Configure SNOW Subscriptions

ServiceNowLogo - Create SCOM subscriptions — ServiceNowLogo – Create SCOM subscriptions

Depending on requirements, creating multiple subscriptions within SCOM to leverage subscriber/channels required. Selecting rules/monitors, and resolution state conditions to help Application teams get incidents for key issues requiring intervention. NOTE Depending on what was command channels were created for various AssignmentGroup(s) and Team(s) within the organization.

Configure ‘TEST Holman’s Command Channel’ subscription

Configure channel to execute logAlert.ps1 command channel to verify SCOM outputs

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

TEST Holman’s Command Channel

Description

C:\MonAdmin\Scripts\LogAlert.ps1 Utilize LogAlert.ps1 example from Holman’s blog. Specific Subscription details: +CRITERIA = ALL Alerts +RESOLUTIONSTATE = NEW (0) +SUBSCRIBER = CHANNEL SCOM Command Channel Subscriber via POWERSHELL +CHANNEL Test LogAlert.ps1 SCOM Command Channel

Setup and use Holman’s script execution channel blog to test what account SCOM uses for notifications

https://kevinholman.com/2021/08/25/what-account-will-command-channel-notifications-run-as-in-scom/

Click on Settings

Example screenshot from Holman’s blog

Full path of Command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters

-executionPolicy bypass -noprofile -file “C:\MonAdmin\scripts\logalert.ps1” -AlertID “$Data[Default=’NotPresent’]/Context/DataItem/AlertId$” -AlertName “$Data[Default=’NotPresent’]/Context/DataItem/AlertName$” -AlertDescription “$Data[Default=’NotPresent’]/Context/DataItem/AlertDescription$” -Severity “$Data[Default=’NotPresent’]/Context/DataItem/Severity$” -ResolutionState “$Data[Default=’NotPresent’]/Context/DataItem/ResolutionState$” -ManagedEntityPath “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityPath$” -ManagedEntityDisplayName “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityDisplayName$” -ManagedEntityFullName “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityFullName$” -ManagedEntity “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntity$” -CreatedByMonitor “$Data[Default=’NotPresent’]/Context/DataItem/CreatedByMonitor$” -WorkflowId “$Data[Default=’NotPresent’]/Context/DataItem/WorkflowId$” -DataItemCreateTimeLocal “$Data[Default=’NotPresent’]/Context/DataItem/DataItemCreateTimeLocal$” -WebConsoleUrl “$Target/Property[Type=”Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer”]/WebConsoleUrl$?DisplayMode=Pivot&AlertID=$UrlEncodeData/Context/DataItem/AlertId$”

Startup folder for the command line:

C:\MonAdmin\SCRIPTS

Click Finish

Configure New-SNOWEvent command channel in SCOM

Grab file from GitHub repository https://github.com/theKevinJustin/New-SNowEvent

As needed, save TXT file as .ps1 on SCOM MS’s

Design recommendation

Create multiple command channels depending on assignment group and team(s) to pass these variables to the script.

NOTE path to setup channel execution, AssignmentGroup, and Team variables

Configure ‘TEST SNOW Event Creation’ SCOM Notification command channel

NOTE Use these steps to create multiple command channels, as the AssignmentGroup and Team may differ depending on Application Owners

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

TEST SNOW Event Creation

Description

C:\MonAdmin\Scripts\New-SNowEvent.ps1 Outputs 711 Events into Operations Manager event log.

Specific Subscription details: +CRITERIA = ALL Alerts +SUBSCRIBER = CHANNEL New-SNowEvent.ps1 via POWERSHELL +CHANNEL ServiceNow SNOW Event Creation Channel

New-SNOWEvent.ps1 command channel creates ServiceNow SNOW events for alerts and incidents.

This channel will also update the SCOM alert TicketID, Owner, ResolutionState to modify SCOM alert with SNOW information, or information passed in SNOW event.

See blog for more details https://kevinjustin.com/blog/2024/03/27/servicenow-event-integration/

Click on Settings

Full path of Command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters

-executionPolicy bypass -noprofile -file “C:\MonAdmin\scripts\New-SNowEvent.ps1” -AlertID “$Data[Default=’NotPresent’]/Context/DataItem/AlertId$” -AlertName “$Data[Default=’NotPresent’]/Context/DataItem/AlertName$” -AssignmentGroup “JustinTime System Admin” -Team SYM

Startup folder for the command line:

C:\MonAdmin\SCRIPTS

Click Finish

Create new channel for New-SNowIncident.ps1

Grab file from GitHub repository https://github.com/theKevinJustin/New-SNOWIncidents

As needed, save New-SNowIncident file as .ps1 on SCOM MS’s

Design recommendation

Create multiple command channels depending on assignment group and team(s) to pass these variables to the script.

