1 2 3 4 Previous Next 56 Replies Latest reply on Dec 21, 2015 4:55 AM by Shweta Jhall
      • 1. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
        Jeffrey Fan

        Where i can more detail Intelligent Ticket solution reference doc? I want to check if i need to upgrade Intelligent Ticketing Solution 2.0 in our environment. We have BPPM 8.602 SP4 and ITSM 7.604 SP5.

        • 2. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
          Ashok Kumar Jha

          Hi,

          Although my reply is pretty late, but see if it still helps.

          1) There is no ITSM release like ITSM 7604 SP5. For ITSM 7604, the last service pack is SP4 only. SP5 is only for the AR.

          2) Intelligent Ticketing 2.0 is released and you can find the documentation here:

          https://docs.bmc.com/docs/display/itkt20/Home

          https://docs.bmc.com/docs/display/itkt20/Supported+platforms+and+versions

          https://docs.bmc.com/docs/display/itkt20/Downloading+the+patch

           

          Thanks.

          • 3. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
            Tim Bocardo

            What is actually propagated to ibrsd for an Infrastructure ticket? 

            Both the CI state change event and the original event or only the state change? 

            If only the CI state change, then does the event info (specifically the msg slot) get into the ticket description?

            If a second event gets attached to the CI (and hence, to the ticket), does the msg slot from that event make it into the ticket (e.g. in Work Details)?  This would be very useful information to have

            • 4. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
              Darius Wallace

              For the new policies supported with IT2.0,  when an Incident is created from an event, the initial state is set depending on if it's an Event, Causal or Impact Incident and the event information is mapped to Work Info. The initial status for Event and Causal Incidents is "Assigned" and Impact Incidents are initially set to "Pending". Additional events for the same CI will result in additional Work Info entries on the original Incident.

              • 5. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                Tim Bocardo

                So my unanswered questions are these:

                 

                What is the Description on the Causal incident?  Is it the msg text of the event like it would be for an event-based ticket, or is it something more generic about the CI changing status?

                 

                Also: if a new event arrives for that CI, does the msg text of that event get put into the work details of the incident?

                • 6. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                  Darius Wallace

                  Question: What is the Description on the Causal incident?  Is it the msg text of the event like it would be for an event-based ticket, or is it something more generic about the CI changing status?

                   

                  Answer: Description is “Intelligent incident for Causal CI {CI Name}”.

                   

                  Question: If a new event arrives for that CI, does the msg text of that event get put into the work details of the incident?

                   

                  Answer: In case of new policy, for all events related
                  to Causal CI, the information about event such as event message, event details etc.  goes into worklogs.

                  • 7. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                    Darius Wallace

                    Sorry about the formatting... Somehow it got all stripped away and the text just got all merged together...

                    • 8. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                      Tim Bocardo

                      Thanks Darius.  New question:

                      If I'm doing BPPM-CMDB integration and auto-publishing all ComputerSystem CIs,my understanding is that every event will associate to the  ComputerSystem CI specified in mc_host.  (I haven't tested this, but believe it to be true)

                      Does that mean that every event is associated to a CI and so every ticket would be a Causal ticket, even if I use the Event policy, or would I still need to use the Causal policy?

                      • 9. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                        Sumit Kumar

                        Hi Darius,

                         

                        I also have two questions and am sure you should be able to help me with that. It's very basic question while implementing any auto-ticketing solution. So here is the questions:

                        What mechanism do we have to prevent auto incident creation when there is event flood and in case of service flapping alerts? I mean what technique is there is there to implement it.

                         

                        Thanks

                        Sumit

                        • 10. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                          Anne Brock

                          I think that's usually done by the event manager - BPPM/Proactivenet.

                          • 11. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                            Sumit Kumar

                            Hi Anne,

                             

                            I am OK if its even from BPPM/BEM. I am curious to understand the available techniques and methods to prevent event flood and service flaping situation. Please share if you got any.

                            • 12. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                              Carey Walker

                              Hi Sumit

                               

                              A couple of things to note that can confuse people easily.

                               

                              BPPM is a broad bundling (these days) of what were generally discrete products. I find it easier to think of it as two main parts. One is the 'monitoring' parts of the solution (like Patrol, Proactivenet and other related things). Second is the 'event management' parts of the solution (like BEM, SIM, IBSRD/IT/Service Resolution) etc). Bit of a generalisation but it works for me. So when people say 'BPPM does this or that' it's always good to clarify exactly what they are referring to, even if the context of the comment will usually be obvious.

                               

                              Now to your question. There are several ways you can quieten down the 'noise/flapping' you described, to avoid a flood of useless incidents.

                               

                              Best way but often hardest is at the monitoring source. So if you can, define the alarm and related rules to be more tolerant of devices that exhibit this behaviour, without tying things down too much, and maybe missing important things.

                               

                              Next is to look at the event management engine's processing capabilities. There are de-duplication and correlation options that will help here. So if a device is being monitored every 3 minutes and is broken for 60 minutes, you can define de-dupe logic that recognises that the 20 or so events you will get here, are in fact the same thing, and only create the event once, and record subsequent events as additional counts of the same thing. The incident will only get created if configured to do so, on the first event, and typically the incident can get work info details updated as the later events come in. So one event with a counter to say it's repeated, and one incident with multiple Work Infos to reflect the repeated events.

                               

                              Correlation takes it a step further and can identify what are related events, and effectively bolt them all together under one 'master' event. The 'master event' again will be the one that can create the incident. An classic example here is where a switch fails, and hence all devices attached to the switch will start to generate connectivity alarms. If you can define a correlation rule that can recognise the switch failure and the device connectivity failures then BEM will treat them as a single event.

                              • 13. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                                Sumit Kumar

                                Hi Carey,

                                 

                                Thanks for your inputs. With the above explanation I understood that one can achieve it by implementing correlation rules based on CI's objects. Can you please quote me a solution on service flapping with some example?

                                 

                                Environment: Events--->BEM--->Auto Ticketing---->ITSM

                                Issue:-A Network device frequently changes its state from up to down and the again coming back up. The issue goes on for a while and the impact is numerous incident creations as we have auto ticketing in place. Though I understand the incidents will be closed by their corresponding up events every time but Its will cause great number of P1 incidents in reports.

                                 

                                What correlation or solution we should deploy to avoid the issue?  May be we should try to identify the trend before sending it to ITSM engine by implementing some event staging. Please suggest .

                                • 14. Re: Ask me about BMC Intelligent Ticketing Solution... (FAQ)
                                  Carey Walker

                                  For this scenario, I would set up a correlation rule that had a time window included. e.g. identify the device name (mc_host) and every time the device and the down event message appears in an event, correlate if within a 10 minute window say. Depending on the frequency of failure, this will reduce the event count s and therefore incidents, considerably.

                                   

                                  This is only a quick and very simple idea to get you started. you will need to use this as a learning exercise and then refine it overtime.

                                  1 2 3 4 Previous Next