| \n\nRole title \\[name\\]\n\n | \n\nDescription\n\n | \n\nContains roles\n\n |
|---|---|---|
| \n\nEvent Management Administrator\\[evt\\_mgmt\\_admin\\]\n\n | \n\nHas read and write access to all Event Management features to configure Event Management.**Note:** Exercise caution with the evt\\_mgmt\\_admin role, as it can be elevated to the admin role. A user with the evt\\_mgmt\\_admin role has the ability to add and modify scripts that run on a global scope. Ensure proper access control. With this role, the user can create and/or update the following scripts:\n\n- Alert correlation rules\n- Alert management rules\n- Maintenance rules\n- Advanced scripts\n- Event field mapping\n- Pre- and post-binding scripts\n\n | \n\n- evt\\_mgmt\\_user\n- template\\_editor\\_global\n\n |
| \n\nEvent Management Operator\\[evt\\_mgmt\\_operator\\]\n\n | \n\nIn addition to the evt\\_mgmt\\_user permissions, can also activate operations on alerts such as acknowledge, close, open incident, and run remediations.\n\n | \n\nevt\\_mgmt\\_user\n\n |
| \n\nEvent Management User\\[evt\\_mgmt\\_user\\]\n\n | \n\nHas read access to all Event Management features. Has the itil role to be able to manage incidents that are created from alerts.\n\n | \n\nitil\n\n |
| \n\nEvent Management Integrator\\[evt\\_mgmt\\_integration\\]\n\n | \n\nHas create access to the Event \\[em\\_event\\] and Registered Nodes \\[em\\_registered\\_nodes\\] tables to integrate with external event sources.\n\n | \n\n \n\n |
| \n\nEvent Management AIOps Manager\\[evt\\_aiops\\_manager\\]\n\n | \n\nResponsible for overseeing NOC teams performance and can onboard AI Specialists as part of the agentic workforce features in AIOps.\n\n | \n\nevt\\_team\\_operator\n\n |
| \n\nEvent Management Team Operator\\[evt\\_team\\_operator\\]\n\n | \n\nCan create and manage their own integrations, set up their own alert automations, and enhance control over alert management for their teams.\n\n | \n\n \n\n |
| \n\nScheduled job\n\n | \n\nDescription\n\n |
|---|---|
| \n\nEvent Management — Connector execution job\n\n | \n\nCompares current time with time when active connector instances were last run and sets relevant connectors to execute. Runs every 10 seconds.\n\n |
| \n\nEvent Management — Handle Impact Stuck Service\n\n | \n\nReleases stuck services and marks them as requiring rebuilding in the Impact Changes table to rebuild the impact tree. Runs every 2 minutes, 31 seconds.\n\n |
| \n\nEvent Management — Impact Calculator Trigger\n\n | \n\nTrigger the impact calculation. The Event Management dashboard and impact tree are refreshed using the calculated figures.Runs every 6 seconds.\n\n |
| \n\nEvent Management — Impact Topology Consumer\n\n | \n\nConsumes topology changes and marks the related services as ‘require rebuilding’ in the Impact Changes table to rebuild their impact trees.Runs every 19 seconds.\n\n |
| \n\nEvent Management — Update stuck connectors\n\n | \n\nRelease connector instances that are stuck. Runs every 2 minutes.\n\n |
| \n\nEvent Management — Alert Priority Queue\n\n | \n\nCalculate [alert priority](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/alert-priority.md). Two Alert Priority Queue jobs are active and available and can be run multi-thread. Runs every minute.\n\n |
| \n\nEvent Management — Auto Close Alerts\n\n | \n\nAlerts that are idle longer than 7 days \\(default time period\\) are closed. Modify the default using the `evt_mgmt.alert_auto_close_interval` property. Runs every 10 minutes.\n\n |
