In ITIL v3, event management is defined as “the process that monitors all events that occur through the IT infrastructure. It allows for normal operation and also detects and escalates exception conditions.” It sat within the Service Operation stage of the ITIL v3 lifecycle and is responsible for flagging issues and changes occurring in the IT infrastructure, both expected and unexpected.

Now in ITIL 4, the purpose of the renamed monitoring and event management practice is “to systematically observe services and service components, and record and report selected changes of state identified as events. This practice identifies and prioritizes infrastructure, services, business processes, and information security events, and establishes the appropriate response to those events, including responding to conditions that could lead to potential faults or incidents.” It’s one of ITIL 4’s service management practices.

But what’s actually special about event management and do you really need it? In this blog post, I explain what events are in the IT world and then provide five reasons why your organization would benefit from the use of an event management tool.

What’s an event?

Before looking at the benefits of an event management tool, I should first explain what the meaning of “event” is within IT service management (ITSM).

An event is essentially any change that occurs to a significant piece of your IT infrastructure. This could be, for example, a system, an IT service, or a configuration item. These changes are not necessarily bad. Sometimes an event is just telling you that something is different.

For instance, let’s take an automated backup that runs each week where an event occurs when the backup status changes to “completed.” Events can let you know when everything is working as expected just as they can let you know when something has gone wrong.

There are three kinds of events that can take place:

1. Informational – These events let you know that something has changed but no action is necessary. Like in the example above, the automated backup has run and completed – and it’s good for you to know that this change has occurred (so you know the backup has been successful) but because it worked as expected there’s no reason to take action of any kind. You can just carry on letting it do its thing.
2. Warning – This type of event is a little more serious and might actually require some kind of action. For example, a server might reach its capacity threshold, so a warning event is triggered to let engineers know that some kind of manual intervention will need to take place. If action is not taken, the server is at risk of falling over which would then result in an incident. In scenarios like this, warning events can help to prevent incidents.
3. Exception – An exception event means that something has gone wrong. These are of course the most serious type of event and will require immediate attention to investigate and resolve. In all cases, the incident or problem management team will need to be involved.

In short, all incidents are events as they signal negative changes to your IT infrastructure, however, not all events are incidents. Some changes that create events are entirely normal and expected.

Events signal how well your IT infrastructure is behaving – and event management gives you the ability to reduce incidents, highlight troublesome services, and view the performance of your entire IT estate. When you can see the full picture, your problem management and continual service improvement (CSI) – now called “continual improvement” in ITIL 4 – capabilities are vastly improved.

Finally, events occur all day, every day, as it the nature of IT operations. Whether it’s a user logging in, a system changing from idle to active, or a backup running, IT never stops so nor will your event management tool.

5 benefits of using an event management tool

Now that we understand the importance of events and event management in IT, let’s look into the benefits that an event management tool can bring to your organization.

1) Improving incident detection and response times

When you use an event management tool, you can improve your incident detection and response times. If your IT organization currently relies on its end users finding and reporting issues to the IT service desk, then this should be music to your ears.

Depending on the incident type, instead of a phone call to the desk from an unhappy user, the event alert comes in before anyone even notices that something has failed. With the event management tool alerting the necessary teams and individuals for the start of investigation and resolution activities.

As the incident has been detected almost immediately, engineers are able to respond quickly, and communications can be sent to the relevant stakeholders to alert them as and when necessary.

If it’s an exceptional event, the added bonus of improving your detection and response times means that you reduce system downtime too. And if it’s a warning event, you have the opportunity to avoid an exception altogether.

2) Automation capabilities that save time and costs

With an event management tool, you can create workflows for the entire lifecycle of your events. This means that when an event is triggered, the tool can automatically notify the correct individuals, assign the event to the relevant support area and category, and close/archive the event upon completion. Events can also be automatically turned into actionable alerts or incidents speeding up your logging process too.
Moving these tasks to an automated workflow instead of requiring manual handling, will not only speed up your processes – it will also ensure consistency and accuracy of event handling. Such that there’s no more trying to remember who deals with what, with the event management tool automating these routes for you.

3) Better decision-making and actions through automated report distribution

Reports can be used to highlight problem areas (repeat warning or exception alerts) and therefore assist in your organization’s service improvement efforts.

An event management tool will already provide out-the-box reporting functionality that your organization can take advantage of. However, through some simple setup steps, you can customize the reports you create as well as automating their distribution – with reports scheduled, executed, and sent to relevant people without any further manual intervention required.

4) Greater visibility into IT service delivery quality

An event management tool will provide you with greater visibility into the ongoing status of your IT estate per se – both infrastructure and applications – helping you to see what’s healthy and where there are issues.

The increased visibility across the estate not only allows for proactive fixes but also longer-term investments to prevent incidents and reduce downtime, and it also makes root cause analysis easier and quicker.

5) Operational cost savings

As with any investment, you’ll, of course, want to know whether an event management tool is going to save your organization money in the long-run.

Given that an event management tool will give you the ability to:

• Improve your detection and response time
• Reduce downtime (and the associated business-level costs)
• Automate service operation processes
• Highlight problem areas for review, and
• Proactively fix issues

The operational cost savings, and required business case calculations, quickly become obvious. Plus, support costs will also be driven down as your environment becomes better managed and continual improvement activities will be made easier.

If you’re already using an event management tool, what other benefits would you highlight? Please let me know in the comments.