Troubleshoot ServiceNow

This Orion Platform topic applies only to the following products:


This topic provides frequently asked questions about the ServiceNow integration.

Why are my incidents reopening right after I resolve them?

When you change an incident's state to the reset state manually and the alert that created this incident is still active, the incident transitions to the reopen state.

To forcefully close the incident, put it in one of the closing states.

Why are closed incidents reopening instead of creating a new incident?

Make sure the final closed state is one of the closing states.

If you never want to reopen an incident, set the reset state to a closing state.

Why are my incidents reopening after I changed the closing states?

This is a known issue. When you add a state to the group of closing states, the change is not reflected on incidents already closed according to the original definition of closing states.

If an incident was closed and the state it was in was not originally among the closed states, the incident gets reopened when the alert triggers again. After that (when its state is among closed states), the incident will not reopen any more.

You can also resolve this by updating the mapping in the database. Contact support for the script to run.

Why are my incidents not being reopened and only receive work notes?

Make sure you define the reset state, which is used to show that an incident is resolved. Only incidents in the reset state get reopened. This is to stop the incident from transitioning to the reopen state on any incident update.

Why does my incident not change state when I acknowledge its associated alert?

When you acknowledge the alert, the incident only changes to the defined acknowledge state when the incident has not been touched yet. This means that the incident is in the state defined in incident detail of the alert action.

Why is an object still reopening my tickets when it is no longer monitored (deleted on SolarWinds side)?

When you delete a monitored object, its related objects (triggered alerts, interfaces...) are deleted. If an alert is in the triggered state at the time of deletion, the incident stays in the triggered state with no way to reset.

The incident will be cleaned up during nightly database maintenance.

To resolve the issue immediately, run the maintenance.

I want the integration to only create incidents and leave them alone afterwards. How do I do this?

If you do not define any states in the Create ServiceNow Incident alert action, the incident will be created and receive notes when actions happen in the Orion Platform, but its state will not be changed.

However, there will only be one incident at a time. Only when it is closed would a triggered alert create a new one.