Event Management - SCOM Severity Not Passing to ServiceNow

[Justin Wilburn]

Has anyone had trouble with payload information showing up as 'error' in Event Management? To be more specific, we are using the SCOM connector instance to connect our SCOM instance with service now, via a MID Server. While some events show up with a 'SCOM Severity' JSON pair equal to the Severity (Warning for example), others show up with a 'SCOM Severity' JSON pair as 'Error'. 

I have double checked that the events showing up with 'SCOM Severity' of Error in SN actually have a defined Severity inside of SCOM (so the issue is not with the monitoring tool). Just struggling to understand why this value cannot be interpreted/transferred correctly for half of our events. Any insight/assistance would be greatly appreciated. 

 

[Marlos]

Check the event field mapping:

Event Management -> Rules -> Event Field Mapping

If the severity field is not mapped out correctly than an error will be thrown.

https://docs.servicenow.com/bundle/kingston-it-operations-management/page/product/event-management/concept/c_EMEventFieldMapping.html

[stevemacamway]

Unless things have changed since Jakarta, the Event Rules are not applied in the actual event, the result of the mapping only shows up in the generated Alert. 

[Justin Wilburn]

Agreed. That is the confusing part to me as well - why are the EVENTS showing up with a severity of 'Error'. If it were the Alerts, I would have more control to transform/correct the data within ServiceNow EM.

Anyone else ever experience this issue?

[Justin Wilburn]

Still looking for a solution on this one. Data seems to be lost after leaving SCOM, but before the incident is created in SNOW EM. I am guessing the connector instance or MID server are involved. What I can't understand, is why only some incidents have the issue.