Event Management Fundamentals Flashcards
1
Q
What is an application service, within the context of ServiceNow’s ITOM Suite?
A
A collection of components that offer a service to your organization.
These components can include
- Network Devices
- Computers
- Applications
- etc
2
Q
What does Discovery do, within the context of ServiceNow’s ITOM Suite?
A
Discovery discovers and inventories components (Configuration Items) that make up an IT Infrastructure.
The technology provides a scheduled classification and update of configuration items and populates the Configuration Management Database.
3
Q
What does the CMDB (Configuration Management Database) do?
A
Catalogs the assets and services controlled by a company. The CMDB can be thought of as a database of configuration items, where CIs are hardware and software infrastructure components required to deliver a service.
4
Q
What does Service Mapping do, within the context of ServiceNow’s ITOM Suite?
A
Service Mapping moves the CMDB into the next strategic level by providing a targeted mapping of the IT components that support an application service.
The CMDB is transformed from an inventory to a service-aware dependency map.
5
Q
What does Event Management do, within the context of ServiceNow’s ITOM Suite?
A
Event Management collaborates with existing monitoring systems to provide a real time state of the IT infrastructure. The application processes infrastructure events through a combination of event mappings and rules. Events are converted and consolidated into significant alerts for investigation and remediation.
6
Q
What are 4 main features of ServiceNow’s ITOM Suite?
A
- CMDB population with devices and applications
- Service Mapping with dependencies
- Service Health with event and alert processing
- Infrastructure remediation with Integration Hub workflows and activities.
7
Q
What do Metric Intelligence and Health Log Analytics do?
(Supported by Agent Client Collector)
A
They proactively identify anomalies in your IT infrastructure before they cause service outages.
8
Q
How is Integration Hub able to provide automated investigation and remediation of IT systems?
A
Through the use of workflow, MID Server, and network processing technologies.
9
Q
How is Event Management helpful?
A
Event Management enables visualization of the state of the entire IT infrastructure with several tools.
10
Q
What does the Service Operations Workspace service dashboard do?
A
Provides a service-centric view that focuses on how alerts are impacting applications services.
11
Q
What does the Event Management Overview dashboard do?
A
Gives you a quick summary of active alerts and affected services. It can be configured to display alert analysis by service and/or configuration item.
12
Q
What is an event, within the context of Event Management in ServiceNow?
A
An event is a notable occurrence/notification from the infrastructure
In other words, an event is a monitoring tool notification indicating something of interest has occurred, like a failure or a warning.
The event contains information about the issue to help diagnose and resolve it.
13
Q
What determines if an event should be ignored, converted into a new alert, or update an existing alert?
A
Event processing with event rules
14
Q
What is an event rule, within the context of Event Management in ServiceNow?
A
A configuration that defines the conditions and actions to be taken when specific events occur within an organizations IT infrastructure.
15
Q
What is a metric, within the context of Event Management in ServiceNow?
A
A metric is a measure of an operating characteristic for a device over time, like memory usage or CPU utilization.
16
Q
What is Table Rotation, and why is it important within the context of Event Management in ServiceNow?
A
Table Rotation refers to the process of managing historical data in tables.
It is important to Event Management because, on a daily basis, events older than 5 days are cleared out of the event table via table rotation.
- For performance reasons, table rotation should not be altered.
17
Q
What are some Key Features for Event Management?
A
- Consolidates events from different sources
- Filters events to reduce noise and generate qualified events
- Relates events to CMDB CIs
- Identifies alerts created due to planned maintenance
- Performs service impact analysis
- Provides dashboards for understanding health and service status
- Spawns SN tasks from alerts
- Assists with alert remediation - automated or manual
18
Q
In the context of a MID Server, what does M.I.D. stand for?
A
Management
Instrumentation
Discovery
19
Q
What is a MID Server, within the context of ServiceNow Event Management?
A
The MID Server is a Java application that runs on a server on your local network as a Windows Service or a Unix daemon.
(Enables communication between a ServiceNow instance and the customer network)
20
Q
What does the MID Server do?
A
Facilitates communication and movement of data between the ServiceNow instance and external applications, data sources, and services.
21
Q
Within the context of Event Management, to what do MID Servers connect, and how do they connect?
A
In Event Management MID Servers connect to monitoring systems via connectors implemented with JavaScript and Groovy scripts.
Baseline connectors enable connection with a ridiculous amount of different systems.
22
Q
Within the context of Discovery, how does the MID Server initiate communication?
A
By querying the ServiceNow External Communication Channel (ECC) Queue.
23
Q
What is the ServiceNow External Communication Channel (ECC) Queue used for?
A
Data synchronization between the MID Server and the ServiceNow instance.
ECC Queues are used to transmit data, such as Discovery probe results or other information collected by MID Servers, from remote locations (where MID Server is installed) to the central ServiceNow Instance.
24
Q
Why is the ECC Queue important, within the context of data validity?
A
It helps maintain the synchronization and integrity of data across distributed environments.
25
Where is the MID Server installed?
The MID Server is installed behind the customer firewall, as close to the target devices (line-of-sight) as possible.
26
How does the MID Server initiate communications?
The MID Server initiates communications using SOAP on HTTPS port 443, which means that all communications are secure and initiated inside the enterprise firewall. No special firewall rules or VPNs are normally required.
27
What types of calls are made in the relationship between the MID Server and the ServiceNow instance?
MID Servers make outbound calls to the ServiceNow instance.
No inbound calls are made from ServiceNow to the MID Server.
Data is returned to the ServiceNow instance in XML and JSON formats.
28
What Operating Systems support MID Server installation, and what type of account is needed?
Windows and Linux 64-bit operating systems
The service requires a non-admin account on the hose machine to run under
29
What setup tasks are necessary for a MID Server manual installation?
- Create ServiceNow user
- Download installer file
- Install, validate, and test connectivity
Extended Response:
- Create the MID Server users account and grant the appropriate role (mid_server) to this user. (in SN)
- Download the appropriate installer file to the host machine
- Install the MID Server on a Linux or Windows host.
