Optional Observer Configurations

Custom alerts allow you to define your own alerts to occur when ServiceNow events meet certain conditions. This provides you a way to monitor events that are not covered by the built-in alerts already included with Observer.

Here's how to create one:

1. In Observer, click the menu icon (), followed by the Settings icon (), followed by Alert Configurations
   
   
2. Near the bottom right corner of the page, above theActions column, click +New
   
   
3. Type directly in each of the fields to add your custom alert (see more information below). At least one out of three of the following fields must be filled out: Threshold, Velocity, Analysis Window.
   
   
4. Click Save

Field descriptions:

(A) Active: Check the box to make your custom alert active in Observer.

(B) Name: The name of the custom alert which is also the name of the event that will cause this alert to occur. This is the name that is sent in the “name” field of messages sent from your ServiceNow instance to Observer. For example, if your ServiceNow instance has events called “Perspectium_Monitor” and you've set it up inside the Perspectium app (under Perspectium > Observer > Event Subscription) to send messages to Observer, then you can create a custom alert with this name to alert when certain conditions are met as described below.

(C) Description: Type any description for your custom alert.

(D) Threshold Operator: A dropdown containing operators such as “>”, “<”, “>=”, “==”, etc. This is used with the valued entered for threshold to determine a minimum, maximum or specific event value in order for the alert to occur. For example if you have “>” here and “25” in threshold, the condition for this alert with be an event that has a value of greater than 25.

(E) Threshold: The maximum value that must be met and/or exceeded for this custom alert to be triggered. This value must be a number value and is used in conjunction with the threshold operator value to determine how the threshold behaves.

(F) Velocity Operator: A dropdown containing operators such as “>”, “<”, “>=”, “==”, etc. This is used with the valued entered for velocity to determine the velocity direction. For example if you have “>=” here and “5” in velocity, the condition for this alert with be a velocity of greater than or equal to 5.

(G) Velocity: When an event is received, the rate of change per minute that must be met from the last time this event occurred for this alert to happen. This is used in conjunction with the velocity operator and must be a number value. For example, if you have the velocity condition of “>=” and “5”, then the alert requires that the event be increasing at a rate of greater than or equal to 5 per minute from the last time this event occurred.

(H) Analysis Window: The time window in minutes to analyze if an alert will occur. Generally when an event occurs, it is logged in Observer and then if the same event occurs again in the time window specified here, then an alert will be created. This value must be a number value. For example, if the analysis window is “12”, then an event must occur twice in a 12 minute time window for an alert to occur.

 NOTE: After you have created your custom alert, you can modify any field for that custom alert by clicking and typing directly into that field. You can test your custom alert by clicking the right arrow icon () or delete your custom alert by clicking the trash icon (). Testing your custom alert will not actually create an alert.

 This is an advanced procedure that requires knowledge of scripting with ServiceNow APIs.

To create an event for slow transactions:

1. In ServiceNow, type Scheduled Jobs into the Filter Navigator in the top left and select it (it should appear under Perspectium > Observer)
   
   
2. At the top of the Scheduled Jobs form, click New to create a new Scheduled Job
   
   
3. Type a name for your new Scheduled Job and make sure the Active box is checked
   
   

4. Scroll to the scripting section and type your script for the new job
   
   Below is an example of a script that could be used to create a new Scheduled Job for Observer called slow.transaction. For more information about creating scripts for Perspectium Jobs in ServiceNow, see the ServiceNow API Reference Guide.
   
   

   // Identify any instance within the last 15 minutes of the job "JOB: Perspectium MultiOutput Processing" running longer than 1000; output one event per instance found
   var gr = new GlideRecord("syslog_transaction");
   gr.addEncodedQuery("type=scheduler^url=JOB: Perspectium MultiOutput Processing^sys_created_onONLast 15 minutes@javascript:gs.minutesAgoStart(15)@javascript:gs.minutesAgoEnd(0)");
   gr.addQuery("response_time", ">", 1000);
   gr.query();
   while(gr.next()){
       var msg = "Job " + gr.url + "(" + gr.sys_id + ") is taking too long: " + gr.response_time + " ms";
       gs.eventQueue('slow.transaction', current, msg);
   }

   
   

5. Click Submit
   
   
6. To apply the script, go to the Event Subscription module by searching in ServiceNow's filter search at the left (it should appear under Perspectium > Observer)
   
   
7. Click New to create a new Event Subscription
   
   
8. Type a name for your new Event Subscription next to Event
   
   

9. For the script section, add your script according to the example below
   
   

   answer = event.param1 + "|" + event.param2

10. Click Submit

By default, Observer will monitor and collect data from your ServiceNow instance 24/7. However, you can configure Observer monitoring and data collection to be turned off for a specified time window.

Here's how:

1. In ServiceNow, type Observer into the Filter Navigator in the top left and select Properties (it should appear under Perspectium > Observer)
   
   
2. Check the box under Enable a time period daily when Observer will not send data
   
   
3. Type or select a Start time and End time to correspond with the time for which you want to turn off Observer monitoring and data collection
   
   
4. Click Save

 This is an advanced procedure that requires knowledge of scripting with ServiceNow APIs.

In ServiceNow, you can create your own Perspectium Action to perform custom monitoring and send in your own events. For example, you may want to monitor the total number of tasks created daily. You can do this by leveraging the PerspectiumObserver script include that comes as part of the Perspectium Core Update Set for ServiceNow. The following functions available for use in the PerspectiumObserver script include: 

Custom flags can be posted to Observer to mark an integration event such as success or failure. These flags can be used to alert as well. 

