Value to business

Scope

Event Management

An event can be defined as any detectable or discernible occurrence that has significance for the management of the IT Infrastructure or the delivery of IT service and evaluation of the impact a deviation might cause to the services. Events are typically notifications created by an IT service, Configuration Item (CI) or monitoring tool.

Effective Service Operation is dependent on knowing the status of the infrastructure and detecting any deviation from normal or expected operation. This is provided by good monitoring and control system s, which are based on two types of tools:

• active monitoring tools that poll key CIs to determine their status and availability. Any exceptions will generate an alert that needs to be communicated to the appropriate tool or team for action
• passive monitoring tools that detect and correlate operational alerts or communications generated by CIs.

4.1.1 Purpose/goal/objective

The ability to detect events, make sense of them and determine the appropriate control action is provided by Event Management. Event Management is therefore the basis for Operational Monitoring and Control (see Appendix B).

In addition, if these events are programmed to communicate operational information as well as warnings and exceptions, they can be used as a basis for automating many routine Operations Management activities, for example executing scripts on remote devices, or submitting jobs for processing, or even dynamically balancing the demand for a service across multiple devices to enhance performance.

Event Management therefore provides the entry point for the execution of many Service Operation processes and activities. In addition, it provides a way of comparing actual performance and behaviour against design standard s and SLAs. As such, Event Management also provides a basis for Service Assurance and Reporting; and Service Improvement. This is covered in detail in the Continual Service Improvement publication.

Event Management can be applied to any aspect of Service Management that needs to be controlled and which can be automated. These include:

• Configuration Item s:
• Some CIs will be included because they need to stay in a constant state (e.g. a switch on a network needs to stay on and Event Management tools confirm this by monitoring responses to ‘pings’).
• Some CIs will be included because their status needs to change frequently and Event Management can be used to automate this and update the CMS (e.g. the updating of a file server).
• Environmental conditions (e.g. fire and smoke detection)
• Software licence monitoring for usage to ensure optimum/legal licence utilization and allocation
• Security (e.g. intrusion detection)
• Normal activity (e.g. tracking the use of an application or the performance of a server).

The difference between monitoring and Event Management

These two areas are very closely related, but slightly different in nature. Event Management is focused on generating and detecting meaningful notifications about the status of the IT Infrastructure and services.

While it is true that monitoring is required to detect and track these notifications, monitoring is broader than Event Management. For example, monitoring tools will check the status of a device to ensure that it is operating within acceptable limits, even if that device is not generating event s.

Put more simply, Event Management works with occurrences that are specifically generated to be monitored. Monitoring tracks these occurrences, but it will also actively seek out conditions that do not generate events.

Event Management’s value to the business is generally indirect; however, it is possible to determine the basis for its value as follows:

• Event Management provides mechanisms for early detection of incident s. In many cases it is possible for the incident to be detected and assigned to the appropriate group for action before any actual service outage occurs.
• Event Management makes it possible for some types of automated activity to be monitored by exception – thus removing the need for expensive and resource intensive real-time monitoring, while reducing downtime.
• When integrated into other Service Management processes (such as, for example, Availability or Capacity Management), Event Management can signal status changes or exceptions that allow the appropriate person or team to perform early response, thus improving the performance of the process. This, in turn, will allow the business to benefit from more effective and more efficient Service Management overall.
• Event Management provides a basis for automated operation s, thus increasing efficiencies and allowing expensive human resources to be used for more innovative work, such as design ing new or improved functionality or defining new ways in which the business can exploit technology for increased competitive advantage.

4.1.4 Policies/principles/basic concepts

There are many different types of events, for example:

• Events that signify regular operation:
• notification that a scheduled workload has completed
• a user has logged in to use an application
• an e-mail has reached its intended recipient.
• Event s that signify an exception
• a user attempts to log on to an application with the incorrect password
• an unusual situation has occurred in a business process that may indicate an exception requiring further business investigation (e.g. a web page alert indicates that a payment authorization site is unavailable – impacting financial approval of business transaction s)
• a device’s CPU is above the acceptable utilization rate
• a PC scan reveals the installation of unauthorized software.
• Events that signify unusual, but not exceptional, operation. These are an indication that the situation may require closer monitoring. In some cases the condition will resolve itself, for example in the case of an unusual combination of workload s – as they are completed, normal operation is restore d. In other cases, operator intervention may be required if the situation is repeated or if it continues for too long. These rules or policies are defined in the Monitoring and Control Objectives for that device or service. Examples of this type of event are:
• A server ’s memory utilization reaches within 5% of its highest acceptable performance level
• The completion time of a transaction is 10% longer than normal.

Two things are significant about the above examples:

• Exactly what constitutes normal versus unusual operation, versus an exception? There is no definitive rule about this. For example, a manufacturer may provide that a benchmark of 75% memory utilization is optimal for application X. However, it is discovered that, under the specific conditions of our organization, response time s begin to degrade above 70% utilization. The next section will explore how these figures are determined.
• Each relies on the sending and receipt of a message of some type. These are generally referred to as Event notifications and they don’t just happen. The next paragraphs will explore exactly how events are defined, generated and captured.

Дата добавления: 2014-12-23