We first discussed converting Aria Operations Alerts to ServiceNow Incidents via the ServiceNow Plugin. We then showed how to populate the Configuration Item (CI) field on Incidents via Operations Webhooks. There is another ServiceNow construct called an Event, which allows you to call Event Rules, open subsequent ServiceNow Alerts, and more. Nice piece here explaining the difference between ServiceNow Incidents, Events, and Alerts.
As discussed in previous blogs, we can open ServiceNow Incidents with the ServiceNow Plugin that comes with Aria Operations. But if we want to open ServiceNow Events, we need the Management Pack for ServiceNow. Let's explore! Note, all screenshots here are from Operations 8.17.1 and ServiceNow Vancouver. Opening ServiceNow Events also requires the ServiceNow ITOM Module.
Once installed, your ServiceNow adapter instance will require a configuration file, which exists in $VCOPS_BASE/user/plugins/inbound/servicenow_adapter3/work.
The Management Pack comes with example configurations file that can be found in $VCOPS_BASE/user/plugins/inbound/servicenow_adapter3/conf/config_samples. Documentation around these can be found here, I'm going to use the sample uuid_events.json as my configuration file, as you can see I've copied it from the sample directory to the work directory and renamed it eventsv2.conf. As indicated in the documentation above:
This configuration filters vROps alerts to the following ResourceKinds: VirtualMachine, ClusterComputeResource, Datacenter, Datastore, HostSystem. It creates ServiceNow events for these vROps alerts and associates them with their CI if it is present in the CMDB. The mapping uses a combination of UUID and vCenter UUID as identifiers for all ResourceKinds.
If you want to populate the CMDB in addition to creating Events, you might use one of the configuration samples from the cmdb_sync directory. You'll want to work with your ServiceNow administrators to ensure proper CMDB population.
root@vr83-bpeterson [ /usr/lib/vmware-vcops/user/plugins/inbound/servicenow_adapter3/conf/config_samples/cmdb_sync ]# ls -altr
total 32
-rw-rw-r-- 1 admin admin 94 Jan 2 23:34 uuid_populate_only.json
-rw-rw-r-- 1 admin admin 113 Jan 2 23:34 uuid_populate_and_delete_when_removed.json
-rw-rw-r-- 1 admin admin 118 Jan 2 23:34 uuid_populate_and_delete_when_not_existing.json
-rw-rw-r-- 1 admin admin 94 Jan 2 23:34 moid_populate_only.json
-rw-rw-r-- 1 admin admin 113 Jan 2 23:34 moid_populate_and_delete_when_removed.json
-rw-rw-r-- 1 admin admin 118 Jan 2 23:34 moid_populate_and_delete_when_not_existing.json
drwxrwxr-x 5 admin admin 4096 Jan 2 23:34 ..
drwxrwxr-x 2 admin admin 4096 Jan 2 23:34 .Once you've configured your adapter instance, confirm it can connect to ServiceNow via the VALIDATE CONNECTION button, then start it!
Once started, the adapter instance will open ServiceNow Events for Operations Alerts based on the mappings in your configuration file. Our Operations Alerts look like this.
Their corresponding ServiceNow Events look like this.
The Operations Alert to ServiceNow Event field mappings can be found here. Let's explore one in detail.
The Operations Alert Id is included in the ServiceNow Event description and the Processing Notes include the ServiceNow CI the Operations Alert "Triggered On" object is being mapped to. If the ServiceNow CMDB doesn't include CIs for certain objects, your Events will look like this.
In this case you might use one of the cmdb_sync configurations available instead, so as to update your CMDB while you generate Events.
As you might have noticed, these Events are in turn generating Alerts based on Event Rules.
The ServiceNow Alerts look like this.
As you can see, Description and CI are being populated based on what's in the originating Operations Alert and subsequent ServiceNow Event. This is just one way we can use the ServiceNow Management Pack, there are several more.
Operations Alerts to ServiceNow Alerts
Syncing between Operations Alerts and ServiceNow Incidents/Events/Alerts
CMDB Population such that Operations aware objects are inserted into the ServiceNow CMDB if they don't already exist there
Import ServiceNow Application/Services into Operations as Dashboards and populate them with their corresponding Operations aware objects
Finally, we can open ServiceNow Alerts directly if you'd like with the Operations Management Pack for ServiceNow. We will explore that use case in our next blog.
Comments