Notifying Analysts when Action Log was updated

There are several possibilities to update the action log of an incident. Service Manager can update the action log automatically, an analyst can update the action log with a manual antry from the console and endusers can update the action log by using the portal or by email (when using the exchange connector). If an analyst is waiting for user input, it can be painful to constantly check if the incidents were updated. It much more confortable to just wait for an email that tells you that the action log was updated. This can be done by using relationship subscriptions.

This blog post is based on a post Travis made some time ago. You can find his blog post here. I used his MP as and made only minor modifications.

We need a workflow that checks if the action log of incidents was updated – and this on a defined schedule. Because the action log comments of incidents are stored in objects of another class, the relationship property is used. this is why this kind of notification subscriptions are called relationship subscriptions. I will not go into any detail here because Travis explained this in very detail here.

So if you download the MP from this blog post (at the very end of the post), you will see a new entry in the workflow status list. This is where you can check if everything is running as expected. If this is not the case, consult the Operations Manager Event Log for more details.


The template that is used for sending the mail is located in the same MP. You can see and also edit it by using the Notification Templates section.


The template is preconfigured and shows the most important information of the incident. For this example I send the mail using html. Take a look at the <Group> section as it is used to iterate through all the available comments and display them in the email.


Now if the action log is updated, the analyst that the incident was assigned to gets an email.


With this procedure analysts can save a lot of time because they don’t need to constantly control pending incidents for user input.

You can download the MP here (itnetx.ActionLogUpdate.NotifyAnalyst.xml)


This entry was posted in SCSM and tagged , , . Bookmark the permalink.

64 Responses to Notifying Analysts when Action Log was updated

  1. Jay Scovill says:

    Hi Marcel,
    Great blog.
    I have the Exchange Connector and SendEmail MP configured and working.

    I’ve imported your MP but when I reply to an email generated through the SendEmail extension the workflow doesn’t appear to trigger (there is no status) and the analyst doesn’t get an email.

    Am I correct in my understanding that this workflow should function any time the action log is updated by the Affected User, whether that be through the portal or via email?

    Any pointers for me?

    Also, would this workflow also then be able to replace the one by Travis that updates the Analyst when a user replies to an email generated from SendEmail? It seems like it should work for both that instance as well as if the user replies to any incident email (IOW it doesn’t rely on the Pending/Active status changes).


    • Hey

      I found out that it depends on how the Action log gets updated. For instance when you update the action log from the console SM does not use the same relation as when you update an incident by using the portal. the portal update is written as “enduser comment” where as updates by mail are written to the “analyst comment”. So depending on how exactly you want to notify analysts, you have to make small modifications to my MP. Inside the MP you can see the relation that is used –> “TroubleTicketHasAnalystComment”. This can be change if needed to to “TroubleTicketHasEnduserComment”. So frist try to find out how the process for Action Log update is exactly handeled and then use the MP without or with modification.


  2. Jay Scovill says:

    One other thing. Your MP seems to do the opposite of Tim’s. Yours notifies the analyst on log change and his notifies the affected user. Do I read that right?

    • Correct, my MPs was made to inform the analyst (assigned to User) when the log was updated by the user. Travis’s MP notifies the enduser (affected User) ehwn an Analyst has updated the action log.

  3. Victor Gacitua C. says:

    Hi Marcel, thanks for you blog. Im trying to use your MP with some customization to notify to IR createdbyuser when an analyst comment is registred at action log but i cant get it work. WF fail. Can you provide some email to send my MP and error to you??

    Again, thanks in advance.

    Victor Gacitua C.

    • Hey Victor

      Sorry for the delayed response – i was on holidays 🙂

      Send your MP to zehner at itnetx dot ch. I will take a look at it.


  4. Victor Gacitúa C. says:

    Hi Marcel, what about my last question? Why is not published here? Can you give me a little help?

    Thanks in advance,

    Victor Gacitúa C.

  5. Andrés Cisternas says:

    i like see the worflow in the SM Authoring Tool, you can upload the other files like: xolm, xolmx and cs?


