Event Management - SCOM Severity Not Passing to ServiceNow

[Justin Wilburn]

Has anyone had trouble with payload information showing up as 'error' in Event Management? To be more specific, we are using the SCOM connector instance to connect our SCOM instance with service now, via a MID Server. While some events show up with a 'SCOM Severity' JSON pair equal to the Severity (Warning for example), others show up with a 'SCOM Severity' JSON pair as 'Error'. 

I have double checked that the events showing up with 'SCOM Severity' of Error in SN actually have a defined Severity inside of SCOM (so the issue is not with the monitoring tool). Just struggling to understand why this value cannot be interpreted/transferred correctly for half of our events. Any insight/assistance would be greatly appreciated. 

 

[Christian Ramos]

I have the same issue.

You can check the groovy script on the Connector definition of SCOM > SCOMConnector.groovy

By default, "Error" is mapped to Major Severity for the event.

String scomSeverity = params.get("SCOMSeverity");
if ("Error".equals(scomSeverity)) {
event.setSeverity("2");
} else if ("Warning".equals(scomSeverity)) {
event.setSeverity("4");
} else if ("Information".equals(scomSeverity)) {
event.setSeverity("5");
} else {
event.setSeverity("3");
}​

I'm not sure you can map out the defined severity coming from SCOM Alert from this script.

If you find out a solution, mind to share it with me also 🙂

Thanks

[Justin Wilburn]

Thanks for the Reply. Out of curiosity, what version are you guys on? And have you had any luck with finding an answer on how this can be corrected? I am curious if the connector instance in Jakarta or Kingston has a correction in place.

We are on Istanbul, with plans to move to Kingston in the next 2-3 months. 

[Michael Skov2]

What about other Critical alerts from SCOM, are they being mapped correctly in ServiceNow? I am wondering if it is only related to Critical alerts from SCOM, or also Warnings from SCOM.

[Justin Wilburn]

Now that you mention it..... I went back and pulled some reports, events from SCOM with a severity of Warning of Informational show up correctly. SCOM Critical events never process; have a SCOM Severity in the event of Error. Any idea why this might be?

[Michael Skov2]

Interesting 🙂

First, the "SCOMSeverity":"Error" is correct. I have critical events from SCOM mapped to major alerts in ServiceNow.

Also, your event is actually being processed (it doesnt say Error in State). How does the alert look?