Until ITIL V3 came to fruition, there was a common misconception that any reported event was an incident, and required a ticket be opened. That could be a CPU threshold exceedance, a process restarting, or a change in network topology. Service Desk vendors drooled like Tasmanian Devils, and some went as far as redefining terms such as Business Service Management.

On the opposite end of the spectrum, many organizations still send email notifications or pager alerts whenever any exception occurs in the monitoring infrastructure. IT administrators receive numerous notifications to the point that many emails are ignored or deleted – since the notifications were too common to be taken seriously. Some infrastructure monitoring tools incorporate a certain level of correlation, but they only correlate the data captured by the tool itself; and often, the correlation capabilities are too narrow or limited. Naturally, these tools cannot correlate information reported by other toolsets. So, the IT administrators are now bombarded with emails from multiple tools, not just one.

With an event management platform in place, correlation first occurs prior to taking any secondary action. Correlation can occur whether the events originated from the same source, or multiple sources. Tickets are then opened on real incidents and problems.  Email notification volumes are dramatically reduced. When an administrator receives an email, he/she can rest assured it’s regarding a real problem. It ensures that those 3 AM calls are actually worth getting up for.

Aside from correlation, an event management platform also acts as a central location to consolidate events across the infrastructure. It is ideal for data center operators since they can see the status of any component in real-time in a single pane of glass. That can include power supplies, HVAC units, servers, virtual machines, the network, the cloud, and virtually any other component. Operators can launch “in context” to other tools once incidents have been correlated to problems. This facilitates troubleshooting, and ensures operators drilldown to the right tool, rather than wasting their time swiveling between multiple tools, and manually trying to correlate problems.

Last but not least, a good event management system also makes business sense out of IT events. In a previous life, I recall instructing operators to ignore a set of messages from 1 – 2 AM due to system maintenance. And that was just for my systems! What about every other application, system, and network device out there? Alert enrichment to the rescue! By looking up the maintenance schedule from a change control system, alerts can be suppressed during maintenance periods, or automatically escalated otherwise. What if escalation contacts are automatically populated into alerts, but the contact information resides in an external inventory management system? Alert enrichment can automate the lookup, and automatically send notifications to the contact. How about populating carrier Circuit ID for ‘link down’ events? Or customers impacted by an outage? Perhaps looking up procedures from a knowledgebase, and automatically executing the verification steps? Alert enrichment allows for such intelligence, which facilitates correlation, automation, and visualization.

RiverMuse, the next generation real-time IT Operations platform enables operational efficiency through event consolidation, alert reduction, and business context enrichment. Rather than swiveling chairs from one tool to another, and looking up procedural information in spreadsheets and other systems, all pertinent information is automatically mapped to alerts. In the past such systems were only afforded by large corporations with large budgets. RiverMuse completely breaks through that barrier by delivering sophisticated event management technology at the right price and ease-of-use that can appeal to mid-market companies too.  Join our RiverMuse Pro Community to discuss your thoughts on IT event management.