Use Case:
What constitutes Event Management and how is it managed through ServiceNow? Are there any configurable solutions available within ServiceNow?
Solution:
What is Noise?
In your organization, numerous physical and virtual servers, as well as network items, are managed within the data centers. We refer to these items as configuration items. All of these items are associated with various monitoring tools to oversee their health status. The health is assessed based on predetermined threshold values. The monitoring tool establishes these threshold values, and when a threshold is exceeded, it is compared to the defined and existing values to identify any issues. If multiple items experience the same issue simultaneously, it will be classified as noise.
The table below outlines the categorization of monitoring tools. The tools listed are typically managed by the OOB framework for events and noises.
|
# |
Category |
|
1 |
Infra Monitoring |
|
2 |
Cloud Monitoring |
|
3 |
Application Monitoring |
|
4 |
Network Monitoring |
How to handle Event Management in ServiceNow?
ServiceNow is an exceptionally robust platform for constructing workflows and executing business processes with both effectiveness and efficiency. Nevertheless, the functionality of the workflow is always contingent upon the data. Event data will be integrated with ServiceNow via connectors. If, for any reason, connectors are not available from ServiceNow, custom integration will be employed to achieve the desired outcome. Integrations are managed through the 'Integration Launchpad' within the Service Operation Workspace.
After ServiceNow is integrated with Monitoring tools via the 'Integration Launchpad', the raw event data will be saved in the 'em_event' table. Subsequently, the data from this table will be transformed into alerts, which will then be converted into incidents.
What are the capabilities supporting (Noise Reduction) to handle Event Management?
Upon receipt of the event data, it will be transformed into Alerts and Incidents via Event rules and Alert rules. The diagram below illustrates four key components known as Ignore, Enrich, Group, and Respond rules. This diagram clarifies the application of each element within the event management framework. There are three primary rules implemented in the event management framework.
1. Event Rules
2. Alert Correlation Rule
3. Alert Management Rule
In contemporary practice, it is a fully configurable solution, streamlined through the Service Operation Workspace.
What it mean by auto remediation or Self Healing?
Once an incident is generated through 'Respond' or 'Alert Management Rule', the auto remediation or self-healing process will be initiated with the assistance of a subflow or flow. ServiceNow offers two methods to manage self-healing.
1. Playbook - This will be associated with the alert and executed manually by the agent.
2. Flow / Sub flow - This will be carried out automatically without manual intervention, depending on the conditions outlined in the 'Alert Management Rule' or 'Respond'.
Regards,
Suresh.
