Symptom Incide

Had some discussion with Stavros today about Incident ID, and I still have questions about whether a symptom can participate in multiple incidents.

In Alvin’s example below, the “Service not available” appears to be a type of symptom, not a specific symptom. I would argue that a symptom emitter would only be aware of a single incident to which its unique emitted symptom is related.

I’m not aware of any management products where a symptom (alarm, event, alert, etc) can be associated with multiple help desk incidents. I don’t think there are use cases to support it, thus the products don’t support it.

Not a huge deal to make IncidentID an array, but just not sure the use cases support it.

From: Black, Alvin [mailto:Alvin.Black@ca.com]
Sent: Friday, January 07, 2011 11:22 AM
To: Stavros.Isaiadis@uk.fujitsu.com; saf@lists.oasis-open.org
Subject: RE: [saf] First call in 2011

The “symptom participating in multiple incidents” seems like it would come up very often. The most obvious scenario to me is for any broad symptom that could have multiple possible causes (which may actually be completely separate incidents).

For example:

A “Service not available” symptom could belong to a symptom chain for multiple causes:

A) “Virus detected” symptom

B) “Network unavailable” symptom

C) “Server on fire” symptom

Or, if we want to use a more abstract example:

“I have a headache” symptom:

A) “Did not get any sleep last night” symptom

B) “Axe buried in my head” symptom

C) “I just read another one of Alvin’s emails” symptom

From: Stavros.Isaiadis@uk.fujitsu.com [mailto:Stavros.Isaiadis@uk.fujitsu.com]
Sent: Friday, January 07, 2011 10:54 AM
To: saf@lists.oasis-open.org
Subject: [saf] First call in 2011

Hi all,

First of all, a very happy new year to everyone, and I hope you all enjoyed your holiday breaks! I also hope we will meet in person again and release a mature spec in 2011!

As for our first call this year, it seems that we may be a bit low in numbers for Monday, so be prepared for a "catching-up" like discussion (or even cancelation depending on the numbers).

As a reminder, last time we were discussing about related symptoms, incident id, and case reference. We could try to finalize proposals for this one, and warming up for related issues. I personally like this triple as each one seems to handle different needs:

- RelatedSymptoms provide means to refer to other symptoms using metadata to denote the kind of relationship, e.g. supersedes, causality, repetition etc. This would be set by the emitter probably (?)

- IncidentID, is a rudimentary form of relating symptoms based on the emitter's understanding, e.g. emitting symptoms that are all related to a server down incident.

- CaseID, is a more comprehensive grouping of symptoms based on the diagnosticians' (and other experts') more complete understanding and holistic picture. As such, a case is not the same as an incident, and it can be used to link to external case management systems.

I am still lacking a symptom which could potentially participate in multiple incidents... Any thoughts?

Thanks and hope to speak to you soon,

Stavros

______________________________________________________________________

 Fujitsu Laboratories of Europe Limited

 Hayes Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE

 Registered No. 4153469

 This e-mail and any attachments are for the sole use of addressee(s) and

 may contain information which is privileged and confidential. Unauthorised

 use or copying for disclosure is strictly prohibited. The fact that this

 e-mail has been scanned by Trendmicro Interscan does not guarantee that

 it has not been intercepted or amended nor that it is virus-free.

saf message