- Validate the MID Server to ensure that it is trusted
- Test connectivity between the MID Server and the instance.
30
Why would you deploy multiple MID Servers in your network?
For load balancing or when domain separation is required.
31
What is the External Communication Channel (ECC) Queue?
A connection point between an instance and the MID Server. Jobs that the MID Server needs to perform are saved in this queue until the MID Server is ready to handle them.
32
What is **Long Polling**, within the context of MID Servers?
**Long Polling** refers to an event-driven feature used for asynchronous communication between the MID Server and the ServiceNow instance. Long Polling allows a MID Server to continually query because the MID Server subscribes to an AMB (Asynchronous Messaging Bus) that is continuously available in the instance.
The request is kept open by ServiceNow much longer than a typical HTTP request. The ServiceNow server holds the request until new data or updates are available.
33
Why would you use Long Polling as opposed to traditional polling, within the context of the MID Server?
In a traditional polling approach, the MID Server would periodically send requests to the ServiceNow instance. This constant polling can be resource-intensive and may not provide real-time responsiveness.
Long polling reduces the overhead of continuous polling and provides near-real-time communication. It is especially useful when the MID Server needs to respond quickly to events or receive updates as soon as they are available.
34
What is an **Asynchronous Messaging Bus** (AMB)?
A communication mechanism that allows different parts of the ServiceNow platform to exchange messages and data asynchronously. In enables loosely coupled components and processes to communicate without being tightly integrated.
35
What AMB Channel does the MID Server listen to?
The MID Server opens a consistent connection to the instance through the AMB client and listens on the
/mid/server/
AMB Channel.
36
What happens when an output record is inserted into the ECC Queue?
An AMB message is sent to the MID Server’s channel. The MID Server receives this message and immediately polls the ECC queue for work.
37
What safeguard is in place to prevent AMB connection failure?
To safeguard against an AMB connection failure, the MID Server polls the ECC queue in 40 second intervals regardless of AMB message activity.
This interval is configured with the parameter - *mid.poll.time*
38
How does the MID Server know when it needs to upgrade?
The MID Server checks in with the ServiceNow instance hourly to determine whether it needs to upgrade.
39
How does Event Management use MID Servers?
To connect to third party monitoring systems via connectors.
40
What are **Probes**, within the context of the Discovery process?
**Probes** are small programs or scripts that run on a ServiceNow MID Server and use various protocols and methods to retrieve data from devices and systems being scanned.
41
There are 4 probe phases within the Discovery process, can you list them?
- Port Scan Phase
- Classification Phase
- Identification Phase
- Exploration Phase
42
There are 4 probe phases within the Discovery process. Please explain the first phase, the **Port Scan Phase**.
**Port Scan Phase:** Scan for open ports against the IP range. Open ports indicate the type of device. Some examples - port 22: Unix host // port 135: Windows host // port 515: printer
43
There are 4 probe phases within the Discovery process. Please explain the second phase, the **Classification Phase**.
**Classification Phase:** A classifier is created for each device and defines the device type based upon operating system or device function.
(Note that when CI classes are created in the CMDB, relationship rules must also be created)
44
There are 4 probe phases within the Discovery process. Please explain the third phase, the **Identification Phase**.
**Identification Phase:** An identifier is created for each device that captures key data about the device. (serial number, MAC address, etc)
45
There are 4 probe phases within the Discovery process. Please explain the fourth phase, the **Exploration Phase**.
**Exploration Phase:** Multiple exploration probes are generated for the target to capture device data (running processes, RAM, hard drive, etc)
46
How do probes collect data about CIs in the Discovery process?
The probes are placed as output records on the ECC queue. The MID Server downloads and executes the probe against the targets. The results are returned as input records in XML format on the ECC Queue. ServiceNow sensors parse the XML and update the CMDB.
47
What does **Bottom-Up** mean within the context of Discovery?
**Bottom-Up** refers to a discovery approach that starts from the lower levels of an IT infrastructure’s hierarchy and gradually works its way up to discover and map higher-level CIs and dependencies.
48
What does **Top-Down** mean within the context of Discovery?
**Top-Down** refers to a discovery approach that begins at the higher levels of an organization’s IT infrastructure hierarchy and gradually drills down to discover and map lower-level CIs and dependencies.
49
In Discovery, when should you use a Top-Down approach?
Service Mapping Discovery: Top-Down
Top down discovery discovers only IT components that support the provisioning of the service.
- **Service-Centric Focus:** You want to prioritize the discovery of critical business services and understand how they rely on underlying infrastructure. This approach is excellent for organizations where maintaining service availability and reliability is paramount.
- **Impact Analysis:** You need to quickly assess the impact of changes or incidents on key services. A Top-Down approach helps you identify the dependencies and relationships that affect service delivery.
- **Strategic Planning:** You are planning for IT service management (ITSM)or service-oriented initiatives, and you want to align your discovery efforts with your service management strategy
- **Limited Resources:** You have limited resources or need to make efficient use of your discovery capabilities. Starting with critical services can provide immediate value without exhaustive infrastructure scanning.
50
In Discovery, when should you use a Bottom-Up approach?
Traditional Horizontal Discovery: Bottom-Up
Bottom-Up discovery discovers all infrastructure assets based upon the scope of an IP range.
- **Infrastructure-Centric Focus:** You need a comprehensive understanding of your entire IT infrastructure, including all devices, servers, and network components. This approach helps your build a detailed inventory from the ground up.
- **Infrastructure Changes:** You are primarily concerned with tracking changes to hardware and software configurations, managing assets, and ensuring compliance.
- **Complex Environments:** Your organization has a highly complex and diverse infrastructure with numerous interconnected components that require detailed mapping.
- **Security and Compliance:** You are focused on security and compliance and need a thorough inventory for auditing and monitoring purposes.
51
What are **Dependency View Map**s, within the context of Event Management?
**Dependency View Map**s graphically display CIs and the relationships between them. It is a logical model showing how CIs are related.
52
What is the **Root Node** within the context of Event Management’s Dependency View Map?
The **Root Node**, also called the **Root CI**, is the starting point of the Dependency View Map.