| \n\nEvent Management — Calculate Alert Priority Grouping\n\n | \n\nRuns and calculates the priority groups: urgent, high, moderate and low for the alerts according to the highest and lowest priority score in the system.Runs every 30 minutes.\n\n |
| \n\nEvent Management — Close Flapping Alerts\n\n | \n\nClose flapping alerts. Runs every 5 minutes.\n\n |
| \n\nEvent Management — Close Threshold Alerts\n\n | \n\nClose threshold alerts. Runs every 2 minutes.\n\n |
| \n\nEvent Management — Evaluate Scoped Alert Rules Management0\n\n | \n\nExecute alert management rules. Two separate jobs run to ease the load on the system.Runs every 11 seconds.\n\n |
| \n\nEvent Management — Evaluate Scoped Alert Rules Management1\n\n | |
| \n\nEvent Management — Filter Services for Impact - Queue Handler\n\n | \n\nProcess changes from em\\_impact\\_inclusion\\_class and em\\_impact\\_filter\\_service.Runs every minute.\n\n |
| \n\nEvent Management — Impact Tree Builder\n\n | \n\nHandles all services with changes from the em\\_impact\\_changes table and rebuilds their impact trees.Runs every 11 seconds.\n\n |
| \n\nEvent Management — Insert Health Monitor\n\n | \n\nJob to produce the **ServiceNow Event Management** application services. Runs once every hour.\n\n |
| \n\nEvent Management — Maintenance Calculator\n\n | \n\nCalculate the maintenance for CIs. Runs every minute.\n\n |
| \n\nEvent Management — Node Count\n\n | \n\nCalculate [license usage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/license-usage.md). Runs once every hour.\n\n |
| \n\nEvent Management — Populate Impacted Services Table\n\n | \n\nScan cmdb\\_ci\\_service\\_auto and copy all services to em\\_impacted\\_service, along with all related classes to em\\_impact\\_inclusion\\_class.Runs once after upgrade.\n\n |
| \n\nEvent Management — Process Events\n\n | \n\nJob that runs and processes each Ready event \\(apply event rule, mapping rule, and create or update alert\\)Runs every 5 seconds.\n\n |
| \n\nEvent Management — Process Metric Binding\n\n | \n\nProcess metric binding.Runs every 5 seconds.\n\n |
| \n\nEvent Management — Process Records in em\\_extra\\_data\\_json\n\n | \n\nCreates events for log analytics anomalies.Runs every 13 seconds.\n\n |
| \n\nEvent Management — Queue Connector Processor\n\n | \n\nBi-directional functionality. Processes all pending alerts in the Update Queue and sends them to the MID Server. By default, this dequeue process is performed in batches of 1,000 alerts. Runs every 30 seconds.\n\n |
| \n\nEvent Management — Recalculate Impact for Groups\n\n | \n\nBy default, this job is not active. Can be run on demand to correct the impact on service groups.Runs on demand.\n\n |
| \n\nEvent Management — Recover Stuck Events\n\n | \n\nHandle all events that are in queued state and switch back to Ready to handle events from the beginning.Runs at system startup.\n\n |
| \n\nEvent Management — Update Health Monitor\n\n | \n\nUpdate the **ServiceNow Event Management** application services. Runs once every hour.\n\n |
| \n\nEvent Management — Update SLA Configuration Result\n\n | \n\nSynchronizes the CIs that match the SLA configuration filter with the Event Management SLA \\[em\\_ci\\_severity\\_task\\] table. Runs every 10 minutes.\n\n |
