Event Management Use Case

[jhammega]

We face a few challenges in event management module

Daily we receive an event between 08:55 en 09:05.

We know this is for fixing a memory leak for a certain application.

I understand we should filter this at the source.. but currently this is not possible.

How can we suppress this event/alert with OOB functionality and without script/workflow.

I'm mentioning the latter because we want to assign evt_mgt_user role to others so we can let people create their own rules.

For this I'm writing/thinking about standard OOB solution.

I'm unable to think of working/feasable solution with maintenance rule because this does not allow me to set a timeframe.

We expect this to be a recurring request for several CI's and therefor a daily recurring change would not be a preferred solution.

Something more simple at the start of the event would be nice.

I have read the very usefull contribution for the maintenance flag > I am interested to know how the Maintenance flag works

I have tried to create an event rule which matches, then we have alert rule and we could use alert template to set maintenance flag.

However how can I set a window making the event rule only applicable for this daily recurring 10 minute window?

Thanks very much for thinking with me !

[vNick]

Hi Jeroen,

Have you tried creating another event rule for the same Source and give it a lower Order value, then set the filter to only process events from that source which fall within the timeframe you note and whatever parameters identify the system/application against which the event is generated?

You can then check the box to "Ignore Event" if that's what's appropriate

[jhammega]

Hi Nick,

First of all, thanks for your reply!

I forgot to mention we're on Jakarta release in DEV and on Helsinki in PROD instance.

I went the maintance flag road because of unable to specify the "timeframe" in the event filter in the Jakarta release.

No "Time of event" in the select box.

In Helsinki "maintenance rules" do not even exist. So there your suggestion (event rule with ignore option and timeframe filter) would be a perfect fit.

But how to create a 10 minute window filter based on the business rule > Get Date Filter Options for Date Filters because this is what we can choose from.

With this combination I have been unable to specify a daily recurring window of x minutes for the "Time of event". I tried "between", "trend" and "relative".

So this is why I went the "maintenance" path although then at some point I would still need some "schedule" to select the timeframe in.

[jhammega · Accepted solution]

Unfortunately we had to create a scripted workaround for this, since there is no option to select the correct timeframe and we do not want to end up with an alert we need to overwrite with alert template, maintenance plans and all other far to complicated solutions..

We ended up creating scheduled jobs to activate/inactivate "event rules" in which we set the "ignore" option.

The scheduled job allowed us to select duration and recurrence etc.

// Workaround

var gr = new GlideRecord('em_match_rule');

// Add correct name to match event ignore rule

gr.addQuery('name','CiName Maint Rule');

gr.query();

if (gr.next()) {

gs.log('EVTMGT - CI maint window values are : ' + gr.sys_id + ',' + gr.name + ',' + gr.active);

gr.setValue('active', true);

gr.update();

gs.log('EVTMGT - Start CI maint window. Value of active field for event rule with name ' + gr.name + ' is:' + gr.active);

// Add duration in this example is 15 minutes

// gs.sleep is in milliseconds

gs.sleep(900000);

gr.setValue('active', false);

gr.update();

gs.log('EVTMGT - Stop CI maint window. Value of active field for event rule with name ' + gr.name + ' is:' + gr.active);

}

At least this code snippet is simple enough to share with our application support teams.

The only need to define:

1. Ignore eventrule

2. Scheduled job.

3. Paste in script in scheduled job and adjust "gr.name" and "gs.sleep" duration.

Quick and dirty, but for now it will have to do

Hope ServiceNow will built in the option to select timeframe with the event rule.. by adding more "answer" options to the BR "Get Date Filter Options for Date Filters"

function getDateFilterOptions() {

answer.add('001_Today@javascript:gs.daysAgoStart(0)@javascript:gs.daysAgoEnd(0)','Today');

answer.add('005_Yesterday@javascript:gs.daysAgoStart(1)@javascript:gs.daysAgoEnd(1)','Yesterday');

answer.add('010_Tomorrow@javascript:gs.daysAgoStart(-1)@javascript:gs.daysAgoEnd(-1)','Tomorrow');

answer.add('015_This week@javascript:gs.beginningOfThisWeek()@javascript:gs.endOfThisWeek()','This Week');

answer.add('020_Last week@javascript:gs.beginningOfLastWeek()@javascript:gs.endOfLastWeek()','Last Week');

answer.add('025_Next week@javascript:gs.beginningOfNextWeek()@javascript:gs.endOfNextWeek()','Next Week');

