Missing events from SolarWinds

[Karthick Nagara]

Hi,

Im using Solarwinds connector to get the Events for alert creation.

My stakeholder says that some specific events are not found in ServiceNow . Especially a set of events where NETOBJTYPE starts with UND. Ideally the connector is supposed to pull all events from the source is what I understood.

Im looking for a place in servicenow to check the raw events that we receive from Solarwinds .Something like payload.

Can someone help me in this troubleshooting.

[Karthick Nagara]

I see the OOB Query used in getQueryForExecute function is filtering out events with NetObjectID = NULL (WHERE NetworkNode >= 0 AND NetObjectID > 0)

Unfortunately the missing events have NetObjectID = NULL

Inorder to get those events as well, what would you suggest. Copy and customize the MID Script include: SolarWindJS or is there a better way to customize to allow future updates from Servicenow

[Shreya Jain1]

I believe this should be fixed at source end, i'm not what significance NetObjectID has at Solarwinds end but you can check once with Solarwinds team if they can populate some value in that field. 

You can customize connector script as well but its not recommended, better to get it fixed at source (Solarwinds) level.

Regards,

Shreya

[Eric Smith]

Karthick, did you find the root of the issue? Hope you did so. We did not use the SW connector but decided on a custom one (we used the zigiops connector). It did not take much of our time and allowed us to customize it to fit different use cases.  We had no issue with the configuration and the set up of the connection. you can check it out just for future reference.

[Peter Delf]

We're due to meet with SolarWinds and ServiceNow tomorrow to discuss this.  SolarWinds have suggested we customise ServiceNow code and remove the 'WHERE' restriction that blocks any events that don't have a 

NetObjectID value, and that value is greater than 0.  We're mocked this up in Dev, and though it does work, there's a lot of traffic/events coming through that don't seem relevant.

[Peter Delf]

Senior SolarWinds Technical Support have suggested the following as a fix for the ServiceNow code:
/nav_to.do?uri=ecc_agent_script_include.do?sys_id=5bb862bddb6210108922274b139619c4

Line 209:

"WHERE NetworkNode >= 0 AND (NetObjectID > 0 OR EventType = 5000) ";

which has worked for us.  I've just spoken to ServiceNow support who are taking this to their Product Specialist to determine whether they will raise an enhancement to officially include this customisation into the official product line release.  I should hear back next week.