Here's how to create a method that will post your custom flag to Observer using Python and the AMQP Python client:

1. Create a method that will post the flag to Observer using the code below, where <perspectium_mesh_url> is the Perspectium Mesh URL and <customer_vhost> is your vhost as provided by Perspectium.
   
   

   #!/usr/bin/env python
   
   import pika
   import sys
   import socket
   import os
   import time
   
   def postFlag():
   	credentials = pika.PlainCredentials('username','password')
   	connection = pika.BlockingConnection(pika.ConnectionParameters('<perspectium_mesh_url>',5672,'<customer_vhost>',credentials))
   	channel = connection.channel()
   	channel.queue_declare(queue="")
   	channel.basic_publish(exchange='',routing_key='psp.in.servicenow',body='{ topic:"monitor", type:"label", key:"perspectiumdemo1", name:"integration.failed", value: "1"}')
   	connection.close()

2. Call the postFlag() method in a try/catch block
   
   

   try:
       soapMethodToServiceNow();
   except Exception e:
       print "Integration failed, posting integration flag to Observer"
       postFlag()

   
   

3. Now, log into Observer and click the Settings icon ()
   
   

4. Click Alert Configurations
   
   

5. Click the Events tab
   
   

6. Enter a name for your custom alert under the Name heading and select a Type from the dropdown
   
   

7. Click Save
   
   

Custom external events can be posted directly to Observer for monitoring. The following is an example using python and the AMQP python client to create a method that will post a flag for external events to Observer, where <perspectium_mesh_url> is the Perspectium Mesh URL and <customer_vhost> is your vhost as provided by Perspectium:

#!/usr/bin/env python

import pika
credentials = pika.PlainCredentials('username','password')
connection = pika.BlockingConnection(pika.ConnectionParameters('<perspectium_mesh_url>',5672,'<customer_vhost>',credentials))
channel = connection.channel()
channel.queue_declare(queue="")
channel.basic_publish(exchange='',routing_key='psp.in.servicenow',body='{ topic:"monitor", type:"statsx", key:"demo005", name:"transaction_sec", value: "1423"}')
connection.close()

After installing the Perspectium for ServiceNow update set and the Perspectium Observer update set, you have the option to uninstall non-Observer tables, scheduled jobs, and modules from your ServiceNow instance. The Uninstall Non-Observer Components module ensures easy and secure removal of Perspectium features (e.g. group share, bulk share, etc.) that are not needed by Observer. 

To access this module, go to Perspectium > Observer > Uninstall Non-Observer Components. Click Confirm to proceed with uninstalling all non-related Observer features from Perspectium. 

You may have to log out and log back in to your ServiceNow instance in order to see all non-Observer modules removed from the navigation menu on the left.

Tables that get removed may vary depending what version of the update set you have installed. Check the table below for ServiceNow tables and scheduled jobs that will NOT be removed:

Disabling the Observer upset set will stop Perspectium Observer jobs from running on your ServiceNow instance.

Here's how:

1. Go to Perspectium > Observer > Scheduled Jobs and set the Active field on all jobs to false - this will stop any Perspectium jobs currently runing, and set the triggers to cancel them from running again
   
   

   Warning

   DO NOT deactivate Perspectium MultiOutput Processing. 

   
   
   

2. Now, delete all of the scheduled jobs that were set to false in step 1 - this prevents someone from accidentally scheduling the jobs to run again. 
   
   

3. In addition to the Scheduled Jobs, which poll for data, there are Event Listeners, made up of the Event Subscription and associated built-in Script Actions. Now, delete all Event Listeners, which will also delete all associated Script Actions. 
   
   
   
   
4.   Step 3 should account for all out-of-box Perspectium Script Actions, but you should double check that all Script Actions are deleted, included any custom ones that may have been created. To do so, go to Perspectium > Observer > Script Actions and delete any remaining script actions listed. 
   
   
   
   
5. Next, delete all Follow Transactions - these need to be triggered manually to begin processing, but it's best practice to delete them all
   
   
   
   
6. (Optional) You can hide the Perspectium application from view altogether to prevent users from accessing it - you can remove it by following the steps on Application navigator
   
   
7. (Optional) You can remove the tables for Observer, since it won't be generating or posting any messages. If you wish, delete the following tables only (we recommend leaving any remaining tables intact):
   
   

   • u_psp_situations

   • u_psp_sit_template

   • psp_event_subscription

   • psp_follow_transaction

   • u_psp_actions

   • u_psp_observer_out_message

In Observer's trend chart, you have the option to assign URLs to flags, allowing you to simply click on a flag to open a webpage.

Here's how:

1. Click on any flag that appears on a trend chart
   
   
   
   
2. If a URL has not yet been assigned, a dialogue box should pop up, which displays the name and value of the flag, along with fields to add a URL and description (optional). Fill out the URL field, and the description field (if you wish), and click Assign
   
   
   
   
3. If you want to modify the URL once it's been assigned to the flag, you can do so in Settings > Alert Configurations > Events

For any trend chart, you can generate an aggregate table of all metrics according to a specific date/time range, just with the click of one button. The generated table will contain AVG, MIN, MAX, STD-DEV, and the total COUNT of the values in the range. 

To aggregate a chart, click the function icon () as seen below

To view details about your ServiceNow instance that is providing data to Observer, hover the Observer for ServiceNow logo on any Observer page. A popup will appear displaying the following information about your ServiceNow instance:

This is an example of alerting when an import set run does not complete. If you are familiar with firing a custom event within ServiceNow, you can skip to step 3.