*
Quick Links|Home|Worldwide
Microsoft TechNet*
|TechCenters|Downloads|TechNet Program|My TechNet|Security Bulletins|Archive
Search for


Autoticketing Solution Accelerator

Published: November 22, 2004
On This Page
Executive SummaryExecutive Summary
IntroductionIntroduction
Autoticketing OverviewAutoticketing Overview
Processes and ActivitiesProcesses and Activities
AppendicesAppendices

Executive Summary

In the increasingly important and complex world of information technology (IT) operations, it is essential to implement a robust and reliable systems management infrastructure based on proven methods. Service Monitoring enables data center managers to increase operational efficiency and to achieve a higher state of availability for mission-critical applications and management of Microsoft® Windows® services. Increased levels of performance can be achieved on Windows platforms through the implementation of Service Monitoring, which incorporates best-practice guidance in planning, building, designing, and deploying Microsoft Operations Manager (MOM) 2005 to monitor Windows applications and services.

Automated ticket generation—or autoticketing—enables the fully automated posting of a request (or ticket) into the Trouble Ticketing (TT) system used in incident management. Because it requires no user or manual interaction, autoticketing results in improved operational efficiency through:

More effective and efficient overall delivery of IT services.

A corresponding increase in user satisfaction with the service received.

Quicker and more effective responses to service incidents.

More effective and efficient workforce from improved accuracy and speed in receiving information.

Introduction

Document Purpose

This guide contains information about autoticketing for organizations that have deployed (or are considering deploying) MOM 2005 in a data center or other type of enterprise computing environment. It discusses the steps inherent to preparing for and implementing autoticketing. In addition, it provides sample scripts for the MOM Connector Framework (MCF) and Siebel Enterprise Application Integration (EAI)/HTTP transport.  

It is not the intention of this document to provide a fully implemented autoticketing capability because doing so would be assuming that a universally applicable solution for autoticketing is possible, which is not the case. Autoticketing requires a thorough study of the internal IT organization’s applications, workflows, and business rules. Then the data, logic, and specific configurations must be applied based on that information. This guide describes many of these considerations in order to implement a successful autoticketing solution.

Background

Autoticketing is a practice that is aligned with the Service Monitoring and Control (SMC) service management function (SMF). The SMC SMF is one of the 21 SMFs (shown in Figure 1) defined and described in the Microsoft Operations Framework (MOF) Process Model. Every SMF within MOF benefits from some aspect of SMC because these functions are inherent to ongoing process improvement. This is especially true in the Operating Quadrant of the MOF Process Model, where the SMFs are closely interrelated.

Figure 1. MOF Process Model and related SMFs

Figure 1. MOF Process Model and related SMFs

Appendix B: Key Performance Indicators contains a statistic that should be reviewed to understand the performance of SMC as well as to identify opportunities for improvement.

Intended Audience

The guide is intended for IT professionals in data centers and in large and enterprise organizations. In particular, MOM administrators, help-desk personnel, and others involved in service monitoring and control and in service continuity management should find this guide helpful. It assumes that the reader is familiar with the intent, background, and fundamental concepts of MOF, MOM, and other Microsoft technologies discussed. (Links to further information are contained in Appendix A: Resources.) An overview of MOF and its companion, Microsoft Solutions Framework (MSF), is available at http://www.microsoft.com/technet/itsolutions/cits/mo/mof/default.mspx.

Terminology

This guide uses terminology that is current for MOM 2005. Table 1 lists the changes in terminology between MOM 2000 Service Pack 1 (SP1) and MOM 2005.

Table 1. Terminology Changes Between MOM 2000 SP1 and MOM 2005

MOM 2000 SP1MOM 2005

zone configuration group (middle tier)

source management group

master configuration group (top tier)

destination management group

DCAM

(MOM) Management Server

processing rule group

rule group

processing rule

rule

Feedback

Please direct questions and feedback about this guide to msmfeed@microsoft.com.

Autoticketing Overview

Goals and Objectives

This chapter identifies some of the reasons for implementing autoticketing. In addition, it supplies details about the key phases, scope, high-level requirements, and challenges as they pertain to autoticketing, and provides a look at its architecture.

The primary goals of autoticketing are to increase operational efficiency, reduce the costs of IT operations, increase the effectiveness of service monitoring and control, and use key information from other IT operations applications.

The successful implementation of autoticketing achieves the following objectives:

Reduced labor cost. Autoticketing reduces the labor overhead from operators who use the MOM Operator console to determine if a condition warrants specific action and from service-desk staff who process an incident into the Trouble Ticketing (TT) system.  

Reduced error. When operators create a trouble ticket, the process is inherently error-prone because data is manually transposed from one system to another. Errors include misspellings, duplication, omissions, insufficient information, and inaccuracies that can have dangerous ramifications when a privileged administrator acts upon them.

Decreased time to repair. Autoticketing eliminates the need for manual entry of the ticket. This allows an immediate update to an administrator or engineer’s activity list to resolve the failure condition.

Increased availability. Similar to repair, if a cascading failure is detected and a ticket is created sooner, a total failure may be prevented. In addition, when eliminating the labor overhead associated with the manual process, this frees up the staff to focus on more unique conditions as well as proactive investigation.

Maximized investment. Integrating the monitoring system, TT system, and other IT applications has a mutually beneficial effect on functionality, data, and workflow. This results in an improved overall delivery of IT services.

Key Phases

In order to effectively create autoticketing, the alert-tuning process must be in place to optimize the alert volume. Guidance on alert tuning is contained in Optimizing MOM 2005 Alert Volume, which is one of the five solutions for Service Monitoring. Once the alert-tuning process is in place, autoticketing can be established through a process involving three key phases:

1.

Assessment of MOM and Trouble Ticketing Environment. In this phase, pertinent information is collected and organized. Specific mappings and data identification might be necessary to prepare for the implementation.

2.

Implementation of Autoticketing Capability. Actual development and implementation of the communications and logic are performed during this phase.

3.

Run-time Monitoring. The autoticketing solution has been implemented and now needs to be monitored for its health.

These phases are discussed in Chapter 4, “Processes and Activities.”

Scope

This document addresses the ticketing of alerts from MOM 2005.  

High-Level Requirements

The successful implementation of autoticketing requires:

A good understanding of the Service Monitoring and Control SMF and fulfillment of its requirements. This SMF is available at http://www.microsoft.com/technet/itsolutions/cits/mo/smf/smfsmc.mspx.

A working knowledge of MOM 2005.

Proficiency in MOM Connector Framework (MCF) architecture and development. Further information is available at http://www.microsoft.com/mom/evaluation/mcf/default.asp.

Proficiency in the TT system that the IT organization uses.

