I have Spectrum integrated with Service Now in order to raise Incidents automatically when certain critical alerts come through on CA Spectrum
As a pre-requisite, Spectrum needs a user configured in Service Now with the ability to create records in the Incident table.
- Spectrum Configuration
- Perl Script
I have alarm notifiers setup to catch events that require an automated incident. The alarm notifier SetScript then calls a custom perl script in order to send the web services request to Service Now. The alarm notifiers are configured
The SetScript has also been modified to parse out some extra parameters from the policy’s Notification Data. The notification data is accessed from the script through the variable “$NOTIFDATA”.
I use a comma as a delimiter in the notification data to create fields, so the notification data within the policy looks like this
Network Team,Network,Infrastructure
The NOTIFDATA variable is expanded, and then assigned a variable inside the SetScript with the following bash script snippet
declare -a ENOTIFDATA
OldIFS=$IFS
IFS=','
for x in $NOTIFDATA; do
ENOTIFDATA=( "${ENOTIFDATA[@]}" "$x" )
done
AssignmentGroup=${ENOTIFDATA[0]}
Category=${ENOTIFDATA[1]}
SubCat=${ENOTIFDATA[2]}
The SetScript then calls the Perl script with some arguments. The perl script will make the calls to Service Now.
$SPECROOT/custom/scripts/SNow/RaiseInc.pl $AID "$AssignmentGroup" "Autogenerated - A $SEV alarm has occurred on $MNAME" "$EVENTMSG" "$Category" "$SubCat" "$SEV"
The Perl script is built from examples available from ServiceNow.
The following example will need to be modified to suit your environment – specifically the parameters as different organisations will have different configurations for ServiceNow.
#!/usr/bin/perl
#use lib '/usr/lib/perl5/custom';
# declare usage of SOAP::Lite
use SOAP::Lite;
use feature 'switch';
# specifying this subroutine, causes basic auth to use
# its credentials when challenged
sub SOAP::Transport::HTTP::Client::get_basic_credentials {
# login as the itil user
return 'spectrum_user' => 'spectrum_password';
}
# declare the SOAP endpoint here
my $soap = SOAP::Lite
-> proxy('https://instance.service-now.com/incident.do?SOAP');
# calling the insert function
my $method = SOAP::Data->name('insert')
->attr({xmlns => 'http://www.service-now.com/'});
# create a new incident with the following short_description and category
my @params = ( SOAP::Data->name(short_description => $ARGV[2]) );
push(@params, SOAP::Data->name(u_requestor => 'Spectrum 9.3') );
push(@params, SOAP::Data->name(contact_type => 'Auto Monitoring') );
push(@params, SOAP::Data->name(description => $ARGV[3]) );
push(@params, SOAP::Data->name(u_business_service => $ARGV[4]) );
push(@params, SOAP::Data->name(assignment_group => $ARGV[1] ) );
given ($ARGV[6]) {
when ("MINOR") {
push(@params, SOAP::Data->name(urgency => '3') );
}
when ("MAJOR") {
push(@params, SOAP::Data->name(urgency => '3') );
}
when ("CRITICAL") {
push(@params, SOAP::Data->name(urgency => '3') );
}
default {
push(@params, SOAP::Data->name(urgency => '3') );
}
}
# invoke the SOAP call
my $result = $soap->call($method => @params);
# print any SOAP faults that get returned
print_fault($result);
if ($result->fault) {
exec 'echo Incident Raising Error. Please check spectrum logs | mail -h smtp.dmz.localnet -s "Issue Raising Incident" admin@example.com';
}
# print the SOAP response that get return
print_result($result);
# convenient subroutine for printing all results
sub print_result {
my ($result) = @_;
}
# convenient subroutine for printing all SOAP faults
sub print_fault {
my ($result) = @_;
if ($result->fault) {
print "faultcode=" . $result->fault->{'faultcode'} . "\n";
print "faultstring=" . $result->fault->{'faultstring'} . "\n";
print "detail=" . $result->fault->{'detail'} . "\n";
}
}
References
http://wiki.servicenow.com/index.php?title=Perl_Web_Services_Client_Examples
This is awesome stuff! I’m assuming if there is a way to create Incident in SNow that there would also be a method to clear the alarm when the associated Incident is resolved/restored?
“Yes”.
But this depends on whether the alert in Spectrum has already been cleared. I was wanting to do this too, but I found that the alerts in Spectrum would often clear before the resolver techs would close the job off.
I have integrated spectrum and Servicenow for auto incident creation and this is working just fine. The issue here is , these incidents are not getting auto cleared even if alert is cleared from spectrum. Any idea ?
You could set up the ClearScript in Spectrum to close the incident in ServiceNow
Hi…Thanks for your reply …i m testing the clear script now…can you also tell me if we can put servicenow incident hyperlink into spectrum one click console so anyone can open the incident directly from spectrum.
You can update the ticket in Spectrum with the ServiceNow Ticket number by updating the “Trouble Ticket” field.
http://wiki.servicenow.com/?title=Navigating_by_URL#gsc.tab=0 <-- that'll show you how to build a URL using the ticket number Updating Spectrum can be done through the command line via vnmsh
Hi there,
I need to do the same integration between Spectrum and HP’s Service manager. I was wondering if you can help me out with the contents of the SetScript that you are using and also how the definition for the alarm notifier looks like. I am somewhat familiar with Spectrum but just can’t visualise how this all fits together. Your assistance will be greatly appreciated.
regards,
Coenie
Hi,
I would like to know what are the steps to achieve the integration between spectrum and servicenow.
Can someone please help me with this?