NOTE path to setup channel execution, AssignmentGroup, and Team variables

Configure ‘TEST SNOW Event Creation’ SCOM Notification command channel

NOTE Use these steps to create multiple command channels, as the AssignmentGroup and Team may differ depending on Application Owners

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

TEST SNOW Event Creation

Description

C:\MonAdmin\Scripts\New-SNowEvent.ps1 Outputs 711 Events into Operations Manager event log.

Specific Subscription details: +CRITERIA = ALL Alerts +SUBSCRIBER = CHANNEL New-SNowEvent.ps1 via POWERSHELL +CHANNEL ServiceNow SNOW Event Creation Channel

New-SNOWEvent.ps1 command channel creates ServiceNow SNOW events for alerts and incidents.

This channel will also update the SCOM alert TicketID, Owner, ResolutionState to modify SCOM alert with SNOW information, or information passed in SNOW event.

See blog for more details https://kevinjustin.com/blog/2024/03/27/servicenow-event-integration/

Click on Settings

Full path of Command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters

Startup folder for the command line:

C:\MonAdmin\SCRIPTS

Click Finish

Configure SCOM Subscribers

Read the ‘Configure SCOM Subscribers’ blog to build out the SNOW subscribers for multiple PowerShell command channels. Create subscribers according to design requirements.

CHANNEL New-SNowEvent.ps1 via POWERSHELL

Follow the screenshots and fill in the wizard per the steps below.

Subscriber Name:

CHANNEL New-SNowEvent.ps1 via POWERSHELL

Click Next

SCOM subscriber wizard to Configure SCOM Subscribers - New-SNowEvent subscriber wizard — SCOM subscriber wizard to Configure SCOM Subscribers – New-SNowEvent subscriber wizard

Verify ‘always’ radio button is selected

NOTE If notifications required during specific times, configure as needed

Click Next

SCOM subscriber wizard - New-SNowEvent for Schedule radio button — SCOM subscriber wizard – New-SNowEvent for Schedule radio button

Type SnowEvent in Address name: text box

Click Next

SCOM Subscriber New-SNowEvent Address field in wizard

Change ‘Channel Type’ dropdown to Command

Select ‘ServiceNow SNOW Event Creation Channel’ Command Channel from dropdown

Click Next

SCOM Subscriber wizard - New-SNowEvent Channel drop down details — SCOM Subscriber wizard – New-SNowEvent Channel drop down details

On the Schedule tab, click Finish

SCOM Subscriber wizard - New-SNowEvent Schedule tab > Always send radio button — SCOM Subscriber wizard – New-SNowEvent Schedule tab > Always send radio button

Click Finish again to complete subscriber

SCOM Subscriber wizard - Suscriber final Finish window — SCOM Subscriber wizard – Suscriber final Finish window

Repeat steps to ‘Configure additional ‘SCOM Subscribers’

CHANNEL Test LogAlert.ps1 SCOM Command Channel via POWERSHELL

Optional create subscriber, depending on design requirements

CHANNEL Test New-SNowIncident.ps1 SCOM Command Channel via POWERSHELL

Additional Documentation to Create SCOM subscribers

SCOM2019 https://learn.microsoft.com/en-us/system-center/scom/manage-notifications-create-subscriptions?view=sc-om-2022

SCOM2022 https://learn.microsoft.com/en-us/system-center/scom/manage-notifications-create-subscriptions?view=sc-om-2022

Create SCOM Command Channels

Time to update SCOM, specifically to ‘create SCOM Command Channels’, then subscribers, and subscriptions. Depending on requirements, create multiple channels within SCOM.

Save .ps1 file(s) to SCOM MS

LogAlert.ps1 to verify SCOM notification account

New-SNowEvent.ps1 to inject events into ServiceNow

New-SNowIncident.ps1 to inject incidents into ServiceNow

Save LogAlert.ps1

Create Command channel script and save to SCOM MS(s)

From Kevin Holman blog https://kevinholman.com/2021/08/25/what-account-will-command-channel-notifications-run-as-in-scom/

Open in (notepad/notepad++/VSCode, PowerShell ISE) editor, paste the following:

param($AlertID, $AlertName, $AlertDescription, $Severity, $ResolutionState, $ManagedEntityPath, $ManagedEntityDisplayName, $ManagedEntityFullName, $ManagedEntity, $CreatedByMonitor, $WorkflowId, $DataItemCreateTimeLocal, $WebConsoleUrl)

$ScriptName = “logalert.ps1”

$EventID = “710”

$whoami = whoami

$momapi = New-Object -comObject MOM.ScriptAPI

# Begin logging script starting into event log

write-host “Script is starting. `n Running as ($whoami).”

$momapi.LogScriptEvent($ScriptName,$EventID,0,”Script is starting. `n Running as ($whoami).”)