The Root CI is surrounded by a darker frame that repaints itself with a pulsing effect.
53
What are **Application Service Map**s within the context of Event Management?
**Application Service Map**s provide a topology view for the CIs that support the provision of a particular service.
54
What is a **Service**?
A **Service** is a means of delivering value to customers by facilitating outcomes customers want to achieve without the ownership or specific costs and risks.
55
What are the baseline services that ServiceNow provides?
- Business Services
- Application Services
- Technical Services
56
What are **Business Services** in ServiceNow?
**Business Services**, typically order-able by business users, provide different offerings and service level commitments via the Service Catalog (Procurement, shipping, finance)
57
What are **Application Services** in ServiceNow?
Set of interconnected applications and hosts which are configured to offer a service to the organization.
Logical representations of deployed application stacks, such as a unique instance of an application. They can consist of discovered services, manual services, or both created with Service Mapping or CIs in the CMDB.
58
What are **Technical Services** in ServiceNow?
**Technical Services** are published to service owners and typically underpin one or more business or application services.
59
What are **Dynamic CI Groups** in ServiceNow?
**Dynamic CI Groups** are technical services populated with a relationship to a CMDB group. It is a dynamic grouping of CIs based on common criteria.
60
What is the **Common Service Data Model** (CSDM)?
A framework and approach used to standardize and structure data in the ServiceNow platform. The CSDM is designed to provide a common language and data model for defining, organizing, and representing IT services, assets, and other CIs in a consistent manner.
61
Within the context of the CSDM, what is **A Business Capability**?
A business mission or model.
62
Within the context of the CSDM, what is **A Business Application**?
Represents the environment to fulfill a business model.
63
How is Event Management related to Discovery and Service Mapping?
Event Management uses the maps and relationships defined by these applications to visually display the health of application services.
64
What are the two key Event Management tables?
The Events table (em_event)
The Alerts table (em_alert)
65
What does the **Event table** contain, within the context of Event Management?
The **Event table** *(em_event)* contains events received from monitoring systems, in *approximate* real time, including details of the issue.
66
What does the **Alert table** contain, within the context of Event Management?
The **Alert table** *(em_alert)* contains alerts generated from the processing of events.
67
What are some child tables of the Services table?
- The Business Service Table
- The Technical Service Table
- The Application Service Table
+ Other Service Tables
68
The **Application Services** table, extended by the Service Table, further extends to 3 tables that appear on the Event Management Operations Workspace *(Once the service is set to operational and can represent service health with alerts.)*
**What are those tables?**
- The **Mapped Application Service** table *(cmdb_ci_service_discovered)*
- The **Dynamic CI Group** table *(cmdb_ci_query_based_service)*
- The **Manual Service** table *(cmdb_ci_service_manual)*
69
The lifecycle of an event within Event Management is defined by the **State** attribute.
What are the 4 valid state values?
- Ready
- Processed
- Ignored
- Error
70
The lifecycle of an event within Event Management is defined by the **State** attribute.
What does the **Ready** state indicate?
Event has not yet been processed by the system and is ready to be.
71
The lifecycle of an event within Event Management is defined by the **State** attribute.
What does the **Processed** state indicate?
Event was successfully processed by the system
72
The lifecycle of an event within Event Management is defined by the **State** attribute.
What does the **Ignored** state indicate?
Event has been ignored because of an event rule.
73
The lifecycle of an event within Event Management is defined by the **State** attribute.
What does the **Error** state indicate?
Event encountered errors during processing, for example if the severity field was blank
74
What is **Event De-duplication**, within the context of Event Management?
**Event de-duplication** refers to the process of identifying and eliminating duplicate event messages.
75
What is a **Message Key**, within the context of Event Management?
A **Message Key** is a unique identifier associated with an event message used for de-duplication of events.
This identifier is typically extracted from the event payload or message and contains a subset of event attributes that are most likely to uniquely identify the event.
76
When viewing an event record what is contained within the **Node** field?
The event **Node** is the physical/virtual host/device on which the event occurred.
*(Typically one of the fully qualified domain name (FQDN), IP, or MAC addresses associated with the event.)*
77
When viewing an event record what is contained within the **Source** field?
The monitoring tool generating the event/
78
What is something important to remember about the **Severity** field of an event record?
**Severity** is a required field and if not populated will cause an error state. Event rules can be used to populate or translate severity into the ServiceNow standard in the alert.
79
What does a **Message Key** do, within the context of Event Management?
Uniquely identifies the event and determines if an existing alert is updated. The Message Key determines whether this is a repeat or update of an existing event that needs to be associated with an existing alert. Repeated events use the same key, the alert uses the same key as the event, and an alert can have many events attached.
80
If an event has no source-provided Message Key, what is the key auto-populated in *alert* composed of?
- Source
- Node
- Type (optional field)
- Resource or host
- Metric Name
**Example Message Keys**
- SolarWinds_100%CPU_10.1.1.19_CPU-CORE-1
- NGPerfMgr_MonAgentDown_GPMSProd01_AgentSrvce
81
What is an **Event Rule** within the context of Event Management?
An **Event Rule** is a configuration that specifies conditions based on event attributes, relationships, and logic. It is used to evaluate incoming event data and determine how to process, correlate, and take actions on those events.
Event rules provide a key component in event transformation to alerts.
Event rules do not change the event records in the event table but define the resulting alert content.
82
Give a simplistic high level overview of the Event Processing process within the context of Event Management.
- An external monitoring tool detects something deemed important and sends an event using the Mid Server and REST APIs
- An event is inserted into the event table
- Event rule processing applies
- Event field mappings apply
- Alert (maybe) generated
83
After an event arrives in the Event table, what is the next step in **Event Processing**?
As events arrive, event rules are check in their assigned order for matching
84
What does ServiceNow provide to simplify the creation of Event Rules?
Event Management provides recommended rules based on events actually flowing in.
The recommended rules engine analyzes and groups the events, and even provides filter regex expressions used to create the group.
85
What is the first filtering value within an Event Rule and what are some important things to remember about it?
