1 Million Monitoring Events: Should ServiceNow Receive All of Them?

[ravivsnow]

Imagine an enterprise monitoring environment generating 1 million events.

Should all 1 million events be sent directly into ServiceNow Event Management?

Or should filtering, deduplication, aggregation, and correlation happen before the events reach ServiceNow?

From an ITOM architecture perspective:

> Where should event filtering happen?

> What events should actually reach ServiceNow?

> How should duplicate/noisy events be handled?

> At what point should an event become an alert or incident?

> What architecture would you recommend for handling this volume without overwhelming ServiceNow?

How would you design this in a large enterprise environment?

[boteeuwen]

I wouldn't send all 1 million events straight into ServiceNow. At that volume you're mostly moving the noise instead of solving it.

I'd do the first filtering in the monitoring tools themselves. Things like informational events, heartbeats, duplicates, and events that nobody will act on don't really need to reach ServiceNow. If there are multiple monitoring tools, an aggregation layer can also help with filtering and normalizing before forwarding anything.

What reaches ServiceNow should mainly be meaningful state changes. From there, event rules can normalize the event, find the right CI, set a consistent message key, and create or update the alert. Getting the message key right is important here, otherwise the same problem can keep creating new alerts instead of updating the existing one.

I also wouldn't turn every alert into an incident. I'd only create one when someone actually needs to take action. Severity, how long the problem exists, service impact, maintenance windows, and whether automation can fix it first are all useful checks.

So for me the flow would be monitoring source, filtering and aggregation, ServiceNow event management, alert, and then incident only when needed.

With 1 million events, I'd focus less on how many ServiceNow can ingest and more on how many of those events are actually useful to the operations team.

If this helped, could you mark it as helpful or accept it as the solution?