProcessor.java:205)
com.glide.processors.ProcessorRegistry.process0(ProcessorRegistry.java:178)
com.glide.processors.ProcessorRegistry.process(ProcessorRegistry.java:167)
com.glide.ui.GlideServletTransaction.process(GlideServletTransaction.java:31)
com.glide.sys.Transaction.run(Transaction.java:2038)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)

What should the header be based on events coming in via a Listener transform script?
The header name and header value fields are none mandatory and i have no clue what they need to be, if in fact this is the issue. Any other direction would be great.

Thanks Guys.

[vNick]

Hello

What endpoint are you sending to?  I would try https://<<INSTANCE>>/api/global/em/inbound_event?source=genericJson

We only support 1 of the Azure alert formats right now, so you have to make event rules for others as they come into this endpoint.  You can see an example here... https://docs.servicenow.com/bundle/london-it-operations-management/page/product/event-management/task/azure-events-transform-script.html 

[Jonny Lord]

Thanks Nick,

I've used that and still cannot see these events, the event table shows nothing from Azure.
I thought something was wrong on the Azure side as i had nothing but a peak in the logs shows it did send into the instance but was hit with an immediate error. Effectively not parsing the information into the event table.

When i browse here;

Event Management > Event Listener (Push) > Listener Transform Scripts i have an Azure Transform script (Active) with all field populated apart from the 'Header Name' , Header Value. The URL Parameter value is 'Azure'
'Type' instance.

Are there any obvious candidates i should be using for Header Name, Header Value and URL Parameter?

Thanks

[vNick]

hi Jonny,

You shouldn't need to update what's there... mine shows "user-agent" for the Header Name and "azure-insights" for the Header Value.

You just need to make sure the "inbound event azure" endpoint is active and that you have a MID Webservice Event Listener configured so it can receive those events into that transform script. 

Again, I'd just double-check the steps on this page... https://docs.servicenow.com/bundle/london-it-operations-management/page/product/event-management/tas...

[dbehnood]

Hey Nick,

Are you saying that only the Azure Monitor alerts will work with the out of the box Listener Transform Script, and are the only alerts that can successfully post to the https://<instance-name>.service-now.com/api/global/em/inbound_event_azure URI? And Application Insights Alerts will require a custom solution for integration?

Thanks,

-Dom