Understanding Event and Alert Management › Event and Alert Management Overview

Event and Alert Management Overview

Managing the large stream of messages and fault conditions that the multitudes of data sources generate is a unique and difficult challenge in the modern IT infrastructure. Distributing the management of these conditions across multiple domain managers increases overhead, the potential for error or duplication of work, and time to resolution.

CA Service Operations Insight (CA SOI) collects and displays data from all domain managers in your enterprise. Therefore, CA SOI is the ideal product to use as a unified alert management tool across all managed domains. Operations personnel can use the unified alert view to manage all fault conditions in one place, drilling into the source product when necessary to resolve problems.

You can manage alerts in CA SOI from multiple perspectives:

Service-oriented

Alerts that are associated with managed services appear when viewing that service, and you can manage alerts from this perspective to ensure service health.

Queue-oriented

CA SOI also introduces the concept of alert queues to enable unified alert management with no reliance on existence in a managed service. CA SOI displays all collected alerts, including alerts that are not associated with any services. You can group alerts that share common characteristics into queues so that you can manage them together.

These distinct perspectives let you manage alerts in the manner that best suits your needs. If your enterprise is in the early stages of transitioning to a service-oriented paradigm, you can use alert queues to ease the transition to services.

Due to its unique position in the product hierarchy, CA SOI can also serve as the single escalation point for all alerts enterprise-wide. Notification emails, help desk tickets, and other escalations can all originate from CA SOI to consolidate and simplify the escalation and remediation process.

CA SOI also includes an event management layer that lets you define rules for processing raw and normalized event messages. You can define policies that influence how and when raw events appear as alerts, so that operators are presented with a quality set of actionable alert conditions.

The combined features of event and alert management let you effectively manage alert data throughout its lifecycle, from processing to assignment to management to escalation to resolution.