| \n\nEvent Management — Update SLA Severity\n\n | \n\nUpdates Event Management SLA \\[em\\_ci\\_severity\\_task\\] table with the new severity. Runs once every minute.\n\n |
| \n\nEvent Management — Convert IT Service\n\n | \n\nRun this property on demand to convert manual services to application services.Runs every 30 minutes.\n\n |
| \n\nEvent Management — Collect xmlstats\n\n | \n\nCollect event processing statistics.\n\n Runs once every minute.\n\n |
| \n\nEvent Management — Impact Calculator for Alert Groups and SLA\n\n | \n\nCalculates the effect of alerts on alert group services.\n\n |
| \n\nEvent Management — Manual Impact Calculator Trigger\n\n | \n\nManually trigger of Impact Calculation on all operational Services.\n\n |
| \n\n4x Event Management — Impact Calculator for BS\\_0\n\n | \n\nCalculates the impact of alerts on application services, and builds the impact tree on the Event Management dashboard. Four separate jobs run to ease the load on the system.\n\n |
| \n\n4x Event Management — Impact Calculator for BS\\_1\n\n | |
| \n\n4x Event Management — Impact Calculator for BS\\_2\n\n | |
| \n\n4x Event Management — Impact Calculator for BS\\_3\n\n | |
| \n\nEvent Management — Backfill Alert History table\n\n | \n\nLocates redundant records in the em\\_alert\\_history table and cancels them.\n\n |
| \n\nEvent Management — Backfill Impact Status table\n\n | \n\nLocates redundant records in the em\\_impact\\_status table and cancels them.\n\n |
| \n\nEvent Management — Impact for Groups\n\n | \n\nCalculates the impact of alerts on service groups.\n\n |
| \n\nEvent Management — Clean Alert History Table\n\n | \n\nCleans the Alert History \\(em\\_alert\\_history\\) table by removing records more than 90 days old.You can customize the amount of time after which alerts are removed by configuring **evt\\_mgmt.impact\\_calculation.cleanup\\_age\\_seconds.em\\_alert\\_history** in the sys\\_properties.list table.\n\n |
| \n\nEvent Management — Clean Impact Status Table\n\n | \n\nCleans the Impact Status \\(em\\_impact\\_status\\) table by removing records more than 90 days old.You can customize the amount of time after which alerts are removed by configuring **evt\\_mgmt.impact\\_calculation.cleanup\\_age\\_seconds.em\\_impact\\_status** in the sys\\_properties.list table.\n\n |
| \n\nProperty\n\n | \n\nDescription\n\n |
|---|---|
| \n\nProperty\n\n | \n\nDescription\n\n |
| \n\nevt\\_mgmt. connector\\_domain\\_info\\_table\\_name\n\n | \n\nThe table where you store domain information for personalizing domain separation.\n\n- **Type**: string\n- **Default value**: core\\_company\n\n |
| \n\nevt\\_mgmt. connector\\_domain\\_info\\_column\\_name\n\n | \n\nThe field name in the table to identify the provided domain for personalizing domain separation.- **Type**: string\n- **Default value**: name\n\n |
| \n\nevt\\_mgmt. connector\\_domain\\_id\\_column\\_name\n\n | \n\nThe field to get domain ID from for personalizing domain separation.- **Type**: string\n- **Default value**: sys\\_domain\n\n |
| \n\nevt\\_mgmt. connector\\_domain\\_path\\_column\\_name\n\n | \n\nThe field to get the domain path from for personalizing domain separation.- **Type**: string\n- **Default value**: sys\\_domain\\_path\n\n |
| \n\nevt\\_mgmt.connector\\_custom\\_domain\\_sep\\_cache\\_expire\\_in\\_seconds\n\n | \n\nFor personalizing domain separation, if you don’t want your main cache to expire every week.\n\n |
