KBI 311781 Duplicated ServiceNow Tickets From The Same Argent Event

Version

Argent Advanced Technology – All Versions

Date

Wednesday, 10 October 2019

Summary

Argent can integrate with ServiceNow using email to open a ServiceNow ticket for an Argent Event

This article describes an issue where there are duplicate ServiceNow tickets created from one Argent Event

Technical Background

Argent Email can be used for integration between Argent and ServiceNow

An example is shown below




Click For Full Size

In the above example, the Argent Variable EVENT ID: %AGUniqueID% in the Email Alert definition is a unique identifier for an Argent Event

The Argent Event ID helps collaboration and helps ServiceNow correctly handle ticketing

When Argent detects that a condition is broken, an email alert is sent to the ServiceNow mailbox, and ServiceNow will handle ticketing

We need to ensure the Email Alert is not fired to the ServiceNow mailbox multiple times in order to prevent duplicate ServiceNow tickets

If duplicate ServiceNow tickets based on the same Argent Event are noticed, perform the following review:

  1. Retain samples of the duplicate ServiceNow tickets
  2. Track the source of the Alert firing to the Argent product and Relator
  3. Inspect the Relator Trace Log
  4. Identify if any Email Alerts were sent to the ServiceNow mailbox multiple times
  5. Review the Relator “What To Do (Alerts)” tab

Below is an example of a Trace Log showing that Email Alerts were sent multiple times to the ServiceNow mailbox,

   Mon Sep 16 21:46:04.574 ARGENT-SERVER monitor Start testing server SERVER-A.LOCAL (Engine: 64-bit, Trace: Normal)

   Mon Sep 16 21:46:04.574 ARGENT-SERVER monitor CONNECTED to SERVER-A.LOCAL (Credential: ‘Domain\ArgentService’)

   Mon Sep 16 21:46:04.574 ARGENT-SERVER monitor REUSE CONNECTION to SERVER-A.LOCAL (Credential: ‘Domain\ArgentService’)

   Mon Sep 16 21:46:18.281 ARGENT-SERVER monitor Added PDH Counter \Processor(0)\% Processor Time

   Mon Sep 16 21:46:36.373 ARGENT-SERVER monitor \Processor(0)\% Processor Time = 99.49

   Mon Sep 16 21:46:36.373 ARGENT-SERVER monitor >>> Total Time Consumed: 31.808 <<<

   Mon Sep 16 21:46:39.041 ARGENT-SERVER monitor (Result) \Processor(0)\% Processor Time = 99.49 (> 90) – Broken

   Mon Sep 16 21:46:39.057 ARGENT-SERVER monitor Performance data is saved successfully

   Mon Sep 16 21:46:39.135 ARGENT-SERVER monitor Event (#017638) of rule PRF_CPU_OVERLOAD of relator REL_SERVERS_CPU_90 on node SERVER-A.local is added to A1A console

   Mon Sep 16 21:46:39.416 ARGENT-SERVER monitor Email alert EMAIL_AUTO_ANSWER_REPORTING is executed successfully. (REL_SERVERS_CPU_90 / PRF_CPU_OVERLOAD)

   Mon Sep 16 21:46:39.618 ARGENT-SERVER monitor Email alert EMAIL_LOW_1_SERVICENOW is executed successfully. (REL_SERVERS_CPU_90 / PRF_CPU_OVERLOAD)

   Mon Sep 16 21:46:39.821 ARGENT-SERVER monitor Email alert EMAIL_LOW_1_SERVICENOW is executed successfully. (REL_SERVERS_CPU_90 / PRF_CPU_OVERLOAD)


Resolution

Ensure the Relator only contains one Email Alert or Alert Macro definition that will fire an Alert to ServiceNow mailbox once