[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Symptom Incide
Had some discussion with Stavros today about Incident ID, and I still have questions about whether a symptom can participate in multiple incidents.
In Alvin’s example below, the “Service not available” appears to be a type of symptom, not a specific symptom. I would argue that a symptom emitter would only be aware of a single incident to which its unique emitted symptom is related.
I’m not aware of any management products where a symptom (alarm, event, alert, etc) can be associated with multiple help desk incidents. I don’t think there are use cases to support it, thus the products don’t support it.
Not a huge deal to make IncidentID an array, but just not sure the use cases support it.
The “symptom participating in multiple incidents” seems like it would come up very often. The most obvious scenario to me is for any broad symptom that could have multiple possible causes (which may actually be completely separate incidents).
A “Service not available” symptom could belong to a symptom chain for multiple causes:
A) “Virus detected” symptom
B) “Network unavailable” symptom
C) “Server on fire” symptom
Or, if we want to use a more abstract example:
“I have a headache” symptom:
A) “Did not get any sleep last night” symptom
B) “Axe buried in my head” symptom
C) “I just read another one of Alvin’s emails” symptom
First of all, a very happy new year to everyone, and I hope you all enjoyed your holiday breaks! I also hope we will meet in person again and release a mature spec in 2011!
As for our first call this year, it seems that we may be a bit low in numbers for Monday, so be prepared for a "catching-up" like discussion (or even cancelation depending on the numbers).
As a reminder, last time we were discussing about related symptoms, incident id, and case reference. We could try to finalize proposals for this one, and warming up for related issues. I personally like this triple as each one seems to handle different needs:
- RelatedSymptoms provide means to refer to other symptoms using metadata to denote the kind of relationship, e.g. supersedes, causality, repetition etc. This would be set by the emitter probably (?)
- IncidentID, is a rudimentary form of relating symptoms based on the emitter's understanding, e.g. emitting symptoms that are all related to a server down incident.
- CaseID, is a more comprehensive grouping of symptoms based on the diagnosticians' (and other experts') more complete understanding and holistic picture. As such, a case is not the same as an incident, and it can be used to link to external case management systems.
I am still lacking a symptom which could potentially participate in multiple incidents... Any thoughts?
Thanks and hope to speak to you soon,