Key Challenges

In theory, the concept of autoticketing sounds simple: Receive an alert, decompose it, create a ticket, and supply the data. In reality, there are many more considerations. The three key challenges to successful autoticketing are as follows (ranked from highest to lowest complexity):

Data sufficiency. Getting enough quality data in order to create a complete ticket.

Data-transfer enablement. Building the communications between the systems.

Data-transfer management. Managing the communications between the systems.

Data Sufficiency

The key value that a monitoring system can provide to a ticketing system lies in the description of problems—that is, in identifying the potential root cause of the failure condition. However, there might be more data that the ticket recipient needs before the ticket is actionable. When there is not enough of this information, the following conditions may occur:

Missing information forces the recipient to perform fact-finding, communication, and verification tasks. These tasks can cause negative effects such as increased labor cycles, added manual steps, and can create longer waits—essentially nullifying the value that autoticketing is supposed to provide in the first place.

Inaccurate information is even worse than missing information. The recipient can inadvertently act on false information, which can result in a situation such as shutting down the wrong server. Or the recipient might mistakenly work on a very low-priority issue and postpone the repair of the most important system in the infrastructure.

Data sufficiency is a challenge because MOM serves a different functional role than a TT system. MOM is focused on infrastructure monitoring, performance collection, and response. The TT system is focused on record keeping of a ticket or service request (SR), managing workflows, coordinating activities, and reporting. It is understandable that these two IT operations products require different (unique) variables and datasets. In addition, other applications might hold the necessary data; however, they too are likely to have their own data formats and conventions.

Data-Transfer Enablement

MOM 2005 now provides a way to expose alert data through MCF, which is a Web service–based framework for connecting MOM and any third-party management platform.Most commercial TT packages also provide a means to programmatically import and extract data. Standards involved include XML, Component Object Model (COM), EAI/HTTP transport model, Microsoft .NET, and other Web application services.

Enabling the data-transfer capability is a challenge primarily because:

The need for a good understanding of the MCF and the TT interfaces might be a hurdle to enabling autoticketing.

A customization of MOM is required to enable additional states for autoticketing. These states allow MCF to identify which alerts should be ticketed.

In more advanced implementations, the automation includes bidirectional response. In this case, not only does the alert trigger a ticket, but a ticket change can also trigger an alert update. The following are two examples of bidirectional response:

When a request has been successfully processed into the TT, the monitoring tool’s alert status is updated, and the ticket number is appended onto the alert record.

When a request is changed to a resolved or closed state, the alert is also automatically changed to resolved or closed.

Data-Transfer Management

Managing the data-transfer capability is a challenge primarily because:

MCF is a pull-based model instead of a push-based or event-driven model, which means the timing needs to be managed.

The throttling of the data transfer needs to be managed because of the alert volume on the server running MOM, the processing capacity of the TT system, and interactions with other connectors.

Transport of data between MOM and TT is asynchronous in order to be nonblocking. This means that the state of the autoticket workflow needs to be constantly checked in order to determine if the TT application is available to receive additional requests.

An error-handling mechanism is needed to handle failed attempts at autoticketing an alert. This can also trigger a retry.

Autoticket Architecture

Autoticket architecture refers to the component layers that make up autoticketing and the autoticketing workflow process.

Component Layers

As Figure 2 shows, autoticketing has three main layers.  

Application layer. Contains MOM, the TT application, and configuration management applications.

Event integration layer. Enables communication between the applications.

Business logic layer. Contains the rules for manipulating and resolving data elements between applications and handling failure conditions in the autoticket workflow.

Figure 2. Main components of autoticketing

Figure 2. Main components of autoticketing

Application Layer

The application layer provides the source and target data used for autoticketing. Through this layer, users are able to interface with the following functionality:

MOM 2005. This provides enterprise monitoring and contains alert data used for autoticketing. Alert generations form the trigger for automated ticket creation. Sample data items from MOM include Alert Source and Alert Time Raised.

Inventory Management and Asset Management. These applications, as well as other systems that make up the configuration management database (CMDB), house domain-specific data needed to complete a trouble ticket. This information would not be contained in an alert, however important for support personnel receiving the ticket. Sample data items from these systems include Priority and System Location.

Trouble Ticketing. This system coordinates and manages activities and workloads for support teams in IT operations. Sample data items from TT include Contact Name and Activity (to fix the failure) Description.

Event Integration Layer

The event integration layer is an abstraction of all communications between the applications. This layer includes the collection of alerts, the updating of state, and the insertion into the TT system.

Business Logic Layer

The business logic layer provides the core intelligence for autoticketing. The functions of this layer can be characterized as follows:

Multisourcing. There is not enough data in the MOM alert to populate a complete ticket. The data might exist in another system and must be extracted and included into the overall data normalization.

Data transform. Data received from a source application does not comply with the formatting or type of the target application. It is important to resolve the data-transform discrepancies before the data is usable. Examples include time formats, time-zone formats, and fixed integer value versus autoincrementing (for example, UniqueID).

Mapping relationships. Data received from a source application must be mapped to its corresponding fields on the target application. This might require some parsing of the source data. An example is Source: ”Redmond, WA” to Destination: ”City-Redmond” and Destination: “State-WA.”

Weighting. Data values may need to be inflated or deflated according to the business rules that drive the autoticket workflow.

Workflow results. The autoticket workflow can have internally determined data values driven by the workflow logic. For example, assigning the ticket to a particular staff member might be a result of a combination of data values including alert received, system in question, staff location, and staff skill set.

Derived values.The autoticket system may have a predetermined set of standard or default values that are directly used in the source or destination application. For example, the TT field “Ticket Created By “ can be populated with “AutoTicket Service.”

Autoticketing Workflow

When MOM is used as the SMC tool, it provides monitoring capabilities for the health conditions of servers and network devices. In the most common scenario, alerts are created by rules that reside in the MOM agent on each managed node. Based on the triggering of a rule, the different attributes of the alert are raised, such as alert name and resolution state. These alerts are often intended to give proactive notice on potentially harmful situations.

Operators who use the MOM 2005 Operator console are able to view the alerts and, when necessary, can manually create a trouble ticket. In this example, problem management and its resources in the Operating Quadrant roles receive the ticket and work toward issue resolution, while continuously tracking progress and information in the ticket.

In many cases, no human discretion is needed to determine whether the alert requires a ticket to be generated. These alerts should be automatically ticketed. The rule that creates the alert should be configured to prepopulate the alert’s resolution state to “AutoTicket.”

Subsequent sections provide functional and technical guidance on the the autoticketing workflow as shown in Figure 3.

Figure 3. Autoticketing workflow

Figure 3. Autoticketing workflow
See full-sized image

The workflow shown in Figure 3 consists of the following actions:

1.

