How does ITIL 4 define the event management practice? And what can we learn from it for our day-to-day monitoring tasks? Let’s find out.
Table of contents:
In the ITIL framework (IT Infrastructure Library), event management is one of the service management practices. Here’s a direct quote from ITIL 4:
“Monitoring and event management practice: The practice of systematically observing services and service components and recording and reporting selected changes of state identified as events.”
We understand that “observing services and service components” and “service management practice” may sound abstract. View it as terms from ITIL to describe what your IT team already does.
Read more on ITIL and IT services in our other articles.
In practice, the event management part of the IT team’s job involves monitoring the systems that are critical to the delivery of IT services.
Here are some examples:
Alloy’s IT asset management solution provides your team with the richest data ever. Our software gathers information others may not, including:
Connect with our sales team, and we’ll find a way to integrate our solution into your stack.
ITIL 4 defines an event as “any change of state that has significance for the management of a service or other configuration item (CI).”
Events are observed through monitoring tools and serve as indicators of changes in the IT environment that may (or may not) require attention.
What is considered an event in one IT team may not be viewed as such in another. Events are selected changes of state in the IT infrastructure. The IT team selects the monitoring tools and infrastructure areas to be monitored, defines criteria for event identification, and configures monitoring systems accordingly.
Telling the difference between events and incidents in ITIL might be challenging. Let’s try.
An event is any change that has significance for the service or the CI. Meanwhile, an incident is an unplanned interruption or reduction in the quality of an IT service.
Here’s how an event might turn into an incident:
Not all events result in incidents, and not all incidents have an event behind them.
Find more details in our article on incident management.
Event management in ITIL aims to prevent events from negatively impacting IT infrastructure and to maintain continuous service availability.
What can one do to achieve this?
The event management process is what the IT team does to handle events from the moment they’re spotted until they’re resolved.
In the IT world, you might also hear about the “event management lifecycle.” Both concepts emphasize the systematic progression of the event management process. It starts with classification, then moves to prioritization and response management, and results in the resolution.
Here’s a brief overview of each stage of the event management process:
Companies use various monitoring tools and techniques to detect events, such as system logs, performance metrics, network traffic analysis, and specialized monitoring software.
Once an event is detected, it is put into one of the categories according to its security level, the severity of the event, or the affected business function. There is no right or wrong way of event classification. You should choose one that highlights the event’s attributes that matter for your business processes.
For example, ITIL 4 mentions three types of events based on potential security risks: information, warning, and exception events. Categorizing each event helps to define which response measures are needed.
| Definition in ITIL | Practice |
|---|---|
| “Informational events do not require action at the time they are identified, but analyzing the data gathered from them at a later date may uncover desirable, proactive steps that can be beneficial to the service.” | Simply put, informational events are a category for any events that don’t signal danger. An example is logging user activity on the website. |
| “Warning events allow action to be taken before any negative impact is actually experienced by the business.” | Nothing is breaking yet, but it may do so, depending on how it plays out. Imagine an unusual spike in website traffic approaching the server’s maximum capacity. |
| “Whereas exception events indicate that a breach to an established norm has been identified (for example, to a service level agreement). Exception events require action, even though business impact may not yet have been experienced.” | The servers are suffering already, and actions should be taken to mitigate negative consequences. An unexpected influx of suspicious bot traffic to the website servers would be a good example. |
As mentioned, ITIL event management practice focuses on observing IT services and configuration items (CIs), i.e., IT infrastructure components important for delivering a particular service. Configuration items range from configurations, computers, and connectors to networks and servers.
A Configuration Management Database stores all the details about the CIs and dependencies between them. This information supports event management by providing insights about configuration items and their relationships and dependencies, both physical and logical.
For example, if a server outage occurs, event management needs to know which other services or components may be affected due to dependencies on that server.
In Alloy Navigator, you can easily see which CIs are connected to the affected server.
Then, you can get a short overview of the CI: its status, location, owner, and more.
Or click through to get a deeper understanding.
Have there been any recent tickets for this service? No. It looks like it’s all right, and this service wasn’t affected.
Explore all the nuances of managing configuration data in our article on Configuration Management Database.
Event management creates a systematic approach to monitoring events and establishing appropriate responses to them.
You never know where a critical system error or data breach will come from. However, a well-functioning monitoring system with automated event notifications to relevant stakeholders and documented response scenarios can do wonders for the information security system in your org.
In 2024, third-party security monitoring teams discover vulnerabilities in the infrastructures of big companies almost every week. Recent headlines included Ivanti and JetBrains.
Robust internal event management helps build a strong security practice in-house.
Here’s what ITIL 4 suggests for better event management:
Though event management is mainly about automation, people are essential in this process. At the goal-setting stage, when developing the processes and determining the rules for event evaluation, it’s helpful to involve as many team members as possible: system administrators, application developers, service delivery managers, SLA managers, and security analysts.
Once again, while monitoring can be automated, to organize appropriate response to events, people’s involvement is critical. Do not just define and document roles clearly; also, pay attention to how easily each person can access the resources they need for the response.
Automation is crucial for effective event monitoring. Some service components and CIs have their own monitoring capabilities. For example, network devices like routers, switches, and firewalls can generate logs, track traffic, and provide real-time performance data. If you want more information, you will benefit from specific monitoring tools.
Alloy Software’s IT asset management solution provides detailed accounts of every asset in your IT environment:
If you want to learn more, connect with our sales team.
Data generated by monitoring tools doesn’t bring much value if you can’t analyze it, i.e., build connections between events (also called event correlation). So, pay attention to the reporting capabilities of the ITSM or workflow management tool that you’re using.
ITIL also suggests including the provision of data for monitoring into contracts with suppliers if outsourcing some IT functions, such as infrastructure management. Otherwise, suppliers might be reluctant to share data related to the components they deal with.
Start your trial with Alloy Software today
