Application services shown in Event Management Dashboard have incorrect impact. Even though the alerts have been closed, the status will not be changed back to "normal" state. You can see that there is inconsistency between the alert state in em_alert and em_alert_history table.

Steps to Reproduce

  1. Set the alert BR "Set update time" as not active.
  2. Create before BR that sleep for you 90 seconds. (on em_alert table).
  3. Create an event, which will create an alert automatically.
  4. Check that the created alert have created time in the past and updated time in the past.
  5. Check that the alert does NOT copied to the alert history table.


This problem has been fixed. If you are able to upgrade, review the Fixed In or Intended Fix Version fields to determine whether any versions have a planned or permanent fix.

If you are not able to upgrade yet, you can use the following workaround:

  1. Navigate to Event Management properties and change the value of "Number of events to process in bulk during each event processing job" from 500 to 1
  2. Or from the sys_properties table, change the property "evt_mgmt.max_objs_in_alert_query" from 500 to 1
  3. to fix current inconstancy that already created(dashboard shows closed alerts): run from "Scripts - Background" the attached script "emSupport-touchOpenAlertsHistory.txt" 

Related Problem: PRB1391728

Seen In

SR - IRM - Audit Management - New York 2019 Q3
SR - IRM - GRC Profiles - Madrid 2019 Q2
SR - IRM - GRC Workbench - New York 2019 Q3
SR - IRM - Policy and Compliance - Madrid 2019 Q2
SR - Security - Integration Framework - Madrid 2019 Q2
SR - Security - Support Common - Madrid 2019 Q2
SR - Security - Support Orchestration - Madrid 2019 Q2
SR - SIR - Security Incident Response - Madrid 2019 Q2
SR - SIR - Store SecOps Setup Assistant - Madrid 2019 Q2
SR - SIR - Store Threat Core - Madrid 2019 Q2
SR - SIR - Store Trusted Security Circles Client - New York 2019 Q3

Intended Fix Version


Fixed In

New York Patch 9
Orlando Patch 3

Safe Harbor Statement

This "Intended Fix Version" information is meant to outline ServiceNow's general product direction and should not be relied upon in making a purchasing decision. The information provided here is for information purposes only and may not be incorporated into any contract. It is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. The development, release, and timing of any features or functionality described for our products remains at ServiceNow's sole discretion.

Associated Community Threads

There is no data to report.

Article Information

Last Updated:2020-07-02 15:52:02