Retrieve alerts from MOM. Using MCF, collect alerts with resolution state set to “AutoTicket.”

2.

Apply filtering. Use this business logic to check if the alert meets specific criteria and matches other system conditions. This helps determine if the autoticket workflow should continue to the next step.

3.

Update state to “Pending.” Use MCF for setting the state to “Pending” instead of its default “New.”

4.

Apply business logic. Use the predetermined business logic to resolve data issues, so that the ticket information is complete.

5.

Create ticket. Use the connection on the TT system to create a new ticket.

6.

Update attributes in MOM. On successful creation of the ticket, update the attributes in MOM.

7.

Call AckData method for all alerts retrieved. Acknowledge the alert after the workflow is completed.

The following chapter discusses the processes and activities necessary for creating autoticketing.

Processes and Activities

This chapter illustrates what processes must be completed to prepare the environment for autoticketing—namely, assessing MOM 2005 and the Trouble Ticketing (TT) environment, and developing the communications, filtering logic, and business logic behind autoticketing. Next, it defines the activities behind implementing autoticketing and conducting run-time monitoring. In other words, the sections are organized according to user processes and activities—based on the sequence of what the user must do to create autoticketing—followed by the steps that MOM takes once it is implemented (as just depicted in the seven steps of the autoticketing workflow).

When implementing MOM autoticketing, organizations should adhere to the Microsoft Solutions Framework (MSF) life cycle and project-focused guidance. MSF provides a flexible and scalable framework for planning, building, and deploying business-driven solutions. More specifically, the MSF Process Model—with its Envisioning, Planning, Developing, Stabilizing, and Deploying Phases—should be applied to the implementation process.

Autoticketing also requires close coordination with other SMC activities. These activities include the six core processes that an IT organization follows to fully adopt SMC. These processes, as they relate to the MOM environment, are shown in Figure 4. The figure also shows how these SMC activities directly relate to the activities involved in implementing autoticketing.

Figure 4. Six core processes as they relate to the MOM environment

Figure 4. Six core processes as they relate to the MOM environment
See full-sized image

Again, you should be familiar with the MOF Service Monitoring and Control SMF (which describes these six core processes) and with the guidance related to it. Further information is available at http://www.microsoft.com/technet/itsolutions/cits/mo/smf/smfsmc.mspx.

Assess MOM and Ticketing Environment

In this initial phase, pertinent information is collected and organized. Specific mappings and data identification might need to be performed in order to prepare for the implementation.

Define Taxonomy

It is important to organize a taxonomy for autoticket values. This taxonomy helps to identify all the key pieces of information necessary and also serves to clarify duplicates, attribute overloading, and misuse.

Tables 2 and 3 are examples of generic attributes for alerts and trouble tickets, respectively. These are shown for illustration purposes only; they are by no means comprehensive or authoritative.

Table 2. Generic Alert Attributes

AttributeDescription

Repeat Count

Derived based on number of occurrences for the same alerts.

Alert Name

Descriptive name of the alert raised by an alert rule.

DeviceID

Unique identifier for the device or computer that failed.

Device

Name of the server or network device in the alert.

Device Domain

Domain of the device.

Description

Alert description.

Alert Severity

Severity level of the alert as defined in its rules.

Owner

E-mail alias of the operational staff with responsibility for the immediate condition. Initial value can be set through a rule.

Alert Source

Component that generated the alert.

Alert Time Raised

When alert was first raised.

Alert Time of First Event

When first event was detected.

Alert Time of Last Event

When the latest event was detected.

IP Address

Essential data for networking alert.

Alert Resolved By

Person or system that changed the alert state.

Table 3. Generic Trouble Ticketing Attributes

AttributeDescription

Ticket #

Unique identifier for the incident or service request

Title

Name of the trouble ticket or heading

Device Name

Name of affected infrastructure

DeviceID

Unique identifier for the device or computer that failed

Customer Number

Customer or organization with principal interest

Ticket Body

Text in the trouble ticket describing the condition

Ticket Abstract

Short text in the trouble ticket describing the condition

Area

Label for the logical group the ticket belongs to

Sub Area

Subgrouping for the logical organization

Source

Component that failed

Contact Name

Service-desk contact

Contact Detail

Link to information such as phone number, e-mail, and location

Severity

Severity of trouble ticket

Creation Time

Date and time when the trouble ticket was created

Updated Time

Date and time stamp for all updates

State

Current state of the trouble ticket

Activity ID

Unique identifier for the activity associated with the trouble ticket

Activity Name

Activity title

Activity Description

Activity details

Activity Owner

Personnel assigned to execute or manage activity

Parent Ticket#

Identifier for the parent trouble ticket (can only be one)

Peer Ticket#

Identifier for any associated trouble ticket (can be multiple)

Priority

Priority rating of this trouble ticket

Identify Authoritative Source

Once the taxonomy has been created, identify the authoritative source for the information. This source holds the most accurate and updated copy of that attribute. Table 4 lists generic alert attributes, MOM alert attributes, and the authoritative source.

Table 4. Alert Attributes and the Authoritative Source

Generic Alert AttributeAdditionalMOM Alert AttributeAuthoritative Source

 

 

AlertID

MOM

Device Domain

 

ComputerDomain

MOM

DeviceID

 

ComputerID

MOM

Device

 

ComputerName

MOM

 

 

LastTimeStateModified

MOM

 

 

ModifiedBy

MOM

Alert Name

 

Name

MOM

Owner

 

OwnerName

MOM

 

 

ProblemState

MOM

Repeat Count

 

RepeatCount

MOM

 

 

ResolutionState

MOM

Alert Resolved By

 

ResolvedBy

TT System

 

 

RuleID

MOM

 

 

ServerRole

MOM

 

 

ServerRoleInstance

MOM

Alert Severity

 

Severity

MOM

Alert Source

 

Source

MOM

 

 

SubgroupRole

MOM

 

 

SubgroupRoleInstance

MOM

 

 

TicketID

TT System

 

 

TimeAdded

MOM

 

 

TimeLastModified

MOM

Alert Time of First Event

 

TimeOfFirstEvent

MOM

Alert Time of Last Event

 

TimeOfLastEvent

MOM

Alert Time Raised

 

TimeRaised

MOM

IP

 

CustomField1

MOM

Priority

 

CustomField2

MOM

Team

 

CustomField3

MOM

 

 

CustomField4

MOM

 

 

CustomField5

MOM

Description

 

Description

MOM

Map Attributes

Once the taxonomy and authoritative source have been identified, a full mapping can be created. Table 5 illustrates a sample of map attributes.

