{"id":20361,"date":"2024-05-30T13:54:04","date_gmt":"2024-05-30T17:54:04","guid":{"rendered":"https:\/\/kevinjustin.com\/blog\/?p=20361"},"modified":"2024-05-30T14:05:47","modified_gmt":"2024-05-30T18:05:47","slug":"test-snow-script","status":"publish","type":"post","link":"https:\/\/kevinjustin.com\/blog\/2024\/05\/30\/test-snow-script\/","title":{"rendered":"Test SNOW script"},"content":{"rendered":"
\"Test<\/a>
Test SNOW script – Testing, attention please!<\/figcaption><\/figure>\n

Time to ‘Test SNOW script’ for event or incident injection.\u00a0 As long as the prerequisites are verified, to include network connectivity, URL, ID, Password, etc., we’re ready to go!<\/p>\n

Once the CredentialManager piece has been completed, by the same token you can begin testing the script.\u00a0 Testing can begin, whether to the SCOM Admin SA account, or to the SCOM Notifications account, or even hard coding the values into your PowerShell session.<\/p>\n

 <\/p>\n

 <\/p>\n

Begin script testing<\/h2>\n

The testing leverages that you’ve downloaded various integration scripts first, then being saved on SCOM MS (management servers).\u00a0 The following blog posts, GitHub repo’s will set up multiple methods to test from PowerShell (command line) as SA or SVC accounts.<\/p>\n

Create new SCOM Command Channels<\/h1>\n

LogAlert.ps1 from Kevin Holman’s blog https:\/\/kevinholman.com\/2021\/08\/25\/what-account-will-command-channel-notifications-run-as-in-scom\/<\/a><\/p>\n

New-SNowEvent GitHub repository https:\/\/github.com\/theKevinJustin\/New-SNowEvent<\/a><\/p>\n

New-SNowIncident.ps1 GitHub repository https:\/\/github.com\/theKevinJustin\/New-SNOWIncidents<\/a><\/p>\n

 <\/p>\n

Once files are saved, copy to SCOM MS (noting path for later tests).<\/p>\n

Preferred choice is non-system disk (i.e. D:)<\/p>\n

Lab example is C:\\MonAdmin\\Scripts<\/p>\n

RDP to server with SVC or SCOM Admin SA account<\/p>\n

Open PowerShell as administrator<\/p>\n

    \n
  • Change directory to script directory on SCOM MS<\/li>\n<\/ul>\n

    cd \\ ; cd MonAdmin\/scripts<\/p>\n

    \"cd<\/a>
    cd to path; CD PowerShell path<\/figcaption><\/figure>\n

     <\/p>\n

      \n
    • Inventory saved files via dir (gci):<\/li>\n<\/ul>\n

      gci New-SNOW[ie]*.ps1<\/p>\n

      gci LogAlert.ps1<\/p>\n

      \"dir<\/a>
      dir gci New-SNow[ie]*.ps1<\/figcaption><\/figure>\n
        \n
      • Grab Critical alert from $Alerts array<\/li>\n<\/ul>\n

        $Alerts = get-scomalert -ResolutionState 0 -severity 2<\/p>\n

        # Test warning events with Severity 1<\/p>\n

        # $Alerts = get-scomalert -ResolutionState 0 -severity 1<\/p>\n

        $AlertID = $Alerts[0].ID<\/p>\n

        $AlertName = $Alerts[0].Name<\/p>\n

        $AssignmentGroup = “JustinTime Infra”<\/p>\n

        \"PowerShell<\/a>
        PowerShell SCOM alert variables assumed for script to run from PowerShell<\/figcaption><\/figure>\n

         <\/p>\n

          \n
        • Test script supplying variables<\/li>\n<\/ul>\n

          .\\New-SNowEvent.ps1 -AlertID $AlertID -AlertName $AlertName -AssignmentGroup $AssignmentGroup -Team SYM<\/p>\n

          .\\New-SNowIncident.ps1 -AlertID $AlertID -AlertName $AlertName -AssignmentGroup $AssignmentGroup -Team SYM<\/p>\n

          \"New-SNOWEventPowerSHellOutput<\/a>
          New-SNOWEventPowerSHellOutput for REST Event injection.<\/figcaption><\/figure>\n

           <\/p>\n

           <\/p>\n

          Verify SCOM alert updated for ServiceNow REST injection<\/h2>\n

          Check SCOM console\/web console for SCOM alert updates to ResolutionState, TicketID, Owner fields, where\u00a0TEAM = SYM, and\u00a0Assignment Group = JustinTime Infra specified<\/p>\n

           <\/p>\n

          \"SCOM<\/a>
          SCOM Monitoring tab Active Alerts output view showing Owner, ResolutionState, and TicketId fields updated.<\/figcaption><\/figure>\n

           <\/p>\n

          Be aware of issues<\/h2>\n

          Indicator of Certificate\/trust issue<\/p>\n

          \"Invoke-RestMethod<\/a>
          Invoke-RestMethod error seen when organization cert not installed, making server sending REST injection NOT trusted.<\/figcaption><\/figure>\n

           <\/p>\n

          Indicator when SNOW alert rule not configured or matching – excessive retry’s.\u00a0 Also note output shows summary of tests, ServiceNow SNOW detail, and SCOM alert updates.<\/p>\n

          \"New-SNOWEvent.ps1<\/a>
          New-SNOWEvent.ps1 failures when SNOW Alert rule not matching or created.<\/figcaption><\/figure>\n

           <\/p>\n

          Logging to Operations Manager Event Log for addtional troubleshooting or debug.\u00a0 Unless otherwise updated, the script logs to the ‘Operations Manager’ event log, EventID = 710-712<\/p>\n

          Single Starting event indicates failed pre-requisite (pre-req NOT met)<\/p>\n

          \"SCOM<\/a>
          SCOM OperationsManager events logging integration script status, as well as whoami and additional debug.<\/figcaption><\/figure>\n

           <\/p>\n

           <\/p>\n

          Additional information<\/h2>\n

          ServiceNow Event integration<\/a><\/p><\/blockquote>\n