Event Mgmt, how to know when an event source is no longer communicating to your instance?

[rrugg0000]

So this comes up regularly, how do you know if your tool stops sending events to SN ?  Regardless of the method, do you look for 24 hours without an event from source X ?  But what if nothing went wrong in 24 hours?  It's funny that we are so used to the 'noise' that it does not seem possible for a whole day to pass without an event of some kind.  That being said, I'm sure someone out there has figured out the most efficient method for this?  A Flow checking event table and listing every source you have configured?

Thanks all,

R

[Ryan Zulli]

we wouldn't recommend a BR or Scheduled job for this - its more efficient to have a flow trigger every x number of minutes looking for a "heartbeat" event that comes along with each source sending events over REST.   When the flow doesn't see this heartbeat event then create an event/alert/incident to alert the monitoring source team that their script has stopped sending events.  I mocked up a sample a couple years ago here ::

https://www.servicenow.com/community/itom-forum/event-management-heartbeat/m-p/903354/page/2

I have made enhancements to this since then, I need to formulate a KB and post it - but you can get the idea.

Hope this helps,

-Ryan

[rrugg0000]

Hey, nice to hear from you Ryan, hope all is well.  I had to go a little different route with this issue, as our sources do not have heartbeat events.  I created a flow to look up a record from each source on Event table (em_event) and Created on Today, return only first record.  Then a bit of logic, If count = 0, then Event, Alert, INC.  As long as at least 1 event shows up, then we're good.