Table 5. Map Attributes

MOM Alert AttributeAuthoritative SourceSiebel TT AttributeAuthoritative Source

AlertID

MOM

 

 

ComputerDomain

MOM

 

 

ComputerID

MOM

DeviceID

MOM

ComputerName

MOM

Device Name

MOM

LastTimeStateModified

MOM

 

 

ModifiedBy

MOM

 

 

Name

MOM

Title

MOM

OwnerName

MOM

 

 

ProblemState

MOM

 

 

RepeatCount

MOM

 

 

ResolutionState

MOM

 

 

 

 

Contact Name

Siebel

RuleID

MOM

 

 

ServerRole

MOM

 

 

ServerRoleInstance

MOM

 

 

Severity

Logic

Severity

Logic

Source

MOM

Source

 

SubgroupRole

MOM

 

 

SubgroupRoleInstance

MOM

 

 

TicketID

Siebel

Ticket #

Siebel

TimeAdded

MOM

Creation Time

 

TimeLastModified

MOM

 

 

TimeOfFirstEvent

MOM

 

 

TimeOfLastEvent

MOM

Updated Time

 

TimeRaised

MOM

 

 

Description

MOM

Ticket Body

 

 

 

Ticket Abstract

 

 

 

ActivityID

Siebel

 

 

Activity Name

Siebel

 

 

Activity Description

Siebel

ResolvedBy

Siebel

Activity Owner

Siebel

 

 

State

Siebel

 

 

Parent Ticket#

Siebel

 

 

Peer Ticket#

Siebel

 

 

Area

CMDB

 

 

Sub Area

CMDB

 

 

Contact Detail

CMDB

 

 

Customer Number

CMDB

 

 

Priority

Logic

Develop Alert-Filtering and Business Logic

The next process in assessing MOM and the ticketing environment is developing alert-filtering logic and business logic (of which alert-filtering logic is a subset). Business logic is necessary to resolve data issues as well as to provide algorithms to the autoticketing workflow. Business logic physically can reside either in the connector itself or within a standalone service.

Alert-Filtering Logic

Alert-filtering logic contains all the business rules that determine which alerts should be processed in autoticketing. The filtering logic is enforced through the use of a state table, which determines the action that should be taken on the alert based on the following criteria:

1.

What is the resolution state of the alert?

2.

Is the alert known? (Does it already exist?)

3.

What is the status of the alert?

4.

If the same alertID already exists, was that alert returned in the same GetData result set?

The business logic for numbers 1-3 is maintained in a state table. Number 4 is enforced through backend code only and will not be data-driven like numbers 1-3.

The state table contains all possible combinations to the answers of questions 1-3 and also contains the appropriate action that should be taken as a result of each possible alert state. When the MOM Connector Framework (MCF) returns data as part of an update, pre-established business logic has to be applied to determine which changes to a particular attribute or state warrant an autoticket generation or change. For example, in MOM 2005, MCF now exposes the ProblemState attribute. This attribute is part of the State Monitoring capability and reveals whether the alert is no longer a problem (whether it has been corrected at the source). Alert-filtering business logic can evaluate this change and choose to process it into the workflow for reflection onto the ticket.

Table 6 shows what values are possible within the state table and explains what these values mean.

Table 6. Valid Values Within the State Table

TermValid ValuesExplanation/Valid Values

Resolution State

New

AutoTicket

Pending

AutoSuccess

AutoFailed

Acknowledged

Resolved

This indicates the resolution state of the alert that is returned by the GetData result set.

MCF Product Connector Status

Pending

This implies that the alert was received as part of a GetData result set, but that for some reason the attempt to create the ticket could not be made.

MCF Product Connector Status

Ticketed

This internal state status implies that a ticket was successfully created in the TT system for this alert; however, for some reason the proper status (MCF ack) was not updated to MOM, so the alert is presented again.

Action

Process

The alert should be processed according to the business rules defined in the current product connector thread.

Action

Continue

Processing of the alert should continue wherever the previous processing of that alert left off.

Action

Ack

This alert should not be processed. Call AckData for this alert, and discontinue any processing of it.

Action

Not Possible

An action for this alert state cannot be determined because this alert state cannot exist.

Business Logic

Business-logic rules are used in taxonomy resolution to help resolve data items. Perhaps the best way to describe this is through sample scenarios.

Scenario 1: Ticket Date

MOM stores the alert date using the datetime SQL type. When exposed using MCF, the format can be very different from what is used in the TT system. A Siebel service request (SR) uses a date and time format of “05/14/04 04:22:05 PM” whereas other TT systems use the format “16:22:05 Friday May 14, 2004”.  

Business logic provides a Transform capability and resolves the formatting prior to insertion into the TT system.

Scenario 2: Priority Weighting

In MOM, an alert has seven default severity levels defined, as shown in Table 7.

Table 7. MOM Default Severity Levels

Severity Levels

1 ?10 Success

2 ?20 Information

3 ?30 Warning

4 ?40 Error

5 ?50 Critical Error

6 ?60 Security Issue

7 ?70 Service Unavailable

A Trouble Ticketing system such as Siebel Call Center© has six default severity levels defined, as shown in Table 8.

Table 8. Siebel Call Center Default Severity Levels

Siebel Call Center SR Severity Levels

1 ?Critical

2 ?High

3 ?Medium

4 ?Low

5 ?Question

6 ?Unspecified

Immediately, the data challenge of Transform becomes apparent. How do the severity values of MOM resolve to the severity values that should be used for the ticket? The levels are almost inverted, and there is an additional level from MOM. The business logic has to resolve this relationship using a customized inverse relationship and rules regarding the lower severity (by description) values.

Assume, at this point, that a ticket is created containing the appropriate severity value.

The problem arises when the ticket recipient needs to rank which ticket to address first (in order to sequence or schedule repair activities.) The ticket recipient is unable to do this because the ticket is incomplete. Although the severity has been identified, the severity and priority are unknown. Therefore, the ticket recipient will need to investigate and obtain the necessary priority information in the CMDB, which is typically composed of systems including inventory and asset management.   

Specifically, the ticket recipient will need to manually obtain the information shown in Table 9.

Table 9. Information That the Ticket Recipient Must Obtain

Configuration Management –Line-of-Business (LOB) Priority

1(Highest) to 5(Lowest)

An LOB priority is assigned to an application defined in configuration management. In a hospital, the LOB prioritization for the trauma care unit’s applications is usually higher than for the radiology unit’s.

Note   This application is assigned to a server defined in inventory management. Since there may be more than one application assigned to a server, a server’s LOB priority is considered to be the highest value (lowest LOB Priority #) of all applications active on the server.