The **Source** is the first filtering value within an event rule.
- If left blank, all sources will be included.
- The order is important as rules are processed in designated order.
- Multiple matching event rules can be applied by selecting *Apply additional matching rules* (If selected then threshold is disabled)
86
What does the **Event Rule Filter** typically contain, within the context of Event Management
Conditions that must be matched by the fields of the event to trigger the rule (you can also ignore events matching the filter)
87
How are the terms **Transform** and **Compose** relevant to Event Management and Event Rules?
Event rules enable event data to be **transformed** and **composed** to provide more meaningful data in the alert and to bind to the most appropriate CI.
For Example:
Node information embedded in the description can be placed in the node field in the alert for automatic CI binding. You can also manually compose new fields.
88
You are working with data gathered from an event. You are realizing that you need data slightly different than what is provided by the event. What are the two main options available and how do you determine which one to use?
- Manipulate the data to be more meaningful
- Reconfigure the source to provide different data
The approach you decide to take will be determined based upon your particular environment and use cases. Each case will be unique, but trying to work with the data before reconfiguring the source is a good idea for *beginners*.
89
What does event processing attempt to do with the text in the Node field (on the event record) by default?
Attempts to match the text in the Node field to a hostname, IP address, or MAC address, and bind the alert to the matching hardware.
90
When trying to bind event alerts to the relevant Configuration Item, what would you do if the event provides no information in the Node field, but does contain identifying information in the description field?
Event processing attempts to automatically associate to CI’s using the Node field, so if there is no information provided there we must do something else.
Because the description field in this scenario would contain identifying information we can utilize auto-regex parsing to extract the relevant information from the description and store it in the alert’s node field, enabling binding of the resulting alert to the correct CI.
91
What setting causes the disabling of Event Rule Thresholds for certain rules?
Rules using the **Apply additional matching rules** will have thresholds disabled.
92
What do **Event Rule Threshold**s do?
Thresholds enable the processing of events based upon a threshold metric and volume over a specified time period. (*The rate at which the event occurs over the defined period of time*).
If a threshold is met, an alert is generated.
93
What is a **Close Alert Operator** within the context of event rule thresholds?
The **Close Alert Operator** defines what is considered “*quiet*” and indicates that there is not longer a problem, then closes the alert.
94
What are the standard ServiceNow Event Management severities?
Standard ServiceNow Event Management severities are: 1 – Critical
2 – Major
3 – Minor
4 – Warning
5 - OK (previously Info) 0 - Clear
95
What’s a primary benefit of alert binding to the correct CI?
It simplifies the task of remediation for operators
96
Which fields does the default binding consider when binding alerts to CIs?
Node field to match CI name, FQDN, IP or MAC address field of host CIs
97
For which CI types does the default binding usually match?
Computer, switch, router, or any CI type extending the cmdb_ci_hardware table.
98
When you want to bind to nonhardware CI components, what should you do?
Override the default binding with event rules
99
How does CI Identification work within the context of CI binding?
It depends on identifying a host, then looking for a matching CI class running on that host.
100
When might you use regex in the event rule for Alert CI Binding?
To parse the event and populate the relevant values and key attributes in the alert.
101
What is the first step in the CI Binding Process Flow when an event arrives?
Event Management checks the node or CI identifiers.
102
What happens in the CI Binding Process Flow if no node exists?
The generated alert can bind to the CI using the alert Type, Additional information, or Configuration item identifier fields
103
What’s the significance of CI Identification rules in the context of Alert CI Binding?
The leverage the identification and reconciliation engine (IRE) to uniquely identify a class.
104
How does CI Field Matching work for CI binding?
It uses your selected CI type and name:value pairs in the Additional Information field to find a matching CI.
105
When binding directly to a nonhost CI using CI Field Matching, what’s an essential step?
Use Transform and Compose to clear the node field and populate the Additional Information field with identifying attributes.
106
How does the binding process differentiate between an event with a specified CI type running on an identified host versus directly binding to a non-host CI?
For an identified host, it identifies the host first and then looks for the specified CI type. For direct non-host CI binding, it relies on unique CI attributes.
107
What might you need to do if all the CI attributes in additional information are included in the matching algorithm?
Use Manual attributes to add the attribute name again with no value, effectively removing them from the matching process.
108
Why might monitoring tools be configured to provide enriched data for Event Management in ServiceNow?
To better identify the Configuration Item (CI) when generating events.
109
What is the role of Transform and Compose within the context of Alert CI Binding in Event Management?
It’s used to parse the event data, especially when the key binding data may not always appear against the correct attribute in the event. This aids in populating relevant values and key attributes in the alert.
110
What is the significance of the IRE when considering CI Identification in Alert CI Binding?
The Identification and Reconciliation Engine (IRE) leverages identification rules specific to the CI class to uniquely identify it, helping to correctly bind alerts.
111
How can one determine the criterion attributes for a CI class they are trying to bind to before creating a rule in Alert CI Binding?
By using the CI Class manager class definitions.
112
How does CI Field Matching identify a suitable CI in Alert CI Binding?
It uses selected CI type and name:value pairs in the Additional Information field to find a matching CI.
113
What’s the difference between binding to a CI type on an identified host and directly binding to a non-host CI in Alert CI Binding?
For a CI type on an identified host, the Node field is populated with a host identifier. For direct non-host CI binding, the node field is cleared and unique CI attributes are used instead.
114
What is the purpose of event field mapping in ServiceNow?
To replace known source event data with more meaningful or normalized data in the resulting alert
115
How is normalization in event field mapping exemplified?
Converting severity values from monitoring tools’ color values to Event Management standard numeric severity values.
116
Are event field mapping rules dependent on event rules?
No, they are independent of event rules.
117
When are event field mapping rules processed in comparison to event rules?
They are processed after event rules.
118
Where can one view the default event field mappings for system monitoring tools in ServiceNow?
Navigate to Event Management > Event Field Mappings.
119
What is the first step to define an event field mapping rule?
Populating the form with either source, filter, or both.