  6. Dan Bradley says:

    Hi Marcel

    Thanks for the great blog and pointers. I’ve installed the MP into Service Manager, but it doesn’t work as expected. In my case it notifies the Analyst when the Analyst adds an entry to the comment log, instead of when the user adds an entry. So it seems to be the correct trigger is missing. I’m using Exchange Connector to pick up replies from Users via email (not using the SendEmail feature)

    • Hey Dan

      Sorry for the delayed response – i was on holidays 🙂

      This is correct. Enduser Comments use another relationship called “System.WorkItem.TroubleTicketHasUserComment”. So if you want to notify on this kind of change, you must use this relationship. When using the Exchange Connector, it unfortunately does not update the User Comments (because also an Analyst could update an Incident by using Mail). If you want to catch all kind of updates it should be possible by using the relationship “System.WorkItemHasCommentLog”. I never tried that myself, but it should work.


      • Marcus Lehmann says:


        Nice work on this. I believe this is exactly what I am looking for but I want the WF to send and email to the ‘Assigned To’ user when an end user adds an update through the SSP. You are talking about this in your response to Dan. So I changed the the line


        which has the effect that the WF does not work anymore. : ) I tried to do a couple of other things as well but then the MP throws errors when I try to import it into SCSM.

        Can you please give me some more details in how I need to change the MP so a notification is being added when a end user update is being added to the incident?

        Thank you

  7. Joe O'Brien says:

    Hi Marcel
    Great piece of code and working well here! Is it possible to edit the code so that it only emails if the action log is not updated by the “assigned to” user. Our analysts dont want to get emails of their own updates.
    Also is it possible to notify if attachments are added or if a call is assigned to new analyst.


    • Hey Joe

      Sorry for the delayed response – i was on holidays 🙂

      I dont think this is possible because multiple relationship subscriptions cannot be combined. You would have to do it with some workaround. I never had this requirement before and therefore did not test this. To notify if an attachment was added it should be possible to use a relationship subscription that works the same way. Again, I never used this before, but you could try using the relationship “System.WorkItemHasFileAttachment”. This should work fine.


      • Pete barbuto says:

        Hey Marcel,

        I have the same request as Joe. Have you given this anymore thought?

        I was thinking that it may be possible to add the a EnteredBy criteria to the code. I assume it would look like:




        I tried entering it myself but didn’t have any luck when trying to import the MP. Is this feasible and if so am I on the right track?


  8. Nico says:

    Hi Marcel,

    I downloaded your MP and imported it. but nothing happens when user replied to the incident?
    When I check Workflow settings, it’s visible on the status page but not in configuration? what am i doing wrong? nothing shows on event logs as well regarding the issue…


    • Hey

      How exactly does the user update the incident? by using the portal or by email? The workflow is not visible in the configuration, only the status. This is correct.


  9. Luke says:

    Thank you for posting this, I’m very excited to make use of it. Unfortunately I am having some difficulty getting it to work. The management pack imports successfully but a notification is never triggered after the user updates the action log via email.

    Shortly after I import the management pack I get this error in the Operations manager event log:

    The database subscription is unable to find instances that match its criteria because of database errors.
    The following errors were encountered:
    Exception message: Error occured in the subscription runtime. Cannot send notifications.
    Subscription id: ac62331f-ab73-ccc1-2c3b-29a6fdfbcd18
    Exception: Polling query for subscription is not generated. Data access layer has not invoked the query generation callback.

    One or more subscriptions were affected by this.

    Subscription name: ManagementPack.SubscriptionRule
    Instance name: Workflow Target (internal)
    Instance ID: {383E578B-E1C9-2802-0047-815853405778}
    Management group: SMAdmins

    Any idea what could be going wrong?

    • Hey Luke

      Strange. Any other error messages from the status logs? Or is this empty?


      • Luke says:

        The status logs for the workflow are empty. The error I posted above only appears twice in my operations manager log, and only immediately following the import of the management pack (I deleted and reimported it once to see if that would help.)

        I plan on installing the new cumulative update tomorrow night and trying again after that is completed.

  10. Marcus Lehmann says:


    I am trying to get your MP working so an email is being send out if an end user updates the incident through the SSP. I used ‘System.WorkItem.TroubleTicketHasUserComment’ and replaced the two ‘System.WorkItem.TroubleTicketHasAnalystComment’ entries in the XML file but it does not work. Now now email is being triggered when an end user update nor a analyst update is being logged in the Action Log.
    Can you please help and let me know whatelse in the MP I need to do to get that to work for the end user updates?