| \n\nevt\\_mgmt.connector\\_custom\\_domain\\_sep\\_user\\_access\\_on\\_domain\\_cache\\_size\n\n | \n\nFor personalizing domain separation, if you want to increase the size of the user access cache.\n\n |
| \n\nevt\\_mgmt.connector\\_custom\\_domain\\_sep\\_missing\\_domain\\_cache\\_expire\\_in\\_seconds\n\n | \n\nFor personalizing domain separation, if you want to increase the expire time for cache storing information regarding the missing domain.\n\n |
| \n\nevt\\_mgmt.connector\\_custom\\_domain\\_sep\\_cache\\_size\n\n | \n\nFor personalizing domain separation, if you need more main cache size for storing domain information.\n\n |
| \n\nTable\n\n | \n\nDescription\n\n |
|---|---|
| \n\nAlert \\[em\\_alert\\]\n\n | \n\nAlerts that Event Management manage.\n\n |
| \n\nAlert Correlation Rule \\[em\\_alert\\_correlation\\_rule\\]\n\n | \n\nRules specifying primary and secondary correlated alerts.\n\n |
| \n\nAlert Aggregation Group Alerts\\[em\\_agg\\_group\\_alert\\]\n\n | \n\nStores alerts associated with aggregated alert groups.\n\n |
| \n\nAlert Aggregation Group\\[em\\_agg\\_group\\]\n\n | \n\nRelationships between aggregated groups and primary alerts.\n\n |
| \n\nAlerts History\\[em\\_alert\\_history\\]\n\n | \n\nHistory of alerts. Used for impact calculation.\n\n |
| \n\nAlert Rule \\[em\\_alert\\_rule\\]\n\n | \n\nMappings of alert fields to the Incident \\[incident\\] table.\n\n |
| \n\nAlert Template\\[em\\_alert\\_template\\]\n\n | \n\nAlert templates. This table extends the Template \\[sys\\_template\\] table.\n\n |
| \n\nEvent Management SLA \\[em\\_ci\\_severity\\_task\\]\n\n | \n\nEvent Management SLA tasks for CIs and services.\n\n |
| \n\nConnector Definition \\[em\\_connector\\_definition\\]\n\n | \n\nSettings for gathering events from external event sources.\n\n |
| \n\nConnector Instance \\[em\\_connector\\_instance\\]\n\n | \n\nConnection details for external event sources.\n\n |
| \n\nMID Server to Connector Instance\\[em\\_connector\\_instance\\_to\\_mid\\]\n\n | \n\nMappings of MID Servers to connector instances.\n\n |
| \n\nEvent Management License Usage\\[em\\_unique\\_nodes\\]\n\n | \n\nWhen events are received by ITOM AIOps, an entry is added or updated in this table based on the monitored target specified in the received message. The entry links to its corresponding CMDB CI. If none is found, the entry is assigned **Type = Unknown**.\n\n |
| \n\nEvent \\[em\\_event\\]\n\n | \n\nEvents received by Event Management.\n\n |
| \n\nEvent Filter \\[em\\_event\\_filter\\]\n\n | \n\nStorage for defined event filters.\n\n |
| \n\nEvent Match Rule \\[em\\_match\\_rule\\]\n\n | \n\nUpdated events for alert processing. Used by event rules.\n\n |
| \n\nEvent Match Field \\[em\\_match\\_field\\]\n\n | \n\nMappings of event fields to alert fields. Simple mapping. Used by Event Rules.\n\n |
| \n\nEvent Compose Field\\[em\\_compose\\_field\\]\n\n | \n\nMappings of event fields to alert fields. Composite mapping. Used by Event Rules.\n\n |
| \n\nEvent Mapping Rule \\[em\\_mapping\\_rule\\]\n\n | \n\nUpdated event fields for alert processing.\n\n |
| \n\nEvent Processing Statistics \\[em\\_event\\_stats\\]\n\n | \n\nStatistics on Event Management performance.\n\n |
| \n\nEvent Type \\[em\\_event\\_type\\]\n\n | \n\nEvent types.\n\n |
| \n\nTask Template \\[em\\_incident\\_template\\]\n\n | \n\nTemplates that define how to populate new tasks. For example, how fields of an incident that is being created from an alert, must be populated. This table extends the Template \\[sys\\_template\\] table.\n\n |