120
Name one of the main available mapping types in event field mapping
Regex
121
In event field mapping, what does the ‘single field’ option expose?
It exposes the key-value mapping on the form
122
How can an alert field value be determined during mapping?
By choosing to map to a single field from the event, specifying a constant value, copying field to field, or using regex.
123
In the context of event field mapping, what are ‘Source’ and ‘Target’ referred to?
They refer to the alert fields that need mapping.
124
What is the primary role of an alert in ServiceNow?
It signals operators about significant events within the infrastructure needing attention.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
125
How does grouping alerts simplify the operator’s job?
By focusing their attention on a single phenomenon, easing investigation and root cause analysis.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
126
How are alerts linked to Configuration Items (CIs) in ServiceNow?
They can be bound to CIs in service maps, indicating the state of application services and IT infrastructure.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
127
List the four main states of an alert’s lifecycle.
Open, Reopen, Flapping, and Closed.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
128
Describe the “Source” attribute in an alert record.
It’s derived from the event and can be values like SolarWinds of Ichinga.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
129
Explain the relationship between the alert “Message Key” and the event “Message Key”.
They share a one-to-one relationship.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
130
What does the “Task” attribute in an alert record refer to?
A task associated with the alert, such as an INC record or PRB record.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
131
What are the factors influencing the Alert Priority Score?
Components like business service criticality, severity, CI Type, role, number of secondary alerts, and alert state.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
132
Explain how the Alert Priority Score for services is calculated using the “Services Value.”
It’s the sum of individual service scores multiplied by 1,000,000
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
133
How can administrators modify the Alert Priority Score Calculation?
By adjusting category order, specific category score/weight mappings, or the CI Type importance.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
134
Describe the role of alert priority groups in ServiceNow.
They categorize alerts into Urgent, High, Moderate, and Low based on priority scores, helping operators prioritize their response.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
135
How are alerts sorted into priority groups on a technical level?
Through a combination of calculations based on percentages ad by setting a static threshold for certain groups.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
136
What does the “State” attribute in an alert record represent?
The current status or lifecycle phase of the alert.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
137
How do you differentiate between the alert priority group and alert severity?
The priority group considers multiple factors, making it more comprehensive and meaningful than severity alone.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 1: Alert Overview)
138
What is the objective of event management’s alert grouping?
To consolidate related alerts into a single phenomenon for improved focus.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
139
Define aggregation within the context of Event Management.
It’s the grouping of alerts based on similarities of relationships.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
140
How does correlation in Event Management function?
It employs rules or relationships to associate related alerts.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
141
List the types of alert groups in Event Management.
Log analytics, rule-based, automated, CMDB, text-based, and manual grouping.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
142
When is Log Analytics visible?
Only with the Health Log Analytics plugin installed.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
143
How does the properties form impact alert grouping?
It manages various parameters and behaviors of alert grouping.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
144
Explain CMDB Alert Groups.
Alerts are grouped based on CI relationships within the CMDB, such as hosting and containment rules.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
145
Define a primary alert.
It’s an alert that signifies the root cause or main issue in a group.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
146
How does the evt_mgmt.rule_based_manual_closure property affect secondary alerts?
When set to true, secondary alerts remain open even after the primary alert is closed.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
147
Describe tag-based alert correlation.
A non-code method for alert correlation that doesn’t rely on CMDB or model fine-tuning.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
148
How does Event Management identify common text patterns?
Through the application of clustering models.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
149
What data source does the automated aggregation algorithm use?
It uses 30 days of historical alert data.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
150
Define the role of a pattern identifier in automated alert groups.
It’s a combination of CI and feature identifier, or CI class and feature identifier.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
151
Highlight the significance of the Learned Patterns Report.
It displays metrics of recognized patterns, aiding in the identification of frequently occurring alert patterns.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
152
Name the jobs crucial for automated alert grouping.
Service analytics alert aggregation learner job, service analytics group alerts using RCA/alert aggregation, and service analytics - update virtual alert job
153
Define the role of Root Cause Analysis (RCA) in Event Management.
It aims to pinpoint probable root causes by analyzing alerts, CI topology, and changes on the CIs.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
154
Describe how CMDB relationships enhance event management.
They provide a foundation for automative alert grouping based on defined relationships.
155
Explain the benefit of the evt_mgmt.avoid_int_enabled property.
When enabled, it prevents incidents from being generated for secondary alerts if a primary alert incident already exists.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
156
Define Alert Clustering Tags
Criteria that must be met for alerts to be grouped.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
157
How does Predictive Intelligence enhance Event Management?
It facilitates the recognition of common text patterns in alerts via clustering models.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
158
Explain the service analytics group alerts using RCA/alert aggregation job.
This job matches new or reopened alerts to established patterns to form groups.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
159
How are patterns formed in manual alert groups?
Through the learning process of the alert aggregation learned job, based on manual operator actions.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
160
How do you access alert correlation rules in ServiceNow?
Navigate to Event Management > Alert Correlation Rules
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
161
Explain the role of a virtual alert.
In CMDB and automated alert groups, it acts as the primary or representative alert.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
162
What is the purpose of Alert Clustering Definitions?
They set conditions for invoking alert clustering tags, which group alerts from common causes.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
163
How do tag-based alert correlations operate?
They work in tandem with existing alert correlation algorithms.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
164
Describe the significance of alert patterns in automated alert groups.
They assist in recognizing and grouping alerts that repeatedly occur together within specific time intervals.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 2: Alert Grouping)
165
What is the primary purpose of Service Operations Workspaces?
To unify IT Operations and Service Management capabilities, enhancing service reliability.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
166
What role is needed to use Service Operations Workspace?
evt_mgmt_user
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
167
Which role allows access to the ITOM landing page in Service Operations Workspace?
evt_mgmt_operator
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
168
What can you monitor on the Service Operations Workspace landing page?
The status of assigned alerts +
analyze alerts and services that need your attention
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
169
What is the primary use of the Service Dashboard?
To monitor the health of services and filter desired information.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
170
What is a benefit of Default Alert Lists?
They categorize alerts for efficient display and management.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
171
How are Top Priority alerts defined?
