Consolidating incidents

To avoid creating redundant incidents in your system, use the Consolidate Incidents option on the Incident Rules form.

The following topics are provided:

If event propagation and incident policies (Impacted and Causal Component-Optimized policy or Causal Only Optimized policy) are enabled in BMC TrueSight Infrastructure Management, two incidents are created for the Causal configuration item (CI): one for the causal event and another for the event status change. Because the actual causal event is the only one that has resulted in the status change of the Causal CI, ideally only one incident should be created. The Consolidate Incidents option is used to consolidate two events (status change and actual causal event) in a single incident, reducing the number of redundant incidents in your system.

To enable Causal Only Optimized policy, you must enable Incident Consolidation for both the Global and Calbro Companies (out-of-box Companies).

To consolidate incidents

Log on to the Remedy IT Service Management (Remedy ITSM) home page.
From the Application list on the left side of the page, select Administrator Console >Application Administration Console > Custom Configuration > Incident Management > Advanced options > Rules.
On the Incident Rules form, for the Consolidate Incidents option, select Yes.

Differences between consolidating events and consolidating incidents

Consolidate Events option	Consolidate Incidents option
Used for consolidating infrastructure events.	Used for consolidating incidents.
Applicable to Level 2 of service resolution.	Applicable to Level 3 of service resolution.
If the Consolidate events option is not selected, each event - Each eventx` for a given CI results in an Infrastructure Incident If the Consolidate events option is selected - Each event for a given CI is consolidated into a single Infrastructure incident.	If the Consolidate incidents option is not selected - When a Level 3 policy and Event Propagation policy enabled, an event for a given CI results in a related Infrastructure incident and a Causal incident. If the Consolidate incidents option is selected - When a Level 3 policy and Event Propagation policy enabled, an event for a given CI results in the Infrastructure incident being consolidated into a Causal incident.
Work log of the incident is updated with the event information.	Work log of the incident is updated with BEM incident information.
Avoids proliferation of incidents.	Avoids redundant incidents.

Best practice

Consider a scenario in which two events exist for the same CI. For example, Server A stops responding and an event is created for this issue. On the same server, the disk capacity reaches the threshold and another event is created for the disk capacity issue. On the same CI (Server A) there are two events. For both events, two separate incidents are created. Relevant support groups then work on these incidents and resolve them. To create and route an incident for every event is an organization-specific choice.

If you are managing a CI as a whole, use the Consolidate Events option.
If you want to avoid redundancy in the number of incidents, use the Consolidate Incidents option. This option is more for ensuring your system's efficiency.

If you select both the Consolidate Events and Consolidate Incidents options:

If the Impacted and Causal Component-Optimized or Causal Only Optimized policy is enabled (SIM policy is enabled), consolidation of incidents takes priority over the Consolidate Events flag.
If the Impacted and Causal Component-Optimized policy is not enabled, consolidation of events takes priority over consolidation of incidents.

Consolidating incidents

To consolidate incidents

Differences between consolidating events and consolidating incidents

Best practice

Related topics

Comments