Consolidating incidents

To avoid creating redundant incidents in your system, use the Consolidate Incidents option on the Incident Rules form.

The following topics are provided:

If event propagation and incident policies (Impacted and Causal Component-Optimized policy or Causal Only Optimized policy) are enabled in BMC TrueSight Infrastructure Management, two incidents are created for the Causal configuration item (CI): one for the causal event and another for the event status change. Because the actual causal event is the only one that has resulted in the status change of the Causal CI, ideally only one incident should be created. The Consolidate Incidents option is used to consolidate two events (status change and actual causal event) in a single incident, reducing the number of redundant incidents in your system.

To consolidate incidents

  1. From the Application list on the left side of the page, select Administrator Console >Application Administration Console > Custom Configuration > Incident Management > Advanced options > Rules.
  2. On the Incident Rules form, for the Consolidate Incidents option, select Yes.

Differences between consolidating events and consolidating incidents

Consolidate Events option

Consolidate Incidents option

Used for consolidating infrastructure events.

Used for consolidating incidents.

Applicable to Level 2 of service resolution.

Applicable to Level 3 of service resolution.

If the Consolidate events option is not selected, each event -

Each eventx` for a given CI results in an Infrastructure Incident

If the Consolidate events option is selected -

Each event for a given CI is consolidated into a single Infrastructure incident.


If the Consolidate incidents option is not selected -

When a Level 3 policy and Event Propagation policy enabled, an event for a given CI results in a related Infrastructure incident and a Causal incident.

If the Consolidate incidents option is selected -

When a Level 3 policy and Event Propagation policy enabled, an event for a given CI results in the Infrastructure incident being consolidated into a Causal incident.


Work log of the incident is updated with the event information.

Work log of the incident is updated with BEM incident information.

Avoids proliferation of incidents.

Avoids redundant incidents.

Best practice

Consider a scenario in which two events exist for the same CI. For example, Server A stops responding and an event is created for this issue. On the same server, the disk capacity reaches the threshold and another event is created for the disk capacity issue. On the same CI (Server A) there are two events. For both events, two separate incidents are created. Relevant support groups then work on these incidents and resolve them. To create and route an incident for every event is an organization-specific choice.

  • If you are managing a CI as a whole, use the Consolidate Events option.
  • If you want to avoid redundancy in the number of incidents, use the Consolidate Incidents option. This option is more for ensuring your system's efficiency.

If you select both the Consolidate Events and Consolidate Incidents options:

  • If the Impacted and Causal Component-Optimized or Causal Only Optimized policy is enabled (SIM policy is enabled), consolidation of incidents takes priority over the Consolidate Events flag.
  • If the Impacted and Causal Component-Optimized policy is not enabled, consolidation of events takes priority over consolidation of incidents.

Related topics

Consolidating events

BMC Service Resolution levels

BMC Service Resolution policies

Was this page helpful? Yes No Submitting... Thank you

Comments

  1. Christian Smerz

    Do these features work exclusively with BMC Truesight or can they work with other event generation tools?

    Apr 27, 2016 02:05
  2. Jeff Desroches

    Hi Christian,  It is possible to configure other event generation tools for Level 1 and 2 type incidents.  Here is the link to the docs:

    https://docs.bmc.com/docs/display/public/BSR35/Integration+support+for+third-party+products

     

    Apr 28, 2016 06:54