Incident State changing automatically

csellens · ‎07-13-2015

We have a strange situation where the state on some incidents changes from Active - Awaiting Change back to Active - Work in Progress. The journal says that I changed them, but I didn't - or didn't think I had. According to the log I was working on updating completely unrelated change requests at the time on at least 2 of the times this has happened. This does not seem to be consistent in that some incidents stay in this state and others change.

I am fairly sure that we did not do any customization around this state and have checked through the business rules, client scripts and UI policies and cannot find anything there. We are using Fuji

Any ideas on what could be causing this?

csellens · ‎08-06-2015

Finally this is now fixed.

It was, as many of you suggested a Business Rule on the Change Request table that we got a part of the StartNow configuration. It is called SNC - ITIL - Update related Incidents. It was querying on the wrong field label in the incident table - change_id instead of rfc. No results were obtained as the query was invalid and this resulted in all incidents being set back to Active Work in Progress every time any change was closed completed. This was regardless of whether the incident was related to the change or not.

Changing to the correct field label fixed - one minutes work after a heck of a lot of troubleshooting!

Many thanks all of you for your help with this.

View solution in original post

Deepak Ingale1 · ‎07-14-2015

Hello Corinne,

By any means there is any relation between the incident getting auto updated by updating change request ( Like Incident is Parent of Child Request). If that is the case, there might be a possibility of Business Rule doing this.

Is behavior being observed all time or it is random?

Also, does it affect only particular set of incident / change ?

Can you reproduce the effect? If you can reproduce the effect, in that case you can set watcher of 'incident state' field.

You can enable field watcher by right clicking on field. It will list down all scripts responsible for changing state of the field (In case it is getting changed only)

csellens · ‎07-14-2015

Hi Deepak,

We have just started using ServiceNow and the fulfillers are using this state to "park" incidents where they are waiting for some external input - hardware to be delivered, a response from a partner or vendor. This means thay are not actually creating changes when they move it into this state, so there are no related changes. Also checked they had no parent or problem records linked to them.

Behaviour seems to be random so cannot reproduce - found the field checker - cool! many thanks for that. If I ever get to the stage of being able to reproduce, I will use this - still a very useful feature which I did not know about before.

It seems to be only incidents in Active - Awaiting change state, the categories are different, cannot see any other common values that could be causing this.

It seems to have stopped for the present, but I will keep monitoring. Many thanks for all your suggestions.

kenappell · ‎07-14-2015

Be sure to check business rules and SLAs. There may be an SLA that is changing the state after a given period of time or a BR that is changing it.

csellens · ‎07-14-2015

Thanks Ken, had already checked the BR's, had not thought of the SLAs. Checked these and there is nothing there.

HugoFirst · ‎07-14-2015

OK, it looks like you're getting lots of great discussion about BR's scripts and the like, so I'm going to take a side trip down another avenue. I'm going to make some assumptions which may be wrong, so please take all this with a grain of salt, OK maybe a shaker of salt :-).

The thought I'm about to share was triggered by your comment saying "...the state on some incidents changes from Active - Awaiting Change back to Active - Work in Progress."

I checked my personal instance which has no customizations for incident and I could find no state value of "Active - Awaiting Change", nor could I find a state value for "Work In Progress". There is a state in the problem record which is "Awaiting Change", so I wondered if this might be a problem record instead of an incident. Or your state values for incident might be customized. That said, I also wonder if there was a change record associated with the incident record which mysteriously changed state. And if so, did the change request change state to a closed state about the time that the incident record went from "Awaiting Change" to "Work in Progress".

It might be good to look at the Business Rules on the change request table, and Global named "SNC - ITIL - Close Related"

While I don't see the exact situation that you describe, it does fire when the change request is closed and it could affect the state of other records, including incident and problem records.

Sorry for the long involved discussion, but I couldn't think of a way to shorten it up. Sorry!