Possible loss of events coming from Operation Bridge Manager (OBM) due to pull connector failed to handle multiple OBM events that share the same timestamp - Known Error

Possible loss of events coming from Operation Bridge Manager (OBM) due to pull connector failed to handle multiple OBM events that share the same timestamp Description Current implementation on Operation Bridge Manager (OBM) pull connector - https://www.servicenow.com/docs/r/it-operations-management/event-management/configure-obm-connector.html - might result in missing events if they share the same timestamp. The connector retrieves events from OBM using the OBM REST API with a timestamp-based watermark. During each execution: 1. The connector queries OBM for all events newer than the stored watermark timestamp. 2. After processing the result set, the connector persists the timestamp of the last processed event as the new watermark.

Steps to Reproduce

Configure OBM pull connector according to https://www.servicenow.com/docs/r/it-operations-management/event-management/configure-obm-connector.html Generate events with the same timestamp in OBM Observe that some of those events are not pulled in to ServiceNow Workaround Applied attached update set = ecc_agent_script_include_d7328dca1b4830500045ed72604bcb98.xml

Explanation for the changes on the update set: Instead of trusting the timestamp of the last event returned, the connector now uses a bounded query window on every poll:

Lower bound: the previous run's saved watermark. Upper bound: now − 2 seconds, rounded down to a whole second (a 2-second safety buffer that protects against events still being committed in the current second). Each query asks OBM for events whose time_changed is ≤ this upper bound. Once the run completes, the upper bound itself is saved as the new watermark — not the timestamp of any individual event.

Why this guarantees no event loss By the time we save a second S as the watermark, that second is at least 2 seconds in the past, so OBM can no longer be writing new events into it. Every event with time_changed = S has already been returned in this run. The next run safely queries for events strictly greater than S, with zero risk of missing same-second siblings.