answer.add('030_This month@javascript:gs.beginningOfThisMonth()@javascript:gs.endOfThisMonth()','This month');

answer.add('035_Last month@javascript:gs.beginningOfLastMonth()@javascript:gs.endOfLastMonth()','Last month');

answer.add('040_Next month@javascript:gs.beginningOfNextMonth()@javascript:gs.endOfNextMonth()','Next month');

answer.add('045_Last 3 months@javascript:gs.monthsAgoStart(3)@javascript:gs.endOfThisMonth()','Last 3 months');

answer.add('050_Last 6 months@javascript:gs.monthsAgoStart(6)@javascript:gs.endOfThisMonth()','Last 6 months');

answer.add('055_Last 9 months@javascript:gs.monthsAgoStart(9)@javascript:gs.endOfThisMonth()','Last 9 months');

answer.add('060_Last 12 months@javascript:gs.monthsAgoStart(12)@javascript:gs.endOfThisMonth()','Last 12 months');

answer.add('065_This quarter@javascript:gs.beginningOfThisQuarter()@javascript:gs.endOfThisQuarter()','This quarter');

answer.add('070_Last quarter@javascript:gs.quartersAgoStart(1)@javascript:gs.quartersAgoEnd(1)','Last quarter');

answer.add('075_Last 2 quarters@javascript:gs.quartersAgoStart(1)@javascript:gs.endOfThisQuarter()','Last 2 quarters');

answer.add('080_Next quarter@javascript:gs.quartersAgoStart(-1)@javascript:gs.quartersAgoEnd(-1)','Next quarter');

answer.add('085_Next 2 quarters@javascript:gs.quartersAgoStart(-1)@javascript:gs.quartersAgoEnd(-2)','Next 2 quarters');

answer.add('090_This year@javascript:gs.beginningOfThisYear()@javascript:gs.endOfThisYear()','This year');

answer.add('095_Next year@javascript:gs.beginningOfNextYear()@javascript:gs.endOfNextYear()','Next year');

answer.add('100_Last year@javascript:gs.beginningOfLastYear()@javascript:gs.endOfLastYear()','Last year');

answer.add('105_Last 2 years@javascript:gs.beginningOfLastYear()@javascript:gs.endOfThisYear()','Last 2 years');

answer.add('110_Last 7 days@javascript:gs.daysAgoStart(7)@javascript:gs.daysAgoEnd(0)','Last 7 days');

answer.add('115_Last 30 days@javascript:gs.daysAgoStart(30)@javascript:gs.daysAgoEnd(0)','Last 30 days');

answer.add('120_Last 60 days@javascript:gs.daysAgoStart(60)@javascript:gs.daysAgoEnd(0)','Last 60 days');

answer.add('125_Last 90 days@javascript:gs.daysAgoStart(90)@javascript:gs.daysAgoEnd(0)','Last 90 days');

answer.add('130_Last 120 days@javascript:gs.daysAgoStart(120)@javascript:gs.daysAgoEnd(0)','Last 120 days');

answer.add('135_Current hour@javascript:gs.hoursAgoStart(0)@javascript:gs.hoursAgoEnd(0)','Current hour');

answer.add('140_Last hour@javascript:gs.hoursAgoStart(1)@javascript:gs.hoursAgoEnd(1)','Last hour');

answer.add('145_Last 2 hours@javascript:gs.hoursAgo(2)@javascript:gs.hoursAgo(0)','Last 2 hours');

answer.add('150_Current minute@javascript:gs.minutesAgoStart(0)@javascript:gs.minutesAgoEnd(0)','Current minute');

answer.add('155_Last minute@javascript:gs.minutesAgoStart(1)@javascript:gs.minutesAgoEnd(1)','Last minute');

answer.add('160_Last 15 minutes@javascript:gs.minutesAgoStart(15)@javascript:gs.minutesAgoEnd(0)','Last 15 minutes');

answer.add('165_Last 30 minutes@javascript:gs.minutesAgoStart(30)@javascript:gs.minutesAgoEnd(0)','Last 30 minutes');

answer.add('170_Last 45 minutes@javascript:gs.minutesAgoStart(45)@javascript:gs.minutesAgoEnd(0)','Last 45 minutes');

answer.add('175_One year ago@javascript:gs.monthsAgo(12)@javascript:gs.endOfThisMonth()','One year ago');

}