#Log script event that we are starting task

$momapi.LogScriptEvent($ScriptName,$EventID,0,”Script is starting. `nRunning as ($whoami). `nAlertID: ($AlertID) `nAlertName: ($AlertName) `nAlertDescription:($AlertDescription) `nSeverity:($Severity) `nResolutionState: ($ResolutionState) `nManagedEntityPath: ($ManagedEntityPath) `nManagedEntityDisplayName: ($ManagedEntityDisplayName) `nManagedEntityFullName: ($ManagedEntityFullName) `nManagedEntity: ($ManagedEntity) `nCreatedByMonitor: ($CreatedByMonitor) `nWorkFlowId: ($WorkflowId) `nDataItemCreateTimeLocal: ($DataItemCreateTimeLocal) `nWebConsoleURL: ($WebConsoleUrl)”)

write-host “LogAlert.ps1 script logging SCOM Notification channel account whoami = $($whoami)” >> C:\MonAdmin\scripts\TestOutputChannel.txt

Save content as LogAlert.ps1 on SCOM MS’s

NOTE path to setup channel execution

Save New-SNowEvent.ps1

Create Command channel script and save to SCOM MS(s)

Grab file from GitHub repository https://github.com/theKevinJustin/New-SNowEvent

As needed, save New-SNowEvent file as .ps1 on SCOM MS’s

Save New-SNowIncident.ps1

Depending on design requirements, grab file from GitHub repository https://github.com/theKevinJustin/New-SNOWIncidents

As needed, save New-SNowIncident file as .ps1 on SCOM MS’s

Configure ‘Test LogAlert.ps1 SCOM Command Channel’

This command channel helps admins determine variables possible to pass to PowerShell script(s).

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

Test LogAlert.ps1 SCOM Command Channel

Description

Test LogAlert.ps1 SCOM Command Channel using Holman’s blog https://kevinholman.com/2021/08/25/what-account-will-command-channel-notifications-run-as-in-scom/

Full path of the command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters:

-executionPolicy bypass -noprofile -file “C:\MonAdmin\scripts\LogAlert.ps1” -AlertID “$Data[Default=’NotPresent’]/Context/DataItem/AlertId$” -AlertName “$Data[Default=’NotPresent’]/Context/DataItem/AlertName$” -AlertDescription “$Data[Default=’NotPresent’]/Context/DataItem/AlertDescription$” -Severity “$Data[Default=’NotPresent’]/Context/DataItem/Severity$” -ResolutionState “$Data[Default=’NotPresent’]/Context/DataItem/ResolutionState$” -ManagedEntityPath “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityPath$” -ManagedEntityDisplayName “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityDisplayName$” -ManagedEntityFullName “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityFullName$” -ManagedEntity “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntity$” -CreatedByMonitor “$Data[Default=’NotPresent’]/Context/DataItem/CreatedByMonitor$” -WorkflowId “$Data[Default=’NotPresent’]/Context/DataItem/WorkflowId$” -DataItemCreateTimeLocal “$Data[Default=’NotPresent’]/Context/DataItem/DataItemCreateTimeLocal$” -WebConsoleUrl “$Target/Property[Type=”Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer”]/WebConsoleUrl$?DisplayMode=Pivot&AlertID=$UrlEncodeData/Context/DataItem/AlertId$”

Startup Folder for Command Line:

C:\MonAdmin\SCRIPTS

Click Finish

Configure ‘ServiceNow SNOW Event Creation Channel’

SNOW Event command channel injects ServiceNow SNOW events, with logic to check for alert, incident, then update the SCOM alert TicketID, Owner, ResolutionState based on runtime.

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

ServiceNow SNOW Event Creation Channel

Use New-SNowEvent.ps1 to create SCOM subscription that creates SNOW incidents, then updates SCOM alert with TicketID, Owner, Resolution State for SCOM alert.

Full path of the command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters:

Startup Folder for Command Line:

C:\MonAdmin\SCRIPTS

Click Finish

Configure ‘ServiceNow SNOW Incident creation channel’

This command channel helps admins determine variables possible to pass to PowerShell script(s).

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

ServiceNow SNOW Incident creation channel

Use New-SNowIncident.ps1 to create SCOM subscription that creates SNOW incidents, then updates SCOM alert with TicketID, Owner, Resolution State for SCOM alert.

Full path of the command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters:

-executionPolicy bypass -noprofile -file “C:\MonAdmin\scripts\New-SNowIncident.ps1” -AlertName “$Data[Default=’Not Present’]/Context/DataItem/AlertName$” -AlertID “$Data[Default=’NotPresent’]/Context/DataItem/AlertId$” -Impact 4 -Urgency 4 -Priority 3 -AssignmentGroup “RCC-C – System Admin” -BusinessService SYSMAN -Category “SYSMAN Support” -SubCategory Repair -Channel Direct

Startup Folder for Command Line:

C:\MonAdmin\SCRIPTS

Click Finish

Test SNOW script

Time to ‘Test SNOW script’ for event or incident injection. As long as the prerequisites are verified, to include network connectivity, URL, ID, Password, etc., we’re ready to go!

