Incident Management

Identification of thresholds

Event Detection and Alert Mechanisms

Good Event Management design will also include the design and population of the tools used to filter, correlate and escalate Events.

The Correlation Engine specifically will need to be populated with the rules and criteria that will determine the significance and subsequent action for each type of event.

Thorough design of the event detection and alert mechanisms requires the following:

• Business knowledge in relationship to any business process es being managed via Event Management
• Detailed knowledge of the Service Level Requirement s of the service being supported by each CI
• Knowledge of who is going to be supporting the CI
• Knowledge of what constitutes normal and abnormal operation of the CI
• Knowledge of the significance of multiple similar events (on the same CI or various similar CIs
• An understanding of what they need to know to support the CI effectively
• Information that can help in the diagnosis of problem s with the CI
• Familiarity with incident prioritization and categorization codes so that if it is necessary to create an Incident Record, these codes can be provided
• Knowledge of other CIs that may be dependent on the affected CI, or those CIs on which it depends
• Availability of Known Error information from vendors or from previous experience.

Threshold s themselves are not set and managed through Event Management. However, unless these are properly designed and communicated during the instrumentation process, it will be difficult to determine which level of performance is appropriate for each CI.

Also, most thresholds are not constant. They typically consist of a number of related variables. For example, the maximum number of concurrent user s before response time slows will vary depending on what other jobs are active on the server. This knowledge is often only gained by experience, which means that Correlation Engines have to be continually tuned and updated through the process of Continual Service Improvement.

In ITIL terminology, an ‘ incident ’ is defined as:

An unplanned interruption to an IT service or reduction in the quality of an IT service. Failure of a configuration item that has not yet impacted service is also an incident, for example failure of one disk from a mirror set.

Incident Management is the process for dealing with all incidents; this can include failures, questions or queries reported by the user s (usually via a telephone call to the Service Desk), by technical staff, or automatically detected and reported by event monitoring tools.

4.2.1 Purpose/goal/objective

The primary goal of the Incident Management process is to restore normal service operation as quickly as possible and minimize the adverse impact on business operations, thus ensuring that the best possible levels of service quality and availability are maintained. ‘Normal service operation’ is defined here as service operation within SLA limits.

Дата добавления: 2014-12-23