SolarWinds Alert Connector Not Collecting Alerts<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Summary SolarWinds Alert Connector is configured and active in Production, test connection succeeds, but alerts are not appearing in ServiceNow Event Management. The root cause is that the Event Connector is missing in the Production environment. Symptoms • SolarWinds Alert Connector is Active in Production • Test connection succeeds with positive alert level • Alerts appear in Test environment but not in Production • No errors or warnings in MID Server syslog • Alert data is being collected (verified in MID logs) • MID logs show "Found 0 records" or empty result sets Root Cause The Event Connector is missing in the Production environment. Alerts flow through the following pipeline: Step 1 Alert Connector Collects raw alerts from SolarWinds TP_CON Step 2 Event Connector Transforms alerts into ServiceNow events TP_EVT Step 3 Event Management Displays transformed events CMDB In Production, Step 2 (Event Connector) is missing. This causes: • Alert Connector successfully collects alerts • Alerts never reach transformation stage • No events appear in Event Management • No errors logged (connector cannot see missing downstream component) Affected Versions • SolarWinds Alert Integration v1.1.1 and later • Event Management module (all versions) • ServiceNow releases: Washington, Vancouver, Utah, and later How to Diagnose Check Test vs Production Connectors 1. In TEST instance, navigate to: Event Management → Integrations → Event Connectors 2. Verify SolarWinds Event Connector exists and is Active 3. In PROD instance, navigate to the same location 4. Compare: If Event Connector is missing in PROD, that's your issue Check MID Server Logs Review MID Server logs for the connector probe. If you see these messages in sequence: • *** Script: SolarWinds Connector: execute connection... • Found 0 records • Payload: {"results": []} • Status: SUCCESS This indicates the Alert Connector is working but data is not flowing downstream. Without the Event Connector, this data cannot be transformed. Solution Step 1: Export the Event Connector from TEST 1. In TEST instance, navigate to: Event Management → Integrations → Event Connectors 2. Click on the SolarWinds Event Connector 3. Note the following configuration details: • Connector Name • Status (should be Active) • Event Source • Transform Map • Any field mappings or custom configurations Step 2: Create the Event Connector in PRODUCTION 1. In PROD instance, navigate to: Event Management → Integrations → Event Connectors 2. Click "New" or "Create a new record" 3. Enter the configuration details from TEST: • Connector Name: (match TEST exactly) • Event Source: (match TEST exactly) • Transform Map: (match TEST exactly) • All other fields: (copy from TEST configuration) Step 3: Activate the Event Connector 1. Verify the Status field is set to "Active" 2. Click "Save" 3. The connector should immediately become active Step 4: Verify Alerts Are Flowing 1. Wait 2-5 minutes for the next connector poll cycle 2. Navigate to: Event Management → Events 3. Filter by Source = "SolarWinds" or search for recent alerts 4. Alerts should now appear with recent timestamps Prevention • When deploying connectors, always verify BOTH Alert Connector AND Event Connector are configured in all environments • Use a deployment checklist that includes both connector types • Document the complete data flow in your environment • Test the full pipeline (Alert Connector → Event Connector → Events) before going to Production • Compare TEST and PROD connector configurations during setup Additional Information Alert Connector vs Event Connector Alert Connector (TP_CON): • Pulls raw data from external source (SolarWinds, Splunk, etc.) • Sends data to internal ServiceNow processing • Does not format data; raw collection only Event Connector (TP_EVT): • Receives data from Alert Connector • Applies Transform Maps to normalize field names • Creates ServiceNow Event records • Enables events to appear in Event Management module Related Knowledge • KB3139571 - SolarWinds Event Troubleshooting (tags: solarwinds, events, integration-setup) • KB2873109 - Configure event collection from SolarWinds monitor • KB0535180 - MID Server Troubleshooting • Event Management Overview • [Now Community] SolarWinds Integration Guide • [Now Community] Transform Maps: Best Practices