Difference between event, alert, problem, and incident

[Bill Smith2]

Hello All,

What is the difference between events, alerts, incidents and problems in ServiceNow world?

What is the relationship between an alert and an incident?

Is an incident synonymous with a ticket in ServiceNow?

How do I create an alert/event in ServiceNow?

Do I/can I store an alert in the incident table?

I am really confused about all these concepts in context of ServiceNow and reading the documentation doesn't seem to help much.

My external system generates a set of alerts and I'd like to be able to generate tickets for them in ServiceNow based on some logic. How do I do that?

Your replies/clarification is much appreciated.

thanks.

[Aniket Sawant]

Hi,

 Please go through the link.

http://www.itskeptic.org/does-itil-explain-difference-between-alert-and-eve

Please mark helpful or correct based on the impact.

Regards,

Aniket Sawant

[Bill Smith2]

Thanks Aniket, for the link, but it really doesn't answer my questions. I am not asking a philosophical question here. I am asking what is the difference between these terminologies in the ServiceNow's world. If my external system generates a set of alarms, e.g., a network device is down, CPU utilization is over 98%, etc., do I need to store them in ServiceNow as alerts or events or incidents? And furthermore, is an incident the same as a ticket.

[Monali Patil]

Hi Bill,

Incident is same as ticket in ServiceNow.

When More than one incident occur for same reason or for same system it considered as Problem.

If any Incident Impacts is more it will consider as major Incident.

An event indicated that something has happened. It can be just “information” (i.e. for you to know only), a warning (i.e. something is going wrong) or an exception (i.e. something has went wrong).
 Information events are logged for operational staff used to check the proper operation of the IT services.
 Warning events trigger “alerts” to notify responsible parties to take actions before things go wrong. Alerts are triggered when the IT services or devices approaching its thresholds (i.e. breaking points)
 Exception events are directed into Incident Management Process normally with high priority as something has went wrong already.

Alert:As alerts generate, you can view more information about them, acknowledge them, and take action to resolve them. You can also manually create alerts to track issues that did not generate an event or alert. Business rules that are written for alert tables [em_alert] must be highly efficient or they may result in performance degradation.

How to create alert manualy.

1. Navigate to Event Management > All Alerts.
2. Click the alert Number.
3. To create an incident:
   • To create an incident, click Quick Incident.
   • To create a security incident, click Create Security Incident. You must install the Security (secops) plugin to enable this option.
4. Click Update.

Event Management:Event Management helps you to identify health issues across the data center on a single management console.

If you want any further information please update me.

If my answer helps you please mark as correct/helpful.

Regards,

Monali Patil

[Himanshu Dubey]

Hi

Below are the answers of your questions:

1) Event: Event are special records the system uses to log when certain conditions occur and to take some kind of action in response to the conditions. The system uses business rules to monitor for system conditions and to generate event records in the Event [sysevent] table, which is also known as the event log or event queue.

 Alert: You can send messages to customers as alerts, informative messages, or error messages.

 Incident : Any unplanned interruption to an IT service or reduction in a quality of services.

Problem :  Re-occurrence of an incident.

2) Yes

3) Creating an Alert 

   gs.addInfoMessage("your message"); // for server side scripting

   alert("your message"); // for client side scripting

 Creating an Event 

   Goto->Event registry->Create an event

   Generate the event:

     There are two ways to generate an event 

       i) By server side script like : Business rule, script include etc.

           gs.eventQueue('event_name',object,parm1,parm2);

       ii) By create an event activity in workflow.

  Respond to the event

     There are two ways to respond to the event 

     i) Notifications

    ii) Script Action

 4 ) 

You can use the Incident Alert Management application to:

• Create an incident alert when a crisis occurs.
• Set up contact responsibilities to identify the individuals who receive automatic notifications when incident alerts are created. If they want to receive notifications, Self-service users can subscribe to incident alerts.
• Manage incident alerts to improve communication while dealing with the crisis.
• Use the optional Notify feature to send notifications by SMS messages and voicemails, and to set up conference calls.
• Monitor events and results with the incident alert dashboard and reports.

Please mark correct and Helpful if it helps

Thanks & Regards

Himanshu Dubey