Binding Event Rules

[Henrik Jutterst]

I'm trying to create an Event Rule where I should bind to the related Database CI.

The problem is that these CIs have a dynamic name, built up by:
<database>@<instance>@<host>, example myProdDatabase@myInstance01@myHost01 .

I have all the data in the event:

• myProdDatabase
• myInstance01
• myHost01

But when I create my Event Rule and try to bind to the database and name identifier, I was having issue to find the CI, because ServiceNow was not able to use variables in order to have dynamic names in the CI: <database>@<instance>@<host>

Question:

Therefore, is there a way around this when we are using dynamic names on the database CIs?

Or what is the alternatives here? Bind it direct to the Host is not the same really, but yeah..

[Henrik Jutterst · Accepted solution]

-----------------------
Ok, so just a couple of days ago I got the help I was looking for from the very helpful and talented @Ryan Zulli at ServiceNow. And since I've seen other users looking for similar questions on dynamic bindings I wanted to create a Blog-post or Article here with my findings and the solution. And here's my Out-of-Box / PDI attempt to show you this, hoping that this will help you. So, here goes...

-----------------------

I took part in implementing Event Management for a while ago, and to be honest, it's one of the best projects that I've been in. The team was great and we really got it going up to speed in a short while and start seeing the benefits of it quite early.

One handy thing is the binding to hardware CIs based on name, fqdn, IP-address or MAC-address, and that works really good since it's almost always in the event if you're monitoring servers.

However, one thing that I really struggled with was binding to long, dynamic names, build up of data in the event sent to ServiceNow. The customer was using a name standard for MS SQL Databases like: <databaseName>@<instanceName>@<hostName>, example myProdDatabase@myInstance01@myHost01. And this is the story of how we solved that.

First we need to have all related CIs in the CMDB.

I have a MS SQL Database with the following values:

• Name: myProdDatabase@myInstance01@myHost01
• Data base: myProdDatabase

I have a MSFT SQL Instance where:

• Name: myInstance01@myHost01
• Instance Name: myInstance01

And I have a Windows Server host where the MSFT SQL Instance is sinstalled:

• Name: myHost01

I also created an Application Service called:

• Name: myApplication

The CIs then have all the relations to each other so the Application Service relates all the way down to the Windows Host.

Now, let's import an event and then create an Event Rule for the dynamic binding. Attached is the event:

<?xml version="1.0" encoding="UTF-8"?>
<unload unload_date="2023-12-13 11:50:37">
<em_event action="INSERT_OR_UPDATE">
<additional_info>{"MonitoringObjectId":"428bede9-8a22-a72b-bce5-97c3a7c6497a","ResolutionState":"255","LastModifiedDate":"2023-12-13 13:37:00","Name":"database is not online.","LastModified":"638338519442200000","TimeRaised":"2023-12-13 13:37:00","MetricName":"Microsoft.Windows.10.0.Cluster.NetworkInterface.StateMonitoring","MonitoringObjectFullName":"Microsoft.Windows.Server.10.0.NetworkAdapter:myHost01;{93BA8477-BD95-45B4-BE38-DF512A585465}","MonitoringObjectName":"{93BA8477-BD95-45B4-BE38-DF512A585465}","TimeResolved":"2023-12-13 13:37:00","MonitoringObjectDisplayName":"Production","StateLastModified":"2023-12-13 13:37:00","Context":"&lt;DataItem type=\"System.PropertyBagData\" time=\"2023-12-13T19:32:24.0585802+02:00\" sourceHealthServiceId=\"353EE599-79D0-2BA7-7AEA-0D156F2670FF\"&gt;&lt;Property Name=\"__CLASS\" VariantType=\"8\"&gt;MSCluster_NetworkInterface&lt;/Property&gt;&lt;Property Name=\"__DERIVATION\" VariantType=\"8\"&gt;&lt;/Property&gt;&lt;Property Name=\"__GENUS\" VariantType=\"3\"&gt;2&lt;/Property&gt;&lt;Property Name=\"__PROPERTY_COUNT\" VariantType=\"3\"&gt;2&lt;/Property&gt;&lt;Property Name=\"Name\" VariantType=\"8\"&gt;myHost01 - Production&lt;/Property&gt;&lt;Property Name=\"State\" VariantType=\"19\"&gt;3&lt;/Prope","TimeAdded":"2023-10-25 17:32:24","Parameter2":"myInstance01","SCOMSeverity":"Error","Parameter1":"myProdDatabase","ProblemId":"28e56027-d827-07e3-72e7-003e9ffbdab7","Parameter3":"myHost01","NetbiosComputerName":"myHost01","MonitoringClassId":"97116693-b8e7-f4b3-fdd6-9644eb842a4d","Priority":"Normal","MetricDisplayName":"Network Interface State Monitor","MonitoringObjectPath":"myHost01","PrincipalName":"myHost01","ManagementGroupId":"095d3d83-3beb-936f-a2e7-ee1855e78355","IsMonitorAlert":"True","database":"myProdDatabase","instance":"myInstance01","host":"myHost01"}</additional_info>
<alert display_value="Alert0010016">f5e808de47c331105c019530116d4342</alert>
<bucket>80</bucket>
<ci_identifier/>
<ci_type/>
<classification>0</classification>
<cmdb_ci/>
<description>Testing out database binding on dynamic CI names</description>
<error_msg/>
<event_class>TestSource</event_class>
<event_rule display_value="SCOM Network Adapter">c0664de5539303007c93ddeeff7b1289</event_rule>
<message_key>myCustomMessageKeyInPDI-1</message_key>
<metric_name>Microsoft.Windows.MSSQL.Database.Down</metric_name>
<node>myHost01</node>
<processed>2023-12-13 11:50:06</processed>
<processing_duration>712</processing_duration>
<processing_notes>Binding alert CI process flow:
Node will be resolved to CI id: b0013b82474331105c019530116d4385 : found by node name
Event CI type is empty
No related CI found for binding, alert CI will be bound to node (id): b0013b82474331105c019530116d4385
Bind to b0013b82474331105c019530116d4385

No event rule applied</processing_notes>
<processing_sn_node display_value="">3bdc1ed3839cc70aeaa1653adf2bca8f</processing_sn_node>
<resolution_state>New</resolution_state>
<resource/>
<severity>2</severity>
<source>TestSource</source>
<state>Processed</state>
<sys_created_by>admin</sys_created_by>
<sys_created_on>2023-12-13 11:50:01</sys_created_on>
<sys_domain>global</sys_domain>
<sys_id>50e8c4de47c331105c019530116d43a7</sys_id>
<sys_mod_count>0</sys_mod_count>
<sys_updated_by>system</sys_updated_by>
<sys_updated_on>2023-12-13 11:50:07</sys_updated_on>
<time_of_event>2023-12-13 11:50:01</time_of_event>
<type>database is not online.</type>
</em_event>
</unload>

After importing the XML-event to my PDI I can see it in the em_event table:

I clicked the event and from that created an Event Rule:

My naming standard for Event Rules are: <customer>.<source>.<application>.<metric>, and I started to create one here:

Clear out the node field and create dynamic data in name field:

No threshold needed in this case:

Now, override default binding using "CI field matching":

Insert a copy of the last event for it to process by Event Management again and see if new binding works:

SUCCESS! 🙂

Now, look at the Alert and see the Configuration Item field:

And looking in the Dependency View gives you this information (where I focus on the Application Service On top):

So, there you have it. It is possible to bind to Dynamic Names in Event Management. You just need to know some details.

Once again. Thank you to @Ryan Zulli for all the help. In this and other questions related to Event Management.

Kind regards

/Henrik