| \n\nRegistered Nodes \\[em\\_registered\\_nodes\\]\n\n | \n\nRegistered nodes data.\n\n |
| \n\nThreshold Rule \\[em\\_threshold\\_rule\\]\n\n | \n\nAlert threshold rules.\n\n |
| \n\nBinding Device Map \\[Em\\_binding\\_device\\_map\\]\n\n | \n\nEvent binding to network paths and storage paths.\n\n |
| \n\nProcess to CI Type Mappings \\[Em\\_binding\\_process\\_map\\]\n\n | \n\nEvent binding to specific processes.\n\n |
| \n\nCI Remediation \\[em\\_ci\\_remediation\\]\n\n | \n\nRemediation rule definitions.\n\n |
| \n\nImpact Graph \\[em\\_impact\\_graph\\]\n\n | \n\nImpact tree of CIs containing CI hierarchy and impact rules to be used for impact calculation.\n\n |
| \n\nImpact Graph History \\[em\\_impact\\_graph\\_history\\]\n\n | \n\nHistory of changes in impact tree.\n\n |
| \n\nImpact Rule Definitions \\[em\\_impact\\_rule\\_definition\\]\n\n | \n\nDefinition of rules used for impact calculation.\n\n |
| \n\nImpact Rule instance \\[em\\_impact\\_rule\\]\n\n | \n\nRules based on impact rule definitions.\n\n |
| \n\nImpact Inclusion Classes\\[em\\_impact\\_inclusion\\_class\\]\n\n | \n\nSpecifies the classes to be used for impact calculation.\n\n |
| \n\nImpact Filter Services\\[em\\_impact\\_filter\\_service\\]\n\n | \n\nSpecifies services to be included or excluded from impact calculation.\n\n |
| \n\nInfrastructure Relations \\[em\\_impact\\_infra\\_rel\\_def\\]\n\n | \n\nChild-parent pairs or CI types. CIs matching these definitions are added to impact trees.\n\n |
| \n\nImpact Maintenance CIs \\[em\\_impact\\_maint\\_ci\\]\n\n | \n\nCIs that are in maintenance and therefore are excluded from impact calculation.\n\n |
| \n\nImpact Status \\[em\\_impact\\_status\\]\n\n | \n\nCalculated status of CIs and services to be displayed in the dashboard and service maps for dynamic CI groups.\n\n |
| \n\nSLA Configuration \\[em\\_sla\\_configuration\\]\n\n | \n\nSLA configuration records that identify the CIs that SLAs can run on.\n\n |
| \n\nService Analytics Metric Type Registration\\[sa\\_metric\\_registration\\]\n\n | \n\nSource registration details for processing raw data.\n\n |
| \n\nHealth monitor scripts\\[em\\_monitor\\_scripts\\]\n\n | \n\nThese scripts determine how to monitor or check, for example, when using the Connectors Monitor script. You can create customized script to monitor a device or an entity. The scripts provided with the base instance are:- Check delay in event processing\n- Connectors Monitor\n- Get Event Processing state\n- MID Server Threshold Alerts\n\n |
| \n\nMonitoring configuration\\[em\\_monitor\\_conf\\]\n\n | \n\nUse this table to configure what to monitor according to the scripts that are listed.Configure how often to run each script. If a script has a threshold, it determines what alert severity to display. Threshold values are in units of minutes and specify the delay time. Navigate to **Event Management** > **Settings** > **Self-Health configuration** to see the list of Monitoring Configurations or to create a new one. Use this script to test Data Center Monitoring.\n\nThe scripts provided with the base instance are:- Connector's idle state monitoring-monitor to verify whether any of the connectors was in idle state that surpassed the threshold \\[in minutes\\] that was configured.\n- Connectors Status- monitor to track the active status of the connectors.\n- Delay in event processing-monitor to track the duration \\[in minutes\\] of events that remained in 'ready' state and were not processed.\n- Event Processing job-monitors the state of the event processing jobs.\n- MID Server Threshold Alert-monitors MID Server health.\n\n |
