Set maintenance flag for alerts

[karanpreet]

Hello,

I'm looking for a way to put alerts into maintenance without relying on the out of the box maintenance rules.

Ideally, it shouldn't have anything to do with the CIs in the CMDB and be usable through the API. For e.g. alerts from a particular source and having a particular metric name need to be in maintenance.

I was thinking I could use event rules/field mapping to set maintenance flag but that doesn't seem to work.

Any ideas on how I can get this to work?

Thanks,

Karan

#itom #eventmanagement #maintenance

[Community Alums]

Hi @karanpreet ,

Please refer to this thread: https://www.servicenow.com/community/itom-forum/alerts-in-maintenance-mode/m-p/1041435

[Riya Verma]

Hi @karanpreet ,

Hope you are doing great.

. Here's how we can achieve this:

1. Create a Custom Field, let's call it "maintenance_flag," in the table where alerts are stored. This field will be used to indicate whether an alert is in maintenance or not.
2. Define the Criteria Next which alerts should be put into maintenance. These criteria could be based on the source of the alert and the metric name associated with it. For instance, alerts originating from a particular source (e.g., "Server-A") and having a specific metric name (e.g., "CPU Utilization") should be put into maintenance.
3. we create an event rule that triggers whenever a new alert is generated. This event rule will check the alert against our defined criteria. If the alert matches the criteria, the event rule will automatically set the "maintenance_flag" field to true for that alert.
4. Implement Field Mapping: To handle the API usability requirement, we will use field mapping. Field mapping allows us to expose the "maintenance_flag" field through the API, making it accessible for setting or updating the maintenance status of alerts programmatically.

[karanpreet]

Hello, 

Thank you for the solution but I don't believe this will fulfil my requirements.

The creation of a custom field is not something that will be allowed within the environment. I could use fields within the additional_info field for this but not a custom field.

I can already create/set a additional_info field and set that to true but cannot use that to mark the alert to be in maintenance.

[karanpreet · Accepted solution]

I was able to resolve this myself. Sharing the solution here in case someone is interested.

It looks like there's an out of the box Subflow to mark the alert in Maintenance named "Change Alert to Maintenance Mode"

The process to mark the alerts in maintenance would be the following:

1. Add a event field mapping to include a custom field in the additional_info of the alert. For this example, the field being added can be "maintenance.true". The value of the field doesn't matter as it's not something we can trigger on.
2. Use the presense of the additional_info field "maintenance.true" in the alert filter of an Alert management rule.
3. The action of the Alert management rule will be to use the OOB subflow "Change Alert to Maintenance Mode"

To make this triggered through an API, use the table api to create an entry in the em_mapping_rule to mark the relevant alerts with the maintenance.true field in the additional_info of the alerts that are required.