Open alerts in the highest priority group category
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
172
When does the Alert List auto-refresh?
After an action is performed on an alert.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
173
In the Alert Layout, what does the Overview section display?
Important cards and records, dynamic based on group membership, shown when a CI is populated.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
174
What is the function of the Alert Form in Service Operations Workspace?
Enables operators to examine, diagnose alerts, and perform actions to expedite resolution.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
175
What is the purpose of the Overall Event Counter?
Tracks the total number of events associated with an alert, including purged ones.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
176
How long are events retained in ServiceNow?
Five Days
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 3: Service Operations Workspace)
177
What is a “flapping” alert in Event Management?
A flapping alert is one that receives multiple open-close events rapidly, indicating uncertainty if events are genuine.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 4: Flapping)
178
List the four main configurable flapping attributes.
Flap Count
Flap Start Window
Flap Last Update Time
Flap Last State
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 4: Flapping)
179
What is indicated by the alert state “Flapping”?
The alert is frequently opened and closed.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 4: Flapping)
180
What system property defines the number of times an alert must reoccur to enter the flapping state?
evt_mgmt.flap_frequency, with a default of 10 times
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 4: Flapping)
181
What is the “Flap Interval” and its default value?
evt_mgmt.flap_interval - The time (in seconds) within which flap_frequency is measured. Default is 120 seconds
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 4: Flapping)
182
Define “Flap Quiet Interval” and its default value
evt_mgmt.flap_quiet_interval - The time (in seconds) needed for an alert to exit the flapping state. Default is 300 seconds.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 4: Flapping)
183
When does an alert enter the flapping state?
When the Flap Count equals the value of evt_mgmt.flap_frequency and within the time period of evt_mgmt.flap_interval
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 4: Flapping)
184
What does the “Flap Quiet Interval” specify?
The quiet time duration required for an alert to exit the flapping state.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 4: Flapping)
185
What is the purpose of Alert Management Rules?
They enable administrators to provide operators with remediation actions based on alert content and CI classification.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 5: Alert Management Rules)
186
What actions can Alert Management Rules provide?
Automatically respond to alerts, open an incident, link alerts to knowledge base articles, open a task, and launch remedial actions via workflows.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 5: Alert Management Rules)
187
How can Alert Management Rules generate incidents?
The can automatically or manually create incidents. Alert data fields like description, severity, and CI are copied to the incident.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 5: Alert Management Rules)
188
What do system properties control in incident handling?
They control what happens to incidents when alerts are closed, reopened, and if resolving an incident will close associated alerts.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 5: Alert Management Rules)
189
Where can you modify these system properties?
Event Management > Administration > Event Management Properties
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 5: Alert Management Rules)
190
What happens to incident work notes when alerts are closed?
They are updated
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 5: Alert Management Rules)
191
What is the purpose of impact calculations in ServiceNow’s event management?
Impact calculations define how alerts show the severity of an issue against a parent CI of service, using impact rules, CI relationships, the history and quantity of alerts, the inclusion of network/storage devices, and the maintenance status of the CI.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
192
What elements are involved in impact calculations?
Impacts rules, number of related active alerts, history of the affected CI, relationships between CIs within a service, inclusion of network/storage devices, and whether the CI is in maintenance.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
193
How does a CI in maintenance affect impact calculations?
If a CI is in maintenance, alerts on the CI are excluded from the impact calculation.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
194
What do impact trees visually represent in ServiceNow?
Impact trees visually represent the impact of alerts on services, showing the relationships between CIs and the relative percentage impact of each child CI.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
195
How can the impact significance of an alert on the application service be determined?
The configuration of the impact profile determines the impact significance of an alert on the application service.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
196
What customization is possible for each CI regarding impact influence?
For each CI, you can manually configure the impact influence percentage and decide if the impact is on the parent CI or application service directly. You can also change the severity of the alert that will be propagated up to the parent of service.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
197
What are some examples of impact rules?
There are impact rules for network paths and storage paths, application and OS cluster members, infrastructure dependencies, and parent-child relationships, accounting for redundancy.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
198
How can impact rules be modified for each application service?
For each application service, you can modify the rule to fine-tune how and when alerts appear on the service.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
199
In which table are the Impact rules stored in ServiceNow?
Impact Rules are stored in the em_impact_rule table.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
200
What is the purpose of the svc_ci_assoc table in ServiceNow?
The svc_ci_assoc table is used for storing Service CI Associations, which depend on relationships.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
201
What factors contribute to the impact calculations in ServiceNow’s Event Management?
The factors include impact rules, number and history of alerts, CI relationships, inclusion of network or storage devices, and whether the CI is in maintenance.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
202
How is the impact defined in ServiceNow?
Impact is defined against the parent CI or the service, utilizing alerts apportioned against the CMDB and the application service map.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
203
How does a CIs maintenance status affect impact calculations?
If a CI is in maintenance, alerts on the CI are excluded from the impact calculation.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
204
What is the purpose of the Impact Tree in ServiceNow?
The Impact Tree visually represents the impact of alerts on services, displaying the relationships and relative percentage impact between CIs.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
205
How can the impact of an alert on the application service be configured?
The configuration of the impact profile determines the significance of an alert’s impact, and for each CI, you can manually configure the impact influence percentage and severity propagation.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 6: Impact Profile)
206
What is an SLA?
**Service Level Agreement**
An SLA defines a set time for a task to reach a specific condition and is often used for incidents, customer expectations, and reporting.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
207
How is an SLA defined?
An SLA definition record outlines timings, conditions, workflows, and other details to create and manage task SLAs.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
208
Where is the information about application services stored?
Each application service is recorded in the Event Management SLA table, specifically in the [em_ci_severity_task] table
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
209
What is the initial state of an application service within the context of Event Management?
The initial state is typically OK (green) for each service.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
210
When are SLAs triggered for application services?
SLAs are triggered when alerts are generated that affect the application service. The start condition is when the service enters a Critical of Major state, and the stop condition is when it’s in an OK or Clear state.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
211
What is the purpose of SLAs?
