ITIL : Alert Management -II

Dear Readers,

As promised yesterday, today we are going to understand the responses to Alert Notifications. But before we start that, let us have a look at Event Management Flow.

In the actual implementations, the alert response depends upon the type of design, process implementation and the requirements at the ground. A good number of standard responses is available and any combination of these responses can be used while responding.

For Example, suppose an event of login of authorized users occurs at the server. Now as per configuration, this event may be logged or may be left without any action. In some setups there may not be any action required and in case of some highly sensitive and security focused setups, these events may needs to be recorded for future analysis.

Some of the important Event response options are-

Event Logging

An event occurred can be recorded for analysis and future reference purposes. But, this decision again depends on few factors like availability of space, retention period, Event types etc. A normal successful login event may be excluded from recording if numbers of such events are very high, are considered less significant and management agrees to do so.

Auto Response

Some of the well analyzed and understood events may be configured for auto response. One such response may be restart of a service by a specific set of IDs. A restart includes a series of event like service stop and then start of service. Hence Auto response may be configured to no action for normal proceeding of entire activity and log an incident in case restart doesn't complete. Another example may be auto locking of accounts after an specified number of unsuccessful attempts.

Escalation

An alert is generated if human intervention is required. Such escalations are mostly configured to reach at help desk which in turns assign this alert of appropriate function.

Ticket Logging

Those events which represent a failure, disruption to service or a need for change, appropriate ticket like Incident, Problem or Change may be logged.

We’ll discuss about selection of correct ticket type will be discussed in the posts on Incident, Problem and Change Management processes.

ITIL V3 : Event Management

Dear Readers,

From today, we are starting the study of Service Operation Processes. There are 5 processes covered under Service Operations.

Event Management:
monitor all events and take proactive action to ensure normal operation.

Incident Management:
Reactive action to resolve any disruption to services.

Request Fulfillment: 
A small change to operations which has no impact on existing operations. 

Problem Management:
Finding RCA. Resolving the causes of event. Update known error database. This may be proactive or reactive.

Access Management:
Ensuring that only authorized users can access the services.

EVENT MANAGEMENT

We can define an event as an occurrence that has potential to impact or cause deviation to the services.

Event management is a proactive approach to insure least deviation or disruption to services as agreed in SLA.

                         

Active monitoring of all the key configuration items, services and components through an automatic tool is the building block to effective event management and hence valuable service operation.

Whatever we do in service life cycle is ultimately aimed to generating value to business. Event management is also no exception but the value generated by event management is mostly indirect because it focuses on early detection of incidents.

                        

Event management in integration with other processes like capacity management can help in early responses that help in avoiding major deviations resulting in to an effective and efficient service management. An effective event management can also help to reduce the cost involved in highly trained technical resources by reducing the number and replacing them with less skilled resources.

                    

Below mentioned are the major steps of event management-

Event occurrence: 
It occurs continuously with every action withing your server, application, router, Firewall, database and all other components of your infrastructure.

Event notification: 
Notifications are generated against the event (mostly using open standard like SNMP)

Event detection: 
Notification is detected by a management tool to understand the meaning of event.

Event filtering: 
It may or may not be possible. This actually tries to categorize the notification.

Event significance: 
The event may be informational(no exception)or warning (approaching threshold) are an actual exception.

Event correlation : 
This is done by a correlation engine that analyses all the events and provide a meaningful information.

Trigger: 
The result of correlation may initiate  a response known as trigger which may in form of incident, change etc.

Response selection : 
Response may be selected according to the trigger. We will discuss it in more detail in my next post.

Review action: 
Actions are reviewed for trend analysis an to generate other meaningful information.

Close event : 
This is the formal closer of event.

Keep reading for more on Service Operation Management.

Happy Reading!!!! Cheers!!