Configuration Management –Level-of-Service (LOS) Priority

1(Highest) to 5(Lowest)

An LOS priority is assigned to an application defined in configuration management. In a hospital, the LOS prioritization for a Magnetic Resonance Imaging (MRI) Calibration application is usually higher than a Monthly Reports Generator application.

Note   This application is assigned to a server defined in inventory management. Since there may be more than one application assigned to a server, a server’s LOS priority is considered to be the highest value (lowest LOS Priority #) of all applications active on the server.

Configuration Management –Rule Priority

1(Highest) to 5(Lowest)

A rule priority is assigned to specific rules (or rule groups). These are defined in the service level agreement (SLA), but are stored in configuration management. A rule for a security breach may have higher priority than a rule for low disk space.

Configuration Management –Service Level Agreements (SLAs)

Guiding rules for LOS and LOB.

The SLA defines additional details about each prioritization and the treatments associated with each score. This is needed to reflect additional factors such as time of day.

To improve future autoticketing, multisourcing should be employed to collect this data from the CMDB applications.

However, having the data is not enough to use it in an automated way. The Siebel SR only has one Priority field. How do the four data points converge into one? This is where priority weighting is used.

The IT organization establishes a formula that the business units agree upon in order to normalize the data set. It has been agreed that a weighted average of all priorities should be used to compute a final value.

The formula is as follows:

((LOB Priority * SLA Weight for LOB) + (LOS Priority * SLA Weight for LOS) + Rule Priority)/3

The severity values were transformed, the multisourced priority data receives business rules for weighting, and the final value is mapped to the appropriate Siebel SR field. Future autoticket cycles will now have more complete information.

Scenario 3: Ticket Queue

An enterprise typically has multiple ticket-recipient targets. For example, there may be a separate team at each key data center to handle failures at those locations. Using mapping-relationships and workflow-results business logic, data from configuration management can be used to populate TT attributes in order to designate a particular ticket queue.

Alert CMDB Business Logic Trouble Ticketing

ComputerName=

seaexchmb04

+

Seattle Data Center 01: seaexchmb01 – mb08

+

Seattle Data Center 01 --> Area=SEADC

=

Area=SEADC Seattle Data Center Team

Implement Autoticketing

After assessing MOM and the ticketing environment, the second phase of establishing autoticketing begins, namely, the actual development and implementation of the communications and workflow activities performed during autoticketing. This section gives detailed guidance on the activities within the second phase.

Extend MOM Resolution States

The autoticket design described throughout this guide is dependent on an upstream process that identifies the alerts to be autoticketed. The result of this process is that all alerts that should be autoticketed arrive in the MOM top-tier database with a predetermined resolution state, such as 5 = AutoTicket.

MOM 2005 implementations undergoing preparation for autoticketing should extend the resolution state definitions to include those shown in Table 10.

Table 10. Extending Resolution State Definitions

IDName (ResolutionState)Interaction

0

New*

System only

5

Auto Ticket

System only

99

Pending

System only

105

Auto Success

System only

205

Auto Failed

System only

85

Acknowledge

User and System

255

Resolved*

User and System

*- Locked

Develop MCF Connector

As stated previously, the MOM Connector Framework (MCF) is a Web service–based framework for connecting MOM and any third-party management platform. It enables full bidirectional alert forwarding and synchronization, including alert clear-downs between management tools. These capabilities provide increased management benefits to both medium and large enterprises.

MCF is a class library used to connect an external system to the MOM database. External systems can only access MCF through product connectors, which are the system interfaces with MOM through which data and objects can be accessed. This guide uses autoticketing as one example of a product-connector function.

Note   This guide provides an idea of what can be done with an MCF product connector. However, detailed information on how to develop a product connector is beyond the scope of this document. That information is contained in the MOM 2005 documentation.

Retrieve Alerts from MOM

The first step in the autoticketing workflow is to retrieve alerts from MOM. The GetData method is an MCF Web service method used for retrieving these alerts. It uses the registration ID associated with the specific product connector (such as the product connector for AutoTicket) as a parameter when requesting alerts with the resolution state of AutoTicket. The GetData method is called at regular time intervals (approximately every 30 seconds).

Although the interval timing for the GetData method is configurable, it is assumed that the autoticketing system will not make GetData method calls more frequently than what the TT system can handle. (For example, it can be set for an interval of every 20 seconds.) In addition, it is assumed that autoticketing will not request too many alerts with each GetData method call. (For example, the request size can be limited to a maximum of 20 alerts.)

If any method call to MCF fails, the service-requestor service should pause. Table 11 gives the workflow rules, dependencies, and error conditions associated with GetData.

Table 11. The GetData Method

Object Type

GetData MCF Web service method

Description

This method call should return the following alerts:

GetData method call to include both NEWALERTS and UPDATEDALERTS:

GetData(NEWALERTS) returns alerts with an Alert.ResolutionState = AutoTicket (ID = 5)

GetData(UPDATEDALERTS) returns the current state of an alert if it was given to the product connector before and changed at a later point—in other words, if the alert was previously returned in a GetData(NEWALERTS) result set.

Workflow Rules

TIMING:

Preliminary Interval Time = 30 seconds

This timing may be reduced as allowed by system performance.

PARAMETERS:

REGISTRATIONID- This value should be the same value received from the MCF SETUP method when initializing a product connection for the AutoTicket resolution state.

DATACHANGEFLAGS- Value = NEWALERTS, UPDATEDALERTS

MAXCOUNT- Preliminary Value of 20

This parameter determines the maximum number of alerts returned by the GetData method.

Example: If there are 50 alerts in the MOM database with alert.ResolutionState of 5 and a GetData call is made with a MAXCOUNT parameter of 10, only 10 alerts will be returned.

Dependency

The GetData method should run at the time interval described. Even if the time interval has been reached, the GetData method should not be called if the previous batch of autoticket alerts is still being processed.

Error Conditions

Once an alert is passed as part of a GetData result set, that alert is passed as part of the GetData result set for all subsequent GetData calls associated to the alert’s original RegistrationID. This occurs until the AckData method is called for that alert.

Retrieving alert data from MOM using the GetData method returns various attributes. The complete list of attributes is contained in the MOM 2005 documentation.

Apply Filtering

The second workflow activity is to apply the filtering-logic rules developed earlier. Further information is contained in “Develop Alert-Filtering and Business Logic,” earlier in this document.

Update State to “Pending”

When an alert is returned through MCF as part of a GetData result set, the MOM application automatically updates the OnePoint.Alert.ResolutionState to “New.” This resolution state sends a confusing message to users of the MOM Operator console, so the third step in the autoticketing workflow is to change the Alert.ResolutionState to “Pending.”

Table 12 identifies the workflow rules, dependencies, and error conditions associated with UpdateAlerts.