SLAs are used to track the availability of business services and are often essential for reporting and agreement compliance.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
212
How are task entries created in the Event Management SLA table?
Task entries in the Event Management SLA table (em_ci_severity_task) are created when the application service is created.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
213
How are SLAs triggered in relation to the application service?
SLAs are triggered by alerts that have an impact on the application service, with start, stop, and pause conditions specified against the table.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
214
What is the purpose of configuring SLAs?
SLAs are configured to define a set amount of time for a task to reach a certain conditions, such as incidents being closed or resolved according to customer expectations.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
215
What does an SLA definition record encompass?
An SLA definition record defines timings, conditions, and workflows required to create and progress task SLAs.
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
216
What table is used for each application service in Event Management SLAs?
Each application service has a single record in the Event Management SLA [em_ci_severity_task] table
(Now Learning Event Management Fundamentals Course: Module 4 - Topic 7: Service Level Agreements)
217
Describe the role and functioning of event connectors in ServiceNow.
Event connectors in ServiceNow pull events from various sources using baseline connectors or custom connectors created with JavaScript of Groovy. They require a MID Server for communication with the instance.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
218
What are the two main methods for ServiceNow to receive events?
Pushing - Where event sources send event directly
Pulling - Where event connectors in ServiceNow actively retrieve events.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
219
How do event listeners facilitate event pushing in ServiceNow?
Events can be pushed to the MID Server or directly to the ServiceNow instance, requiring configuration through scripting. Options include pushing directly to the em_event table via REST API or through transform scripts.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
220
List the push options to the MID Server in ServiceNow.
These include the MID WebService event listener, the MID SNMP traps listener, and listener transform scripts for configuration.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
221
List the different event sources available in ServiceNow.
- Vendor Specific Connectors
- Email
- Agent Client Collector
- Scripts
- SNMP Traps
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
222
How are Vendor Specific Connectors utilized as event sources in ServiceNow?
Using the MID Server architecture, they provide configurable monitoring connectors for various vendors.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
223
Explain how Email servers as an event source in ServiceNow.
Inbound email actions can be created to intercept and convert email data into events.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
224
What is the role of the Agent Client Collector in ServiceNow?
It’s an agent installed on hosts that provides events and metrics through the MID Server.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
225
Describe how Scripts serve as event sources in ServiceNow?
They populate the event table using the ServiceNow Web Service API, with languages such as PowerShell, cURL, JavaScript, and Python.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
226
What is the significance of SNMP Traps as event sources in ServiceNow?
Configured in the MID Server, they monitor key infrastructure events, similar to monitoring connectors.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 1**: Event Source Overview
227
What is essential for a successful monitoring connection in ServiceNow’s event management?
An active and validated MID Server, access credentials to the monitoring system, internal IP address and port, and polling intervals for scheduling access to the target system.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 2**: Configure a Monitoring Connection
228
How is Line-of-Sight (LoS) important in the context of setting up a monitoring connection?
The MID Server must have Line-of-Sight (LoS) to the monitoring system to establish a successful connection.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 2**: Configure a Monitoring Connection
229
Which credential type is typically required for accessing the monitoring system?
Basic Auth
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 2**: Configure a Monitoring Connection
230
What are the components required to create a customized pull connector?
JavaScript, a connector definition, and a connector instance
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 2**: Configure a Monitoring Connection
231
Briefly explain the PULL Process in ServiceNow’s event management.
Configure the MID Server, set up credentials, create a connector instance, then test and activate.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 2**: Configure a Monitoring Connection
232
What is the role of polling intervals in the monitoring connection?
Polling intervals are used for scheduling access to the target system.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 2**: Configure a Monitoring Connection
233
What is the purpose of using Inbound Email as an Event Source?
Monitoring systems can send events in the form of email to the instance inbox for processing. The email will have Subject, Body Text, and User/Recipient attributes that are used to identify and parse it as an event.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 3**: Email Event Sources
234
How can Inbound Actions or Flow Designer flows be used in email event processing?
They can parse the email and map the data to attributes of a specified table, creating a new event which is then processed.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 3**: Email Event Sources
235
What are the configurable options in Inbound Email Actions for Email Event Processing?
Options include specifying the table for generation of new record, setting when to run filters, mapping email data to table fields, and running scripts to extract data.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 3**: Email Event Sources
236
How do inbound actions process emails?
Inbound actions process emails based on execution order; the lowest has higher priority.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 3**: Email Event Sources
237
Which is the recommended method for processing inbound email, and why?
Flow Designer is recommended for its greater flexibility and integration capability. It allows modification of the baseline Process Email Event flow to meet specific needs.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 3**: Email Event Sources
238
What take precedence, Flows or Inbound Email Actions?
Flows take precedence over Inbound Email Actions.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 3**: Email Event Sources
239
What does Flow Designer allow you to specify and use for Email Event Processing?
Flow Designer allows specifying the target table for a new record, setting filters to identify the email, and using field actions to map email data to record attributes.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 3**: Email Event Sources
240
How can Event Management collect push events?
Event Management can collect events pushed directly to the instance or the MID Server, using push connectors included in the baseline system and scripts posting event data directly to the instance tables.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
241
How can you configure the MID WebService Event collector for push event messages?
Configure it to enable the URL method to push event messages to the MID Server, and use transform scripts on the MID to reformat event data.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
242
What is the role of Scripted REST API in push event collection?
It allows building a custom API to receive and process event data, with defined service endpoints, query parameters, headers, and scripts to manager the request and response.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
243
What does the ServiceNow API Explorer enable?
It enables quick generation of sample scripts to invoke a REST web call to a ServiceNow table to read, create, update, or delete, with configurable input parameters and output responses.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
244
What is the purpose of SNMP Traps in push event collection?
SNMP Traps are used by networked devices to communicate critical information. The ServiceNow MID Server acts as the collector endpoint for SNMP traps.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
245
How is the SNMP trap collector extension configured on the ServiceNow instance?
Navigate to MID Server > Extensions > MID SNMP Trap Listener.
