Intelligent Ticketing classifies incidents as Event, Causal, or Impact Incidents based on the kind of information they contain.
An Event Incident is created by an event-management product when a significant event occurs and requires further investigation by service desk operators. Event Incidents only contain information about the event. They do not contain CI-related data.
For example, TrueSight Operations Management gets an alert generated by an error message captured in a log file. In this case the specific CI affected by this error is unknown. However, it is still important to generate an incident to bring awareness to the problem by creating a ticket in the Incident Management system. In this scenario, an incident can be generated which contains all the details about the event, which still proves to be valuable in the resolution of the problem.
An Infrastructure incident is created by an event-management product, which includes a reference to a CI. This CI is the likely cause of the event. Infrastructure incidents contain event and CI information consolidated into a single incident. An Infrastructure incident does not take into account the relationships with any other impacted CIs.
A Causal Incident is created by an event-management product, which includes a reference to a CI. This CI is the likely cause of the event. Causal Incidents contain event and CI information consolidated into a single incident. A Causal incident takes into account the relationships with other impacted CIs as per the impact model. Information about the impacted CIs of interest is listed in the Relationships table of the Causal incident.
The benefit of event and CI information consolidation is that it mitigates the proliferation of incident tickets for any subsequent related events. It is important to note that a Causal CI can also affect one or more business services resulting in one or more Impact Incidents. For example, if the monitoring system detects that a server has exceeded a certain threshold, a Causal Incident containing the Causal CI and the corresponding event information is created. As a result, related Impact Incidents may also be created.
An Impact Incident is intended to document any CI of interest that may have been impacted by an event recorded against a lower level related CI. These incidents are used for notification, tracking, and reporting purposes. As an example, if the email business service is identified as the CI of interest, if any infrastructure CI such as an email server that supports the email service is impacted then both a Causal Incident for the email server and an Impact Incident for the email service can be generated.
Impact Incidents are not actively worked on by service desk technicians to address the root cause. Service desk technicians traditionally work on the Causal Incident to resolve the issue. When the Causal Incident is resolved, the related Impact Incidents are automatically resolved.
It is important to restate that the primary distinction between an Impact Incidents and Causal/Event Incidents is that Impact incidents are intended to document CI's of interest that have been affected by other CIs. Therefore, when the CI of interest is a Business Service, the corresponding Impact Incidents are not actively worked on. The causal incident is worked upon to resolve the root cause of the issue. However, when the CI of interest is an Application, there are cases where the Impact Incident is "worked" and the life cycle is then governed by the assigned person working on the issue at that level.
Relationships capture relationships between CIs and relationships between incidents. If an event occurs against a Causal CI that impacts one or more higher level CIs of interest in addition to creating both the Causal Incident and the corresponding Impact Incidents, relationship between the CIs and incidents are also recorded. Incident relationships help us understand the cause and effect of captured events. Looking at incident relationships helps us to investigate the root cause of the incidents.
For an incident, the following relationships are possible:
- Causal Incident related to a Causal CI
- Impact Incident related to a Service CI
- Causal Incident impacts Service CI
- Service CI impacted by Causal Incident
- Causal CI caused Impact Incident
- Impact Incident caused by Causal CI
- Causal Incident caused Impact Incident