Use Netcool to Leverage Service Now Discovery and CMDB Data

In a previous blog I outlined a possible method of integrating IBM Tivoli Netcool (specifically Impact/TBSM) with Service Now to raise incidents.This blog will outline one possible method to be employed to enrich IBM Tivoli Netcool with data from the Service Now (SNOW for short) Configuration Management Database (CMDB). The method in this blog was required by a customer to enrich data in Omnibus with data from Service Now while minimizing the number of SOAP calls required as nearly every event is to be enriched to build accurate dashboards at an operations centre.

There are many advantages to enriching data from a CMDB:

  • Location specific dashboards which enable operators to identify and fix potential problems before they impact the business.
  • The ability to identify specific customers particularly useful in a multi tenancy environment.
  • The ability to determine what CI’s impact upon other CI’s. For example, a data centre cluster going down would cause many alerts. By using the CMDB data it is possible for operators to identify the root cause and concentrate resources on fixing the root cause to reduce downtime.

The CMDB data in SNOW is populated by Service Now Discovery. For those unfamiliar with ServiceNow Discovery it identifies IP-enabled configuration items (CIs), maps their inter-dependencies, and populates and maintains them in the Service Now Configuration Management Database (CMDB). The discovery itself is scheduled to run at regular intervals such as once a week, which ensures the accuracy of the CI data across an enterprise.

With all this accurate data located in a central repository this makes it ripe for exploitation by IBM Tivoli Netcool.  IBM Tivoli Netcool Impact can be used as the engine to extract that data from the CMDB and feed the enriched data to dashboards viewed by operators.

IBM Tivoli Impact can use SOAP calls to enrich the data for each new event in the alerts.status database. However, this is not the most practical solution and the number of SOAP calls in a large and busy environment could be very high. It is necessary to come up with a solution to this problem and by using the ImpactDB to hold enrichment data it’s possible to vastly reduce the number of SOAP calls to SNOW.

For each new event Impact checks that the following field is populated “CINAME” if CINAME is populated Impact will attempt to enrich the data.

CI not present SOAPWhen the Impact policy begins its processing it checks that the Impact DB does not already hold enrichment data for that CI, if there is data for that CI then the event is enriched with data from the Impact DB. If there is no data for that CI in the Impact DB a SOAP Call is performed to SNOW to retrieve enrichment data. The initial SOAP call passes a single field to SNOW, that field is CINAME.  The SOAP response is customised to present the following fields for enrichment:

  • Customer
  • Email
  • Supportgroup
  • Environment
  • Location

On receiving the SOAP response the data is parsed for the above fields and inserted directly into the originating event in alerts.status and a row of data is inserted into the Impact DB. This ensures that future events that have the same CINAME field are enriched with data from the Impact DB and not via SOAP calls. This will vastly reduce the amount of SOAP calls used for enrichment.

CI present in SOAPBelow is a snippet of code used to populate the Impact Database with data from SNOW.

Snippet of Impact Policy to populate datasource

Snippet of Impact Policy to populate datasource

The impact Database to store the events used the following schema:


It should be noted that there is a “LOGGEDTIME” field this contains the timestamp from when the row of data was inserted. This is important as potentially over time CMDB data could change as the Service Now discovery typically runs once a week. Therefore this row of data can be deleted from the Impact DB by a trigger when the timestamp is over seven days old. This will help to ensure that only accurate data is used in enrichment.

With a method to reduce the number of SOAP calls and still enrich data identified it is time to conclude this blog. Of course there is far more to “Enrichment” than has been presented in this blog but I hope it has given you some ideas on how to sensibly leverage the CMDB data that is contained within Service Now. If you would like to discuss anything in this blog then give me call on Orb Data on +44 (0) 118 9450130  or or email me at .

Views: 241