| \n\nMonitoring Event Management Jobs\\[em\\_monitor\\_jobs\\_state\\]\n\n | \n\nMonitor Event Management jobs by adding the relevant jobs to the table. **Note:** The following jobs are not monitored by this table:\n\n- Event Management - Process Events\n- Event Management - Impact Tree Builder\n- Event Management - Recover Stuck Events\n- Event Processing\n\n |
| \n\nMonitoring state\\[em\\_monitor\\_state\\]\n\n | \n\nUse this table to set the threshold for each connector. When there is a value above the threshold, an alert is generated.\n\n |
| \n\nEM XMLStats Data\\[em\\_xmlstats\\_data\\]\n\n | \n\nSelf-health statistics and diagnostic details for Metric Intelligence and Event Management, which are used to produce the XMLStats page.\n\n |
| \n\nTable\n\n | \n\nDescription\n\n |
|---|---|
| \n\nSA RCA Status \\[sa\\_rca\\_status\\]\n\n | \n\nInformation \\(such as IDs\\) for the latest messages that were sent to the ECC Queue for a service during RCA.\n\n |
| \n\nSA RCA Output\\[sa\\_rca\\_output \\]\n\n | \n\nRCA learner output data.\n\n |
| \n\nSA RCA Group\\[sa\\_rca\\_group\\]\n\n | \n\nAutomated alert groups for the RCA query.\n\n |
| \n\nSA Analytics Alert Staging\\[sa\\_analytics\\_alert \\]\n\n | \n\nStaging table for alerts used for analytics.\n\n |
| \n\nSA RCA Input\\[sa\\_rca\\_input\\]\n\n | \n\nInput data for the RCA learner.\n\n |
| \n\nSA Analytics Status\\[sa\\_analytics\\_status\\]\n\n | \n\nLast run information to be used for alert aggregation and RCA.\n\n |
| \n\nSA RCA Group Alert\\[sa\\_rca\\_group\\_alert \\]\n\n | \n\nAlerts associated with automated alert groups.\n\n |
| \n\nSA RCA Service Configuration Item Association\\[sa\\_rca\\_svc\\_ci\\_assoc\\]\n\n | \n\nAssociations between CIs and services.\n\n |
| \n\nSA Alert Aggregation Learned Pattern \\[sa\\_agg\\_pattern\\]\n\n | \n\nLearned patterns from alert aggregation.\n\n |
| \n\nSA Alert Aggregation Learned Pattern Elements\\[sa\\_agg\\_pattern\\_element\\]\n\n | \n\nCI/Metric Name pairs associated with learned patterns.\n\n |
| \n\nSA Alert Aggregation Query Group Patterns\\[sa\\_agg\\_group\\_pattern\\]\n\n | \n\nRelationships between groups discovered in alert aggregation queries and patterns found in learning.\n\n |
| \n\nSA Alert Aggregation Query -- Staged \\(Recent\\) Alerts\\[sa\\_agg\\_group\\_alert\\_staging\\]\n\n | \n\nA staging table for alerts that have not yet been associated with any aggregated alert group.\n\n |
| \n\nSA Agg Pattern Attribute\\[sa\\_agg\\_pattern\\_attribute table\\]\n\n | \n\nCI/alert attributes to be used for finding patterns for alert aggregation.\n\n |
| \n\nSA Alert Attribute Populator Status \\[sa\\_alert\\_attribute\\_populator\\_status table\\]\n\n | \n\nState and statistics for attribute populator job.\n\n |
| \n\nSA Alert Aggregation Learned Pattern Elements Pair wise Mutual Information and Joint Probability \\[sa\\_agg\\_pattern\\_element\\_pair\\]\n\n | \n\nPairwise probabilities for pattern elements.\n\n |
| \n\nEM Agg Group Prediction\\[em\\_agg\\_group\\_prediction\\]\n\n | \n\nAlert predictions for alert groups.\n\n |