Trigger

Event correlation

If an event is significant, a decision has to be made about exactly what the significance is and what actions need to be taken to deal with it. It is here that the meaning of the event is determined.

Correlation is normally done by a ‘Correlation Engine’, usually part of a management tool that compares the event with a set of criteria and rules in a prescribed order. These criteria are often called Business Rules, although they are generally fairly technical. The idea is that the event may represent some impact on the business and the rules can be used to determine the level and type of business impact.

A Correlation Engine is programmed according to the performance standards created during Service Design and any additional guidance specific to the operating environment.

Examples of what Correlation Engines will take into account include:

• Number of similar events (e.g. this is the third time that the same user has logged in with the incorrect password, a business application reports that there has been an unusual pattern of usage of a mobile telephone that could indicate that the device has been lost or stolen)
• Number of CIs generating similar events
• Whether a specific action is associated with the code or data in the event
• Whether the event represents an exception
• A comparison of utilization information in the event with a maximum or minimum standard (e.g. has the device exceeded a threshold?)
• Whether additional data is required to investigate the event further, and possibly even a collection of that data by polling another system or database
• Categorization of the event
• Assigning a priority level to the event.

If the correlation activity recognizes an event, a response will be required. The mechanism used to initiate that response is called a trigger.

There are many different types of triggers, each designed specifically for the task it has to initiate. Some examples include:

• Incident Triggers that generate a record in the Incident Management system, thus initiating the Incident Management process
• Change Triggers that generate a Request for Change (RFC), thus initiating the Change Management process
• A trigger resulting from a approved RFC that has been implemented but caused the event, or from an unauthorized change that has been detected – in either case this will be referred to Change Management for investigation
• Scripts that execute specific actions, such as submitting batch jobs or rebooting a device
• Paging systems that will notify a person or team of the event by mobile phone
• Database triggers that restrict access of a user to specific records or fields, or that create or delete entries in the database.

Дата добавления: 2014-12-23