Table 12. The UpdateAlerts Method

Object Type

UpdateAlerts MCF Web service method

Description

UpdateAlerts is used by the autoticketing system to update one or many attributes of one or many alerts in a single method call. In this particular phase, the UpdateAlerts method is used to update the OnePoint.Alert.ResolutionState to “Pending.”

Workflow Rules

TIMING:

The UpdateAlerts method should be called after the alert is retrieved from MCF and after the filtering logic is applied to the alert.

PARAMETERS:

REGISTRATIONID- The same registrationID GUID that was used in the GetData call should be used for this UpdateAlerts call.

This registrationID must be used in subsequent UpdateAlerts and AckData method calls by that process thread.

ALERTID- The alertID GUID for each alert to be updated

RESOLUTIONSTATE- The resolution state ID that is associated to the “Pending” resolution state (99).

Dependency

The UpdateAlerts method should be used to update the resolution state to “Pending” for all alerts to be further processed after the alert filtering processes is complete.

Error Conditions

If the UpdateAlerts fails, the following message is returned:

        <FailedUpdatedAlerts>

          <guid>guid</guid>

          <guid>guid</guid>

        </FailedUpdatedAlerts>

Apply Business Logic

After updating the MOM state to “Pending,” the fourth workflow activity is to apply the business logic that was developed earlier. Further information is contained in “Develop Alert-Filtering and Business Logic,” earlier in this document.

Create Ticket

The fifth step is to create the ticket. Details for this activity will vary according to the particular TT system being used. Accordingly, specific information cannot be provided here.

Update Attributes in MOM

After the ticket has been created, the sixth step is to update the attributes in the MOM alert to reflect the new state and other new information. This update is accomplished using the UpdateAlerts method. Table 13 identifites the workflow rules, dependencies, and error conditions associated with UpdateAlerts.

Table 13. The UpdateAlerts Method

Object Type

UpdateAlerts MCF Web service method

Description

UpdateAlerts is used by the autoticket system to update any alert attributes. In this particular point in the process, the alert’s ResolutionState and TicketID fields in MOM are updated.

Workflow Rules

TIMING:

This UpdateAlerts method call should occur after autoticketing has communicated with the TT system, and after the results of that session are communicated.

PARAMETERS:

REGISTRATIONID- The same registrationID GUID that was used in the GetData call on this alert should be used for all UpdateAlerts calls.

ALERTID- The alert ID GUID for each alert to be updated

ALERT.RESOLUTIONSTATE

If the ticket creation succeeded, indicated by the TT system returning a ticket number:

Update Alert.ResolutionState (in MOM) =105 (“Auto Success”)

If the ticket creation failed:

Update Alert.ResolutionState (in MOM) =205 (“Auto Failed”)

ALERT.TICKETID (used for ticket number)

If the ticket creation succeeded, indicated by the TT system returning a ticket number:

Ticket number (returned inside of the TT system return string; typically in XML)

If the ticket creation failed:

Send a friendly error message giving the information that follows in this table.

Dependency

A MOM rule should be created that generates an alert when the Windows Event that follows in this table is created.

Error Conditions

If the UpdateAlerts method fails, the autoticket process should retry twice.

If the UpdateAlerts call fails all three times, the autoticket system should create a Windows Event. This event will be identified by a MOM rule and will be forwarded to the MOM Operator console for visibility.

Call AckData Method for All Alerts Retrieved

After the ticket has been successfully created, and the MOM alert properties have been updated, the seventh and last activity is to set the alert to MCF Acknowledged (not Alert Resolution State). This is perfomed by the AckData method. Table 14 identifies the workflow rules, dependencies, and error conditions associated with AckData.

Table 14. The AckData Method

Object Type

AckData MCF Web service method

Description

AckData is used by the autoticketing system to acknowledge the alerts that have completed the process for autoticketing or creating a ticket. Once an alert has had the AckData method called on it by the AutoTicket Connector, it will not be reprocessed by MCF and the workflow.

Workflow Rules

TIMING:

The AckData method should be called directly after the process thread for autoticketing or for creating a ticket successfully completes the UpdateAlerts call in the previous step.

PARAMETERS:

REGISTRATIONID- The same registrationID GUID that was used in the GetData call should be used for this AckData call.

Note   Once an alert is returned with a GetData result set, the same registrationID GUID that was used with the initial GetData call must be used with all subsequent MCF calls that update or “Ack” that alert. An alert is tied to the same registrationID GUID for its lifetime.

ACKID- The GUID ID value for the alert on which AckData will be called.

The alert should have the AckData method called on it only after the process for autoticketing and creating a ticket is complete and after the Alert.ResolutionState and TicketID have been updated with the appropriate information.

Dependency

Dependent on the UpdateAlerts method call that updates the resolution state and adds the ticket number or failure reason to custom field.

Error Conditions

If the UpdateAlerts method fails, the autoticket process should retry twice.

If the UpdateAlerts call fails all three times, the autoticketing system should create a Windows Event. This event will be identified by a MOM rule and will be forwarded to the MOM Operator console for visibility.

Develop TT Connector

The specific connector for your TT system should be developed in order to transport data to and from the system. This example illustrates the construction of a connector for Siebel.

Background

The Siebel Web Engine will provide HTTP listening services and invoke a workflow process through a business service method. This workflow process will accept the incoming XML document and pass it through an integration object into the business object to update Siebel data. Use the following Siebel components:

The Siebel Web Engine

Workflow process

Business services

Note the following prerequisites:

The Enterprise Application Integration (EAI) component group must be enabled (as in Figure 5).

The Thin Client component group does not need to be running.

Figure 5. The Siebel Web Engine

Figure 5. The Siebel Web Engine

Setup Process

The setup process for developing the TT connector involves:

Creating the workflow.

Setting up the configuration files.

Envoking the workflow through a URL.

Creating a new LOV.

Create the Workflow

To create the workflow

1.

Log onto the Siebel client and navigate to Screens > Siebel Workflow Administration > Workflow Processes > All Processes (as shown in Figure 6).

2.

Create a workflow titled Microsoft Connector (the same name as the business service). Click the Process Properties tab, and add the following variables:

SR message with a type of hierarchy.

<Value> with a type of binary

3.

From the palette of Process Designer, add a start, two business services and an end (as shown in Figure 6).

4.

Edit the first business service and choose EAI XML Converter as the business service and XML Document to Integration Object Hierarchy as the method. Create a new input argument, choose XML Document, set the type to Process Property and choose <Value> as the property name. Create a new output argument and choose SR Message as the property name, with Output Argument as the type and Siebel Message as the output argument.

5.