    Thank you

  11. jimmypanagakos says:

    Is there a way to send the action log to the affected user as well?

  12. jimmypanagakos says:

    yeah, the same thing the analyst would get, to keep the affected user in the loop

  13. Mira Maher says:

    Hi Marcel,

    Thanks for this great blog.
    This MP is notifying the Assigned To Analyst but i need to notify the Primary Owner, I made some modifications on the MP (itnetx.ActionLogUpdate.NewUserComment.NotifyAnalyst) but it doesn’t work.
    can you please send me the correct MP to notify Primary Owner?

    Thanks in advance.

    Mira Maher

  14. Brian Tran says:


    We are using your MP and it works great. However, how do we add the user name and date that wrote the comment into the email?


    • Hey

      Thanks! I have never done this before, but try using the relationship class “System.WorkItemHasActionLog” to get to the Information you need.


  15. Tim says:

    I’ve used this and customized it but I’ve run into a customer that only want usercomment notifications for a certain support group. I’m not sure how to have a <RelationshipSubscription …. and a criteria based rule in the back XML. I tried to create a subscription in the console, export the MP and try get the criteria section added but … only errors. Any pointer would be helpful

  16. David Buchta says:

    Hello! This MP has saved my life, thank you!

    I’ve modified your MP to go the other way–notifying the affected user when the assigned analyst replies via e-mail–and it’s sending the notification, but the analyst comment section is completely blank.

    After much troubleshooting I’ve discovered that all of the analyst replies entered via e-mail are being marked as Private. The checkboxes are filled in with a square box, not a tick mark, implying to me that it’s being inherited/automatically set. If a reply is marked as Private, it will not show up in the e-mail. Any entries manually un-marked as Private will go through, but each new entry is still marked as Private.

    More troubleshooting later, and I find that the tag is breaking it. If I remove these tags the replies show up, but they are in completely random order, which is useless. I can, however, use the tags in your original MP and it works wonderfully.

    I have tried Travis’ MP, and it does the same exact thing. Group tags break it, private comments do not show up, show up randomly otherwise.

    Any help? Even if I could somehow set SCSM 2012 to never mark these replies as Private it would fix everything, but I cannot find any documentation on this.

    Thanks! I really appreciate your blog. It’s helped this SCSM newbie out invaluably.

  17. Pete Barbuto says:

    Im trying to modify this for a Service Request. It seems like I changed everything correctly, but it still notifies on Incidents even though it points to the ServiceRequest Configuration library and uses a Service Request template. Any advice on what I may be missing?

    • Hey

      Hmm, hard to say without knowing what you changed. Send me the MP, I will take a look at it.


      • Pete Barbuto says:

        Have you had a chance to look at my MP yet? I still haven’t had luck.

      • Stephen says:

        This would be great for service requests as well. Works for incidents with no problems. I wonder also if this functionality would work with an Orchestrator runbook …

  18. Pete Barbuto says:

    Thanks for replying Marcel. Heres a link to it:

    All I can think of is that its something in the monitoring section of the subscription, but no matter what I try I can seem to get it to work.


    • Dan Green says:

      Hello Marcel, hello Pete,
      i would also like to use the MP for Incidents and Service Requests. Did you found any solution thats works for both ways?

      • Hey Dan

        Sorry, never used it for SRs myself. However, it should definitely work.


      • Dan Green says:

        Thanks Marcel 🙂
        Great work. Did you see any solution, that Notifications only goes forward if a log comment added by an analyst and not by the primary owner?
        Greets Dan

  19. BJ Smith says:

    I have Subscriptions for specific incidents to keep people notified of changes to an Incident. I can get it to pull the Analyst Comments and User Comments, but it will not pull in the Action Log entries for Resolution, tasks, etc. Any ideas?

    • Hey

      Try playing around with the class “System.WorkItem.TroubleTicket.ActionLog” and the relationship “System.WorkItem.TroubleTicketHasActionLog”.