The MID Server must run the SNMP trap collector extension.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
246
How do SNMP trap notifications appear in ServiceNow?
SNMP trap notifications will appear in ServiceNow as events.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
247
What do the baseline system push connectors enable in Event Management?
They enable event push communication for many systems and also provide samples for use as templates.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
248
How can you use the instance URI in push event collection?
You can create scripts and use the instance URI to POST even data directly to instance tables.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
249
What is the functionality of the Script REST API feature when creating a custom API?
It allows defining service endpoints, query parameters, headers, and writing scripts to manage the request and response.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
250
How does the REST API Explorer facilitate interaction with a ServiceNow table?
It generates sample scripts for making REST web calls to read, create, update, or delete records, with configuration of input parameters and output responses available.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
251
How is SNMP used by networked devices in the context of push events?
SNMP is used by devices to check each other’s activity and communicate critical information through SNMP Traps sent to a central collectors, the ServiceNow MID Server in this case.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
252
What are the steps to configure the SNMP trap collector extension on the MID Sever in ServiceNow?
Navigate to MID Server > Extensions > MID SNMP Trap Listener to configure the SNMP trap collector extension.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
253
What is the role of the MID Server in SNMP trap notifications?
The MID Server acts as the collector end-point for SNMP traps, allowing the notifications to appear in ServiceNow as events.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 4**: Push Event Collection
254
What is the primary function of Agent Client Collector?
Agent Client Collector collaborates with Event Management to provide a real-time state of the IT infrastructure. It enables monitoring service availability, examining the health of the environment, and ensuring that infrastructure and its applications are running properly.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
255
On what framework is Agent Client Collector build, and what does it enable?
It is built on a Sensu framework, which enables the adoption and extension of monitoring checks from the community.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
256
What are Checks in the context of Agent Client Collector?
Checks are individual commands that the agent runs, defined for both event and metric collection, including the frequency with which they run. They are defined on the instance and passed to the agent via the MID Server.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
257
How are Policies utilized in Agent Client Collector?
Policies are containers used to organize and manage groups of related checks and are executed by a population of agents at a given frequency. They use filters to apply to specific sets of CIs and contain customizable check instances.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
258
Describe the data flow to the Agent.
The administrator defines a monitoring policy, including target population, checks, parameters, and frequency. MID Servers listen for policy updates and pass the checks onto the Agents, which store/update check instances.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
259
Explain the data flow from the Agent.
The agent runs assigned checks and pushes results to the MID server. The MID server classifies the results as events or metrics and sends them to the ServiceNow instance using REST API for storage and processing.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
260
What is CPU Protection Mode in Agent Protection?
It is a self-monitoring feature that pauses data collection if CPU usage exceeds a threshold, preventing the agent from using too much of the host’s CPU. It is configurable through the agent’s acc.yml file.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
261
List the parameters available for configuring CPU Protection Mode and their defaults.
- agent_cpu_threshold_disabled (default = false)
- cpu_percentage_limit (default = 5%)
- repeated_high_cpu_num (default = 3)
- monitor_interval_sec (default = 60)
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
262
How can data collection be manually paused for a specific agent?
Data collection can be manually paused from the instance agent record.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
263
What information is displayed in the Agent Client Collector Health Dashboard?
The dashboard displays agent summary information, including Data Collection Status, indicating whether agents are manually or automatically turned off.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
264
What gets installed automatically with the installation of Agent Client Collector Monitoring?
Installing Agent Client Collector Monitoring will automatically install Agent Client Collector Framework. There are also additional ACC store apps supporting Visibility and Log Analytics.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
265
What roles are included with the Agent Client Collector installation?
- agent_client_collector_admin
- agent_client_collector_integration
- agent_client_collector_user
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
266
What permissions does the agent_client_collector_admin role have in Agent Client Collector?
The agent_client_collector_admin role has all permissions including access to REST API, the ability to add, edit, and delete policies, checks, agents, web sockets, and MID server management.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
267
What are the permissions associated with the following roles?
- agent_client_collector_integration
- agent_client_collector_user
- agent_client_collector_integration : Has access to REST API
- agent_client_collector_user : Has only view permissions.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
268
What is a Check Instance and how is it different from a Check Definition?
A Check Instance is a copy of the Check Definition created when associating with a policy.
A Check Instance is customizable, whereas it is advisable not to alter the original Check Definition. Changes to the original definition don’t apply to already created Check Instances.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
269
What does the Check Allow List contain and how is it installed?
The Check Allow List contains permitted check commands and is installed as a .json file with each agent. By default, it includes all validated OOTB checks at the time of agent installation.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
270
Describe the workflow of Policies in Agent Client Collector.
A policy remains in status New until published, Once published, it becomes Active, and agents are updated. Active policies can be deactivated, and agents notified. Editing a published policy creates a Sandbox copy, which overrides the original upon republishing. Changes can be reverted, and policies copied for subgroups.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
271
How are credentials added to policies?
For applications requiring credentials, create the credentials using Connections and Credentials, then edit the policy and add the credential in the Credentials related list.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
272
How is Agent Client Collector configured for service monitoring?
It includes base policies for monitoring service entry points, typically the URL for an application service. One of the installed agents is used for monitoring, and proxy settings are configured based on the type of proxy enabled.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
273
What does the default policy for service monitoring include and how can services be excluded?
The default policy includes all HTTP entry point CIs with the filter of Status being Operational. Services can be excluded from monitoring by de-selecting the “Is monitored by Agent Client Collector” field in the application service form view.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
274
How does the Agent Client Collector interact with MID Servers and ServiceNow instances in data flow?
MID Servers listen to policy updates from the instance and pass checks onto agents. Agents run checks and send results back to MID Servers, which classify data as events or metrics, then forward them to the ServiceNow instance.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
275
What are the implications of pausing data collection from the instance agent record?
Manually pausing data collection allows for stopping the agent from collecting data, which can be useful for maintenance or troubleshooting without affecting the CPU usage or other functionalities.
———————————————————————
📚 Event Management Fundamentals (NowLearning)
**Module 5**: Event Sources
**Topic 5**: Agent Client Collector
