Clean up of unresolved objects for licensing

[Community Alums]

Hi,

In alerts list (em_alert) could see some of the alerts are having empty CI means they are not binded to any CI

An initial review of this, shows that most of these are related of alerts coming from one source alerts, which are not related to any Configuration Item.
This causes ServiceNow to capture the 'node' field of the alert and consider it an 'object' towards the licenses count. and have also gone through em_unique_nodes table to check the license usage and could see the type as unknown 

Please suggest a fix to resolve this or root cause of this issue, could you please help why those particular alerts are having empty CI's

[Harneet Sital]

Hi Dhana, 

Can you please elaborate on how the alerts are created? What is the source of events for these alerts?

You can have event rules to bind certain events to CIs which in turn will populate the alerts with the CI you select. Validate your event rules and see if it helps if not please reply back on the thread and I will try to help further. 

Thanks
-Harneet Sital
Request you to please mark my answer as HELPFUL or CORRECT based on the impact
Find all my ServiceNow articles here

[Community Alums]

Hi Harneet,

Thanks for your quick reply.

Alerts are getting generated based on Event rules conditions and CI binding is specified in Event rules and source of these events/alerts is New Relic.

Observation is most of the alerts when checked in alerts list CI field is empty for the source New Relic and some alerts are from different sources and also when checking the node field particular CI might be missing in the instance. Is that the reason CI is not getting binded to particular alert, If so what can be next steps taken or fix to get CI's binded to alerts

Could you please help here in next steps

[Harneet Sital · Accepted solution]

Hi Dhana, that's right since the CIs do not exist in your instance they won't be binded to the alert.

Alerts bind to CIs based on the following process flow:

1. When an event arrives, Event Management checks the node or CI identifiers.
2. If no node exists, the generated alert can bind to the CI using the alert Type, Additional information, or Configuration item identifier fields.
3. If the event has a node value, search for a valid host.
4. If the event has a host and a CI type, try to bind to a device CI.
5. If the event has a host, try to bind to the application CI.

How alerts bind to CIs

Ideally, if you can't find the right CI, the last resort is to bind it to the application service CI the event is associated with.

Read through this further and see if this helps - https://docs.servicenow.com/bundle/quebec-it-operations-management/page/product/event-management/ref...

Thanks
-Harneet Sital
Request you to please mark my answer as HELPFUL or CORRECT based on the impact
Find all my ServiceNow articles here

[Narmada6]

Hi Harneet,

Even though the value in node field matching the cmbd CI record in ServiceNow, Configuration Item value is not binding. Do we need to create separate event rules for each alert type ? What could the reason for binding fail  ?