One of the ITILnews community have sent in the following question:
"When monitoring both the components and services, duplicate events can potentially be generated for the same fault - one for the component and one for the service. What is the best practice approach to this situation? Do you have both events create an incident and relate the component incident to the 'parent' service incident, or just create a component incident, or just create a service incident?"
In my experience, one needs to examine the value of raising two incidents in relation to one incident.
I would suggest an incident is raised for a failing component, which initially may be seen as the 'cause' of the incident, the subsequent 'effect' of the failing component may result in an impact upon the availability and/or performance of the Service, which from a Service Level Management perspective will no doubt need to be reported against and reviewed in detail prior to a weekly or monthly Service Review Meeting.
The impact of the failing component upon the service will no doubt reflect in the priority and the severity of the incident in question.
If a component was duplexed for example, where the work load was shared across two components and one of the components failed resulting in the second component undertaking the full work load, seamlessly and without interruption to the Service would an incident be raised for the Service in this scenario. I would suggest not, as the system/infrastructure had failed over as designed and without impact to the Service delivered.
Having read this response would you agree or have you more to add. Please let us know here at ITILnews using the comment box below.