A series of ITIL study notes........................(Service operation==> Event Management, Incident Management and Request fulfillment management)

1. Lec-8: ITIL
Mr. Islahuddin Jalal
MS (Cyber Security) – UKM Malaysia
Research Title – 3C-CSIRT Model for Afghanistan
BAKHTAR UNIVERSITY ‫باخترپوهنتون‬ ‫د‬

2. Outlines to be discussed ……………Today
• Service Operation phase of ITIL
• Service operation purpose
• Service operation scope
• Service operation processes
• Event management
• Incident Management
• Request fulfillment Management

3. Service Operation

4. Service Operation
• Managing day-to-day activities and infrastructure
• Responsible for business-as-usual activities
• Executing processes to optimize cost and quality
• Enabling the business to meet its objectives
• Effective functioning of components

5. Service Operation
• Maintenance
• Management
• Realises Strategic Objectives and is where the Value is
seen

6. Continued….
• Service operation in neither an organizational unit nor a single
process
• But
• It include
• Several functions
• Many processes and activities
• It includes guidance on achieving effectiveness and efficiency in the
delivery and support of services so as to ensure value for the
customer and the service provider

7. Functions in Service Operation
• Service Desk
• Technical Management
• IT Operations Management
• Applications Management

8. Processes in Service Operation
• Event management
• Problem management
• Incident Management
• Request Fulfilment
• Access Management
We will discuss these
managements in detail.

9. Continued…
• When service interruptions do occur, service operation is charged
with restoring service as quickly as possible and with minimizing the
impact to the business
• It is the only lifecycle phase in which value is actually realized by
customers. Whereas all other phases of the Service Lifecycle
contribute to and enable value, it is only experienced during Service
Operation.

10. Value to the business
• Service operation is where the value is seen
• Services run within budget and ROI targets
• Design flaws fixed and unforeseen requirements satisfies
• Efficiency gains achieved
• Services optimized

11. Service Operation Purpose
• To coordinate and carry out the activities and processes required to
deliver and managed services within agreed parameter
• Responsible for current management of the technology

12. It is all about balance
• Focus
• Internal versus external
• Stability versus responsiveness
• Cost versus quality
• Reactive versus proactive7

13. Service Operation scope
• Includes
• Services
• Service management processes
• Infrastructure
• People

14. Event Management

15. EVENT MANAGEMENT
• Event
An alert or notification created by
• any IT Service
• Configuration Item
• monitoring tool.
• For example
• A batch job has completed. Events typically require IT Operations personnel to take actions, and
often lead to Incidents being logged.
• Event Management
The Process responsible for managing Events throughout their Lifecycle.

16. EVENT MANAGEMENT
• There are many different types of events:
• Events that signify regular operation
− Notification that a scheduled workload has completed
− An e-mail has reached its intended recipient
• Events that signify an exception
− A user attempts to log on to an application with the incorrect password
− A device’s CPU is above the acceptable utilization rate
• Events that signify unusual, but not exceptional, operation.
− A server’s memory utilization reaches within 5% of its highest acceptable performance level

17. EVENT MANAGEMENT
• Examples of event categories
• Informational
• Warning
• exceptional

18. Informational Event
• This refers to an event that does not require any action and does not represent an exception.
• They are typically stored in the system or service log files and kept for a predetermined period.
• Informational events are typically used to check on the status of a device or service, or to confirm
the successful completion of an activity.
• Examples of informational events include:
• A user logs onto an application
• A job in the batch queue completes successfully A device has come online
• A transaction is completed successfully.

19. Warning Event
• A warning is an event that is generated when a service or device is approaching a threshold.
• Warnings are intended to notify the appropriate person, process or tool so that the situation can
be checked and the appropriate action taken to prevent an exception.
• Warnings are not typically raised for a device failure.
• Examples of warnings are:
• Memory utilization on a server is currently at 65% and increasing. If it reaches 75%, response
times will be unacceptably long and the OLA for that department will be breached.
• The collision rate on a network has increased by 15% over the past hour.

20. Exception Event
• An exception means that a service or device is currently operating abnormally (however that has
been defined).
• Typically, this means that an OLA and SLA have been breached and the business is being
impacted.
• Exceptions could represent a total failure, impaired functionality or degraded performance.
• Examples of exceptions include:
• A server is down
• Response time of a standard transaction across the network has slowed to more than 15
seconds
• A segment of the network is not responding to routine requests.