Edit the second business service and choose EAI Siebel Adapter as the business service with Insert or Update as the method. Create a new input argument and choose Siebel Message as the input argument with Process Property as the type and Account Message as the property name. Add an output argument. Choose <Value>, designate the type to be Literal and add the following to the value:

<h1>Update Completed</h1>

Figure 6. Creating the workflow

Figure 6. Creating the workflow

Set Up the Configuration Files

To set up the configuration files

1.

Edit eai.cfg to include the following section:

[HTTP Services]

  SiebelMOM = SiebelMOM

[SiebelMOM]

  Mode = Document

  Service = Microsoft MOM

  Method = RunProcess

2.

Modify eapps.cfg to allow the inbound HTTP transport by adding EnableExtServiceOnly = TRUE for the EAI application.

Invoke the Workflow Through a URL

Invoke the workflow through a URL as given in the following example:

Note: Some of the lines in the following code have been displayed on multiple lines for better readability.

http://autoticketdemo.microsoft.com/eai_enu
/start.swe?SWEExtSource=SiebelMOM&SWEExtCmd=Execute
&UserName=SADMIN&Password=SADMIN&SWEExtData=
<?xml version="1.0" encoding="UTF-8"?>
<SiebelMessage MessageId="" MessageType=
"Integration Object" IntObjectName="Sample Service Request">
<ListOfSampleServiceRequest><ServiceRequest>
<SRNumber>SDC-100</SRNumber>
<CustomerRefNumber>4334d03c-323c-4787-8211-01ed033d3c3f
</CustomerRefNumber> <Organization>
Default Organization</Organization>
<Description> 
SIID: 4334d03c-323c-4787-8211-01ed033d3c3f
Description: Low disk space detectedIP: 
172.20.87.30;100.100.100.100User: adminPostToQueue:
1Status: Waiting</Description>
<Abstract>Low disk space detected</Abstract>
<ServiceRequestType>Internal</ServiceRequestType>
<Area>IT</Area><Sub-Area>Hardware Break
/Fix</Sub-Area> <Source>Web</Source>
<ContactCreated>06/09/2003 04:22:05 PM<
/ContactCreated> 
<ContactLastName>Doe</ContactLastName>
<ContactFirstName>John</ContactFirstName>
</ServiceRequest></ListOfSampleServiceRequest
></SiebelMessage>

This will insert a new account called “SDC-100” in the “All Service Requests across Organizations – HelpDesk” view.

The URL is the key for activating the SWE. It has multiple sections:

http://<Web_Server>/eai/start.swe?SWEExtSource=<SourceName>&SWEExtCmd=<Execute>&UserName=
<UserName>&Password=<Password>&SWEExtData=<Some_Data>

The parameter, eai, specifies the actual location and section within the eapps.cfg to execute.

The start.swe is the part of the URL that wakes up SWE.

The next input values build the rest of the URL.

The parameter, SWEExtSource, specifies which section within the eai.cfg [HTTP] section to execute.

The second parameter section specifies the logon to execute.

The third and last section specifies the data to send. The <SourceName> is wf in this example and <Some_Data> is the actual XML that is passed.

Create a New LOV

Type = SR_SOURCE

Display Value = Microsoft Operations Manager 2005

Invoke Service Example

The following script listing combines the background and setup information into a sample trouble-ticket creation.

Note: Some of the lines in the following code have been displayed on multiple lines for better readability.

‘-------------------------------------------------
----------------------------------------------------
-------------------------
' CHANGES TO BE MADE BELOW FOR APPROPRIATE SR NUMBER 
GENERATING
strSIShortID = SDCFindSIShortID( pGuid )
If  strSIShortID = "" Then
  strSIShortID = left( pGuid, 8 )
End If
strSRNum = "SDC-" & strSIShortID
‘--------------------------------------------------
-----------------------------------------------------
-----------------------
' CHANGES TO BE MADE BELOW FOR APPROPRIATE INTEGRATION 
IMPLEMENTATION
strEAIHTTPServer = "CHANGE ME"
strEAIMethod = "SiebelActivator"
strRefNum = pGuid
strDesc = pDetails
strAbstract = pDesc
' NOTE: the following subroutines are coded to be reused
in the following context.  
' They rely on the global variables to be set correctly 
outside before being invoked.
' They may also modify the global variables to be used 
later. 
 Sub SDCOpenTicket
‘---------------------------------------------------
------------------------------------------------------
---------------------
' CHANGES TO BE MADE BELOW FOR APPROPRIATE EAI CONFIG
AND DATA MAPPING
  strEAIURL = "http://" & strEAIHTTPServer & 
"/eai_enu/start.swe?SWEExtSource=" & strEAIMethod& _
            
"&SWEExtCmd=Execute&UserName=SADMIN&Password
=SADMIN&SWEExtData=" & _
            "<?xml version=""1.0"" 
            encoding=""UTF-8""?>"
            & _        
            "<SiebelMessage MessageId="""" 
MessageType=""Integration Object"" IntObjectName=
""Sample Service Request"">" & _
            "<ListOfSampleServiceRequest
            >" & _
            "<ServiceRequest>" & _
            "<SRNumber>" & strSRNum
            & "</SRNumber>" & _
            "<CustomerRefNumber>" &
            strRefNum & "</CustomerRefNumber
            >" & _
            "<Organization>
            Default Organization</Organization
            >" & _
            "<Description>" & 
            pAS_Description & "</Description
            >" & _
            "<Abstract>" & pAS_Title 
            & "</Abstract>" & _
            "<ServiceRequestType>Internal
            </ServiceRequestType>" & _
            "<Area>" & pSR_Area &
            "</Area>" & _
            "<Sub-Area>" & pSR_SubArea 
            & "</Sub-Area>" & _
            "<Source>" & pSR_Source 
            & "</Source>" & _
            "<ContactCreated>
            06/09/2003 04:22:05 PM</ContactCreated
            >" & _
            "<ContactId>1-5YQ1<
            /ContactId>" & _
            "</ServiceRequest>" & _
            "</ListOfSampleServiceRequest>
            " & _
            "</SiebelMessage>"
  LogMessage( strEAIURL & vbcrlf)
  SDCSendHTTPReq "POST", "", strEAIURL
  SDCStoreCTSTicket pGuid, strSRNum , SEARCHKEY_SIEBEL, 
CTSTYPE_SIEBEL, pStatus
End Sub
Sub SDCCloseTicket
' ***********************************************************
****************
' CHANGES TO BE MADE BELOW FOR APPROPRIATE EAI CONFIGURATION 
AND DATA MAPPING
' ***********************************************************
****************
  strEAIURL = "http://" & strEAIHTTPServer & 
"/eai_enu/start.swe?SWEExtSource=" & strEAIMethod & _
            "&SWEExtCmd=Execute&UserName=
SADMIN&Password=SADMIN&SWEExtData=" & _
            "<?xml version=""1.0"" encoding=
            ""UTF-8""?>"  & _
                