Once the CredentialManager piece has been completed, by the same token you can begin testing the script. Testing can begin, whether to the SCOM Admin SA account, or to the SCOM Notifications account, or even hard coding the values into your PowerShell session.

Begin script testing

The testing leverages that you’ve downloaded various integration scripts first, then being saved on SCOM MS (management servers). The following blog posts, GitHub repo’s will set up multiple methods to test from PowerShell (command line) as SA or SVC accounts.

Create new SCOM Command Channels

LogAlert.ps1 from Kevin Holman’s blog https://kevinholman.com/2021/08/25/what-account-will-command-channel-notifications-run-as-in-scom/

New-SNowEvent GitHub repository https://github.com/theKevinJustin/New-SNowEvent

New-SNowIncident.ps1 GitHub repository https://github.com/theKevinJustin/New-SNOWIncidents

Once files are saved, copy to SCOM MS (noting path for later tests).

Preferred choice is non-system disk (i.e. D:)

Lab example is C:\MonAdmin\Scripts

RDP to server with SVC or SCOM Admin SA account

Open PowerShell as administrator

Change directory to script directory on SCOM MS

cd \ ; cd MonAdmin/scripts

Inventory saved files via dir (gci):

gci New-SNOW[ie]*.ps1

gci LogAlert.ps1

Grab Critical alert from $Alerts array

$Alerts = get-scomalert -ResolutionState 0 -severity 2

# Test warning events with Severity 1

# $Alerts = get-scomalert -ResolutionState 0 -severity 1

$AlertID = $Alerts[0].ID

$AlertName = $Alerts[0].Name

$AssignmentGroup = “JustinTime Infra”

PowerShell SCOM alert variables assumed for script to run from PowerShell

Test script supplying variables

.\New-SNowEvent.ps1 -AlertID $AlertID -AlertName $AlertName -AssignmentGroup $AssignmentGroup -Team SYM

.\New-SNowIncident.ps1 -AlertID $AlertID -AlertName $AlertName -AssignmentGroup $AssignmentGroup -Team SYM

New-SNOWEventPowerSHellOutput for REST Event injection.

Verify SCOM alert updated for ServiceNow REST injection

Check SCOM console/web console for SCOM alert updates to ResolutionState, TicketID, Owner fields, where TEAM = SYM, and Assignment Group = JustinTime Infra specified

SCOM Monitoring tab Active Alerts output view showing Owner, ResolutionState, and TicketId fields updated.

Be aware of issues

Indicator of Certificate/trust issue

Invoke-RestMethod error seen when organization cert not installed, making server sending REST injection NOT trusted.

Indicator when SNOW alert rule not configured or matching – excessive retry’s. Also note output shows summary of tests, ServiceNow SNOW detail, and SCOM alert updates.

New-SNOWEvent.ps1 failures when SNOW Alert rule not matching or created.

Logging to Operations Manager Event Log for addtional troubleshooting or debug. Unless otherwise updated, the script logs to the ‘Operations Manager’ event log, EventID = 710-712

Single Starting event indicates failed pre-requisite (pre-req NOT met)

SCOM OperationsManager events logging integration script status, as well as whoami and additional debug.

Additional information

ServiceNow Event integration

ServiceNow Incident Integration

Setup SCOM Notifications account

With domain joined machine, use a separate notification services svc account for notifications. SCOM is typically leverages MSAA, or even local system, depending on the accounts used when building out SCOM. Kevin Holman did an excellent job blogging this here

Verify SCOM notification account

Verify and ‘Setup SCOM Notifications account’ to separate notifications outside typical SCOM service SVC account functionality. Also, separating allows CredentialManager to secure, encrypt, and store credentials used by the notification account. Time to verify!

RDP to SCOM MS using notification account.

Open SCOM Console

Click on Administration tab

Expand Run As Configuration

Click on Accounts

Search for notification

Double click on Notifications account

Click on Credentials tab

Verify account being used, in light of CredentialManager piece storing SNOW ID and account.

NOTE Account should be part of SCOM Admins AD group

SCOM console view of Notifications SVC Account

SCOM Notifications Event Log troubleshooting

Knowing the notifications account will aid with SNOW integration scripts, as well as help log whoami, ‘run as’ logging to the ‘Operations Manager’ event log. The specific test and event or incident scripts leverage EventID’s 710-712. 710 for LogAlert.ps1, 711 for New-SNowEvent.ps1, and 712 for New-SNowIncident.ps1.

Single Starting event indicates failed pre-requisite (pre-req NOT met)