Suppress incidents generated through monitoring during scheduled maintenance

[Madhu Prasanth]

We have a use case in my organization to suppress the incidents created through monitoring alerts for CI's under scheduled maintenance. Netcool is our monitoring tool and it creates incidents in ServiceNow. We do not use event management solution from ServiceNow and so there is no alert suppression or correlation capability. Though we create a change record for the maintenance activity, incidents will still generated by Netcool.

I looked at some solutions within ServiceNow and understand we can use scripts to set the CI status to 'Maintenance' during the scheduled maintenance window by reading the start and end time in the change record. And we can suppress the incident creation if the CI status is set to 'maintenance'. Has anyone tried this solution or have a better approach? How are other customers handling this in their organization?

[Michael Skov2]

How do you create the incidents?

[Madhu Prasanth]

Incidents are created through web service call from Netcool

[robertgeen · Accepted solution]

So just to give some background of how this works in event management. Event management has a scheduled job that runs and calculates all the CIs in maintenance and adds them to a table. Out of the box it does this based on a few criteria (one of them is actually change record based and another is that same In Maintenance flag that you talked about). As such the CI status in maintenance is probably your best bet and then you could trigger behaviour off of that when the incident is opened. Either way your thought seems like a good approach is just about the process that you will put in place to mark them as in Maintenance (be careful of the fact that if your change process isn't stringent you may have change records open with time frames that are in excess of a day and this could cause some issues as no incidents would get picked up because people would think they are in maintenance when really it's just not an accurate window assigned to the change record).

[Madhu Prasanth]

Thanks for the insight Rob. Though we don't have the event management solution in place, using the change record to set the CI to maintenance looks like a starting point.