The purpose of the Event Management process is to identify and prioritize infrastructure, service, business process and security events, and to establish the appropriate response to those events, especially responding to conditions that could lead to potential faults or incidents.

Read the Event Management Key Concepts.

Important links

• Event Management Tool Mentors
• Tivoli® Open Process Automation Library Extensions for Event Management

Outcomes

  As a result of the successful implementation of the Event Management process:

• Service quality is sustained and improved
• Incidents are detected early
• The time between event occurrence and detection is minimized
• Appropriate actions are taken in response to events, in order to resolve some without manual response
• Responses to understood faults are started with minimal delay
  

Scope

Event Management is accomplished through scanning monitoring data and from this collecting, evaluating, responding to, and reporting events throughout the business.

Not all events require a response, only those deemed significant events. Typically, a response to a significant event involves either a predefined response or the creation of an incident in the Incident Management process.

Includes

• Providing both real time and historical event information to other IT processes, to facilitate service quality improvement and resource availability
• Providing similar information relating to the automated aspects of business processes for business analysis
• Correlation and filtering of events, to identify alert notifications and other conditions
• Examination and analysis of individual events in isolation as well as events in context with other events
• Creation of incidents from event information
• Capture, logging and administration of data generated by the activities within this process

Excludes

• System monitoring – Monitoring all things that happen related to a system, whereas event management identifies meaningful changes of state that may represent faults. System monitoring takes place in Service Execution and Data Management. ¹

Key performance indicators

• Customer satisfaction with service levels delivered
• SLA and OLA attainment
• Number of events processed
  • Percent of events that are significant events
  • • Percent of significant events that do not result in a service fault
  • Number of events by type or category
  • Percent of events that involved intervention
  • Percent of duplicated events
  • Percent of events related to availability of capacity
  • Number of events vs. number of incidents
• Percent of Incidents reported
  • By Event Management
  • By users using the Service Desk
  • By other means
• Percent of Operational Schedule activities
  • Completed as planned and scheduled
  • Rescheduled or delayed
• The elapsed time and direct costs
  • In this process domain
  • In each process step and between steps

Relation to other processes

• Event Management might open incidents (Incident Management) in the Incident Database. Any fault in the infrastructure should be represented by an incident. Incidents can be automatically handled by Event Management or manually by a Service Desk Operator or n-level support.
• Some events may be defined with input from Availability Management and Capacity Management.  
• Service Execution sets up a service, prepares it for monitoring, and runs it. During the operation of the service, operational monitoring data is used by Event Management to identify events related to the service.
• Event Management may be able to update the status of CIs in Configuration Management.  

Further reading

For more information, see Event Management in the ITIL® documentation.

In addition, see the IBM® Service Management web page.

¹ ITIL Service Operation, 36