Overview

Intelligent Event Modules (IEM) extend the ConsoleWorks Server to include vendor domain knowledge on a wide range of IT components. Each event within an IEM includes the event pattern, the vendor’s recommended priority or severity, and the vendor’s human-readable event definition. IEM events also include vendor recommended actions where available. IEMs have two distinct use-cases. They organize information needed to speed up Incident resolution, produce reports (e.g. compliance), and perform research. They can also be used for real-time event detection and remediation on mission-critical systems. This is typical in situations where Mean-Time-To-Repair (MTTR) is a critical business measure.

Event Patterns

Foundational IT components often generate large streams or flows of information on a continuing basis. Some of the information indicates existing or potential issues (events). Events can be predefined event codes, text patterns that include special characters (including spaces), or complex patterns that can only be identified with wildcards. IEMs include the event pattern for each vendor event. The ConsoleWorks Server uses these patterns to detect the events included in an IEM.

Severity or Priority

Each event in an IEM includes the vendor’s recommended severity or priority. Some events are informational – there is no reason to do more than collect them. Other events demand action and have a much higher priority than informational events. The ConsoleWorks Server uses IEMs to automatically set the proper event priority for each event in an IEM.

Human-Readable Definitions

Most events are not self-describing. They are usually unique patterns that must be looked up in a reference before they can be understood. Each IEM event includes the human-readable definition, from vendor documentation, that describes the meaning of the event. The ConsoleWorks Server presents this human-readable definition with each IEM event so the event can be immediately understood without resorting to references or research.