21. 21
Event Management - Logging and Filtering
Event
Filter
Exception
Information
Warning

22. 22
Event Management - Managing Exceptions
Exception
Incident
Management
Incident
Problem
Management
Problem
Change
Management
RFC
Incident/
Problem /
Change?

23. 23
Event Management - Information & Warnings
Information
Log
Warning
Problem
RFC
Incident/
Problem /
Change?
Incident
Alert Human
Intervention
Auto
Response

24. EVENT
MANAGEMENT

25. 25
Event Management - Roles
• Event management roles are filled by people in the following functions
• Service Desk
• Technical Management
• Application Management
• IT Operations Management

26. Incident Management

27. Incident Management
• Incident
• An incident is any occurrence which causes or may cause interruption or degradation to an IT Service.
• The usual priority when an incident occurs must be to restore normal service as quickly as possible, with minimum
disruption to the users.
• An incident defined as an unplanned, unexpected or unexplained disruption in service.
• This is any event which is not part of the standard operation of a service and which causes or may cause an
interruption to or a reduction in the quality of the service that is provided.
• Example
• E.g. mail server not responding to incoming or outgoing messages.
• Incident Management
• Concerned with the rapid restoration of services and with minimization of impact to the business.
• In most but not all cases the Incident Management process is owned and executed by the Service Desk.

28. Basic Activities or Steps of Incident Mgmt.
• Detection
• The incident becomes known by any mechanism,
• e.g. user call, system alert, etc.
• Logging
• Details of the incident are recorded in the incident management system.
• All incidents must be fully logged and date/time stamped, regardless of whether they are raised through a Service
Desk telephone call or whether automatically detected via an event alert.
• Classification
• The incident is categorized according to predefined criteria for the purpose of facilitating diagnosis and prioritizing its
handling relative to other incidents.
• Prioritization
• The impact and urgency of the incident are determined and factored together to determine its relative priority
among other incidents.

29. Continued….
• Initial Diagnosis
• If the incident has been routed via the Service Desk,
• Service Desk analyst must carry out initial diagnosis, using diagnostic scripts and known error information to try to discover
the full symptoms of the incident and to determine exactly what has gone wrong.
• The Service Desk representative will utilize the collected information on the symptoms and use that information to initiate a
search of the Knowledge Base to find an appropriate solution. If possible, the Service Desk Analyst will resolve the incident
and close the incident if the resolution is successful.
• Escalation
• If necessary, the incident may be forwarded to the appropriate handling group.
• Investigation and initial diagnosis
• Additional details regarding the incident are gathered and used along with tools such as the Known Error Database to
attempt resolution.
• Resolution and Recovery
• Service is restored and users are provided assistance to allow them to resume work.
• Closure
• Successful resolution of the incident is verified with the user, the incident resolution details are recorded, and the incident is
flagged as being closed in the incident management system.

30. INCIDENT MANAGEMENT

31. INCIDENT MANAGEMENT

32. Request Fulfillment Management

33. Request fulfillment Management
• Service request is a request from a user for
• Information
• Advice
• Standard change
• Access to
• Request fulfillment Management
• Process that manages service requests received from the users.
• It is important to distinguish between incidents and service requests.
• Incidents are unplanned and require Change Management approval prior to
resolution.
• A service request, on the other hand, is a request that has a standard
procedure for response and is pre-approved by Change Management.
IT
Service

34. Continued….
• All requests should be logged and tracked.
• The process should include appropriate approval before fulfilling the request.

35. Continued…
• The term ‘Service Request’ is used as a generic description for many varying types of demands
that are placed upon the IT Department by the users.
• Many of these are actually small changes – low risk, frequently occurring, low cost, etc.
• A request to change a password
• A request to install an additional software application onto a particular workstation
• A request to relocate some items of desktop equipment
• A question requesting information

36. Objective of the request fulfillment process
• To provide a channel for users to request and receive standard services for which
a pre-defined approval and qualification process exists
• To provide information to users and customers about the availability of services
and the procedure for obtaining them
• To source and deliver the components of requested standard services
• (e.g. licences and software media)
• To assist with general information, complaints or comments

37. Role of request fulfillment process
• Not usually dedicated staff
• Service Desk staff
• Incident Management staff
• Service Operations teams

38. Thank You
For Your Patience