Chapter5.Event Management

Chapter 5. Event Management

Chapter 4, "Instrumentation," describes how service behaviors are monitored to track compliance with service level metrics and to identify potential or actual service disruptions. Event management, which is the topic of this chapter, describes the different steps that transform a flood of raw alerts into a reduced set of events that require further action from the management system.

The instrumentation system collects raw data, such as response times or packet loss. Unfortunately, administrators often find raw data of low value for making sound service management decisions. A response-time measurement; might have little meaning without further analysis; for example, is it an isolated incident or part of a growing number of slow transactions? Although the measurement is compared to thresholds and baselines to generate an alert, more context is needed to determine how important any measurement actually is. The event management functions refine raw instrumentation measurements into those that require further attention from the management system. Administrators spend their time on important problems and make better decisions with refined information.

This chapter is a complement to Chapter 4, and both should be considered part of the same process: helping you turn raw data into usable information and indicating the next steps when a response to a service disruption is detected and reported.

Note that one of the difficulties in organizing material for this chapter is that vendors offer a range of packaging options. For instance, some of the functions discussed in this chapter, such as artifact reduction, can also be embedded in the intelligent collectors discussed in Chapter 4. In addition, other products are designed specifically for handling events. Thus, be aware that just because event management is discussed separately doesn't mean that it must be packaged as a separate product.

Regardless of the sometimes-vague dividing lines between instrumentation and event management, the goal of this chapter is to examine the range of event management functions and their contribution to the process of creating usable, action-oriented information. Specifically, the focus is on the following:

• An overview of event management

• The basic event management functions

• The examination of a market-leading event manager