  20. Morten M says:


    Is it possible to :
    1) Not send the whole action log to Assigned To user, but only the lastest one updated
    2) Use the Private mark to stop the workflow completely. This seems to work a little, but if there is already a ‘none-private’ analyst comment, this will get emailed to Assigned To 😦

    Thanks for a great MP


    • Hey

      Cou cannot do this by using the regular processes. But you can do this (both your points) by using some Orchestrator Magic …


      • Morten M says:

        Hi Marcel,

        Thanks for the answer. I can live with the whole action log being sent. However, wouldn’t it be possible to make an AND expression inside, so it only sends out when action log is updated by analyst AND IsPrivate is false.

        Something like this:



        I’m really not sure how to build expression inside a relationshipsubscription, i’ve only done it with normal instance subscriptions.. can you guide me somehow? Thanks

  21. Morten M says:

    Hi Marcel,

    The MP works fine, however when updating the action log the whole action log seems to be sent, and not just the recent entry made. In our case we would like to be able to update action log without sending email by marking the Private symbol – however if other none-marked entries has been made in the past, this will get sent to the Assigned to user.


  22. Morten M says:

    This can be done now via console in scsm2012 using the trouble ticket has user comment -> assigned to user (Create subscribtion). Works for both SR and incidents. This way you can also make additional criteria saying: private field does not equal true (so it only triggers when private field is not marked).

  23. Carlos says:

    Hi Marcel.

    You helped me a lot customizing my Work Items forms, and linking them to templates over the Portal, our System Center Enviroment start to look awesome!

    I’ve got a question over notifications, we notificate the end user, some followers or reported users I made with your help and the assigned analyst.

    There is no trouble notificating them, except, lets say that there are a lot of entries, both user and analysts ones, the mail sent becomes just… to heavy to read.

    Would be there any way to modify the template so just the last one user/analyst comment is mailed?

    Thanks for your help, again.



    • Carlos says:

      Forgot about adding more related info.

      We haven’t set up Orchestator yet, and we would rather not want to, our actual enviroment doesn’t allow us to make the System Center Enviroment bigger until it gets reviewed and approved, so theres no slot for SCORCH yet.

  24. Ivan says:

    Hi Marcel,

    I already tried this MP and it works perfectly fine in my system, now i want to disable it. The only way i can disable it i think by delete the mail template but when i do that it gives me an error:

    Date: 3/12/2014 11:52:24 AM
    Application: System Center Service Manager
    Application Version: 7.5.3079.0
    Severity: Error
    Message: An error was encountered while running the task.

    : Verification failed with 1 errors:
    Error 1:
    Found error in 1|ActionLogAddRelationshipSubscription||ActionLogAddRelationshipSubscriptionRule/WA|| with message:
    The configuration specified for Module WA is not valid.
    : Cannot find specified MPElement ActionLogAddRelationshipAffectedUserNotificationTemplate in expression: $MPElement[Name=’ActionLogAddRelationshipAffectedUserNotificationTemplate’]$
    Cannot find ManagementPackElement [Type=ManagementPackElement, ID=ActionLogAddRelationshipAffectedUserNotificationTemplate] in management pack ManagementPack:[Name=ActionLogAddRelationshipSubscription, KeyToken=, Version=].

    : The configuration specified for Module WA is not valid.

    : Cannot find specified MPElement ActionLogAddRelationshipAffectedUserNotificationTemplate in expression: $MPElement[Name=’ActionLogAddRelationshipAffectedUserNotificationTemplate’]$
    Cannot find ManagementPackElement [Type=ManagementPackElement, ID=ActionLogAddRelationshipAffectedUserNotificationTemplate] in management pack ManagementPack:[Name=ActionLogAddRelationshipSubscription, KeyToken=, Version=].
    : Cannot find ManagementPackElement [Type=ManagementPackElement, ID=ActionLogAddRelationshipAffectedUserNotificationTemplate] in management pack ManagementPack:[Name=ActionLogAddRelationshipSubscription, KeyToken=, Version=].

    Is there any way i can disable or delete this tasks?



  25. Pingback: Maud Orndorff

  26. Nick Keller says:

    Hey Marcel!

    A few years later on this post…..but I was just wondering if you knew where/how you knew to use the tag. Where does it come from, and is there any documentation on it? Searching around I could not find any information on it.

    Also, would it be possible to just return the newest comment and not all of them?


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s