CA Service Management

I have a Service Desk Request that magically re-opened on its own. It was closed and then re-opened on its own with no trace of how in the Activity log. 

I'm baffled as to how and why and would like to get to the bottom of it but at a loss as to where to even start in diagnosing this one. 

Many Thanks!

Do you have the Audit Log Enabled ? Look in the Audit Log to see when/who/what modified on the ticket.

We do have auditing on but the audit tables are showing nothing. The ALG shows the close event but the ticket still remains Open. Very Very Strange. 

Same here,

Sometimes request just reopen themselves for no reasons. (Maybe 4 out of 10000 requests).

So i gave up, not loosing time for 0.04%...

If it was changed by someone who had access to the physical database or someone who had access to the SDM server (and could use the pdm_load command) then it would not appear in the Activity Log since both accesses are below the object layer.

Or it could be magic. Look around for co-workers waving wands or wearing pointed hats with stars on them.

There were no PDM_Load actions happening anywhere near the false closure event. Physical db access is heavily guarded. Saving direct access to the physical db, and pdm_load what you are saying is there is no way this could happen other than divine intervention, rogue wizard? Unless... there's a bug in there?

I'm not seeing any wands or pointy hats but I'll keep my eyes peeled. 

Have you checked stdlogs? In our case same thing caused due to Attached Event/Animator_nxd failures.

Lindsay_Estabrooks, this is the kind of answer that makes people avoid forums...

Just being playful with Mr. Barger. He used the word magically first. ;-)

In that case, consider my comment removed.

Lol... it's all good. I appreciate all the help here. Without the logs to back up any kind of sleuthing I guess the best I can do is Chalk it up to Pier's .04% then... That is unless we find Harry Potter hanging around the servers.  

Joel,

I'd consider a few more things around this - 

1) when was the request really closed  vs   when was it reopened (days / months / minutes  difference?)

2) what status was the ticket in 

3) what are the status transitions permitted from that status to  the current status the ticket is in ?

4) Is this a primary/secondary env, or Advanced Availability ?

5) do you still have SDM logs when the request was originally closed and logs around the time when you think it got reopened?

_R

1) when was the request really closed  vs   when was it reopened (days / months / minutes  difference?)

That's impossible to tell because the Activity log shows no evidence of a re-open.

2) what status was the ticket in 
It transitioned from OP -> CL... then directly back to OP if you read the logs. This is impossible due to restrictions placed on the status transitions. It should have gone to re-opened. 

3) what are the status transitions permitted from that status to  the current status the ticket is in ?

4) Is this a primary/secondary env, or Advanced Availability ?

-Primary Production

5) do you still have SDM logs when the request was originally closed and logs around the time when you think it got reopened?

-unfortunately not the anomaly has fallen off the logging time window.