            "<SiebelMessage MessageId="""" 
MessageType=""Integration Object"" IntObjectName=
""Sample Service Request"">" & _
            "<ListOfSampleServiceRequest>
" & _
            "<ServiceRequest>" & _
            "<SRNumber>" & strSRNum 
            & "</SRNumber>" & _
            "<Organization>Default Organization
            </Organization>" & _
            "<Status>Closed</Status>"
            & _
            "</ServiceRequest>" & _
            "</ListOfSampleServiceRequest>
            " & _
            "</SiebelMessage>"
  LogMessage( strEAIURL & vbcrlf)
  SDCSendHTTPReq "POST", "", strEAIURL
End Sub
Dim pID
pID = SDCFindCTSTicket( pGuid, SEARCHKEY_SIEBEL, 
CTSTYPE_SIEBEL )
‘------------------------------------------------------
---------------------------------------------------------
---------------
' To open new service request
If pPostToQueue = POSTTOQUEUE_OPEN Then
  If pID = "" Then
    LogMessage( vbtab & "... submitting new 
service request #" & strSRNum & " 
into Siebel ..." & vbcrlf )
    SDCOpenTicket
  Else
    LogMessage( vbtab & "... no new submission 
is needed since the SI has already been submitted into 
Siebel as " & pID & " ..." & vbcrlf )
  End If
‘----------------------------------------------------
-------------------------------------------------------
-------------------
' To close the associated service request
ElseIf pPostToQueue = POSTTOQUEUE_CLOSE Then
  If pID = "" Then
    LogMessage( vbtab & "... submitting new ticket
first since the SI has not been submitted into Siebel yet
..." & vbcrlf )
    SDCOpenTicket
  End If
  LogMessage( vbtab & "... closing Siebel service 
request #" & strSRNum & " ..." & vbcrlf )
  SDCCloseTicket
End If
LogMessage( "Script Ends!" & vbcrlf )
]]></SCRIPT>

Develop Error Handling

Table 15 summarizes the error-handling conditions that are part of the autoticketing process.

Table 15. Error-Handling Conditions

Failure PointBehavior

GetData Returns Failure

Retry until success, or until three consecutive failures. On third failure, create a Windows Event.

GetData Returns No Alerts

Take no action.

UpdateAlerts to Pending Returns Failure

Retry until success, or until three consecutive failures. On third failure, create a Windows Event.

IR Create Fails

Retry until success, or until three consecutive failures. On third failure, create a Windows Event.

Create IR Activity Fails

Retry until success, or until three consecutive failures. On third failure, create a Windows Event.

UpdateAlerts with Success or Failure Information

Retry until success, or until three consecutive failures. On third failure, create a Windows Event.

AckData Fails

Retry until success, or until three consecutive failures. On third failure, create a Windows Event.

If the TT system is down, the autoticketing workflow should consider this a failure event and pause the processing.

Similarly, if behaviors within the TT systems’ interfaces or MOM’s MCF indicate that the TT system is either down or not responding, this should be considered a failure. When this happens, the autoticketing workflow should create a Windows Event and send an automated e-mail message to a configurable alias. In addition, the entire workflow should pause for new requests. The autoticketing system will continue to attempt the failed method every 30-60 seconds until both the TT system and MOM/MCF are online.

Develop Thread Control

Autoticketing volumes should not exceed the capacity of the TT system. This is primarily a limitation based on the amount of time it takes most TT systems to create a ticket (or service request), which can be due to system capability, business-rule complexity and other external limitations. If the ticketing volume exceeds this number and a backlog occurs, it is recommended that the alerts be ticketed at a rate that is congruent to the performance of the workflow, such as one service request per three seconds, until the backlog is gone.

Thread Control Using Configurations

A distinct execution thread for the product connection cycles continuously over the life of the autoticket process. The autoticket thread represents a process to create a ticket and update the status of the alerts.

When writing an MCF or autoticketing system, the process thread should include the following configurable parameters:

Process Thread Cycle Interval. Defines how often the process within a process thread is to be executed (elapsed time based on the start of the previous execution of the thread). In cases where the previous process has not completed execution within the defined process thread-cycle interval, subsequent execution of the process should occur immediately upon completion of the previous process.

Maximum Process Thread GetData. Defines how many alert records should be retrieved for each call of the GetData MCF method.

Enable/Disable Process Thread. Defines the ability to disable the autoticket thread within the general autoticket process without loss of data.

Process Thread Priority. Defines the priority of a given process thread relative to other threads that might be running against a MOM Management Server.

Set Bookmark. Defines the ability to bookmark the current time, so that autoticketing does not process any alerts forwarded to the top tier before the bookmarked time.

If this attribute is set to 12/1/2003 8:00am, the MCF GetData method will only return the alerts that reached the MOM top-tier database after that time. This setting should be used primarily in emergency scenarios in which MOM is unable to manage the volume of alerts being created.

MCF Failure Retry Attempts. Defines how retries are handled. If the autoticketing system encounters a failure when attempting to submit an MCF method call, it will retry X times. Each retry will occur Y seconds apart. Both X and Y will be configurable.

Conduct Run-Time Monitoring

The third and final phase in establishing autoticketing is run-time monitoring. Autoticketing has been implemented and now needs to be monitored for its health. When operational, autoticketing is a function of the control process within the Service Monitoring and Control SMF.

The automation is triggered when an alert is received in MOM 2005 that matches specific autoticket criteria.  

At run time, all autoticket components should be checked, and error-handling events should be monitored. Figure 7 illustrates the interface components to this solution.

Figure 7. Interface components of autoticketing

Figure 7. Interface components of autoticketing
See full-sized image

Appendices

Appendix A: Resources

Overview of MOF and links to the SMFs, available at http://www.microsoft.com/technet/itsolutions/cits/mo/smf/smfsmc.mspx 

Service Monitoring and Control SMF, available athttp://www.microsoft.com/technet/itsolutions/cits/mo/smf/smfsmc.mspx

Appendix B: Key Performance Indicators

The following statistic should be reviewed to understand the performance of autoticketing as well as to identify opportunities for improvement. The value is mapped over predefined timeframes (such as daily, weekly, and monthly).

Actual Ticket Volume: ”AutoTicket” Alert. This is a key statistic that indicates performance of the filtering and business logic. The goal is to achieve a 1:1 ratio between alerts that qualify for autoticketing and those that successfully have a ticket created.


 

© 2006 Microsoft Corporation. All rights reserved. Terms of Use |Trademarks |Privacy Statement
Microsoft