Apr 302014

I have Spectrum integrated with Service Now in order to raise Incidents automatically when certain critical alerts come through on CA Spectrum

As a pre-requisite, Spectrum needs a user configured in Service Now with the ability to create records in the Incident table.

  1. Spectrum Configuration
  2. I have alarm notifiers setup to catch events that require an automated incident. The alarm notifier SetScript then calls a custom perl script in order to send the web services request to Service Now. The alarm notifiers are configured

    The SetScript has also been modified to parse out some extra parameters from the policy’s Notification Data. The notification data is accessed from the script through the variable “$NOTIFDATA”.
    I use a comma as a delimiter in the notification data to create fields, so the notification data within the policy looks like this

    Network Team,Network,Infrastructure

    The NOTIFDATA variable is expanded, and then assigned a variable inside the SetScript with the following bash script snippet

    declare -a ENOTIFDATA
    for x in $NOTIFDATA; do
    ENOTIFDATA=( "${ENOTIFDATA[@]}" "$x" )


    The SetScript then calls the Perl script with some arguments. The perl script will make the calls to Service Now.

    $SPECROOT/custom/scripts/SNow/RaiseInc.pl $AID "$AssignmentGroup" "Autogenerated - A $SEV alarm has occurred on $MNAME" "$EVENTMSG" "$Category" "$SubCat" "$SEV"

  3. Perl Script
  4. The Perl script is built from examples available from ServiceNow.

    The following example will need to be modified to suit your environment – specifically the parameters as different organisations will have different configurations for ServiceNow.


    #use lib '/usr/lib/perl5/custom';

    # declare usage of SOAP::Lite

    use SOAP::Lite;
    use feature 'switch';

    # specifying this subroutine, causes basic auth to use
    # its credentials when challenged
    sub SOAP::Transport::HTTP::Client::get_basic_credentials {
    # login as the itil user

    return 'spectrum_user' => 'spectrum_password';

    # declare the SOAP endpoint here
    my $soap = SOAP::Lite
    -> proxy('https://instance.service-now.com/incident.do?SOAP');

    # calling the insert function
    my $method = SOAP::Data->name('insert')
    ->attr({xmlns => 'http://www.service-now.com/'});

    # create a new incident with the following short_description and category
    my @params = ( SOAP::Data->name(short_description => $ARGV[2]) );
    push(@params, SOAP::Data->name(u_requestor => 'Spectrum 9.3') );
    push(@params, SOAP::Data->name(contact_type => 'Auto Monitoring') );
    push(@params, SOAP::Data->name(description => $ARGV[3]) );
    push(@params, SOAP::Data->name(u_business_service => $ARGV[4]) );
    push(@params, SOAP::Data->name(assignment_group => $ARGV[1] ) );

    given ($ARGV[6]) {
    when ("MINOR") {
    push(@params, SOAP::Data->name(urgency => '3') );
    when ("MAJOR") {
    push(@params, SOAP::Data->name(urgency => '3') );
    when ("CRITICAL") {
    push(@params, SOAP::Data->name(urgency => '3') );
    default {
    push(@params, SOAP::Data->name(urgency => '3') );

    # invoke the SOAP call
    my $result = $soap->call($method => @params);

    # print any SOAP faults that get returned
    if ($result->fault) {
    exec 'echo Incident Raising Error. Please check spectrum logs | mail -h smtp.dmz.localnet -s "Issue Raising Incident" admin@example.com';
    # print the SOAP response that get return

    # convenient subroutine for printing all results
    sub print_result {
    my ($result) = @_;

    # convenient subroutine for printing all SOAP faults
    sub print_fault {
    my ($result) = @_;

    if ($result->fault) {
    print "faultcode=" . $result->fault->{'faultcode'} . "\n";
    print "faultstring=" . $result->fault->{'faultstring'} . "\n";
    print "detail=" . $result->fault->{'detail'} . "\n";