ITIL V3 在 Event Management 和 Incident Management 有清楚的描述, V2 只有 Incident Management. Event 為事件, Incident 為事故. Event 主要來自網管系統, 無論是 HP OpenView 或 IBM Tivoli 都已經不是單純的網管系統, 可以加裝模組對應用系統加以監控, 在 ITIL V3 Service Operation 中對 Event Management 的功能描述, 和 HP OpenView 像極了, 讀起來很有親切感.

ITIL V3 對 Event Management 的定義為 :

The ability to detect events, make sense of them and determine the appropriate control action is provided by Event Management.

另外對 Monitoring 和 Event Management 的區別也做解釋, Monitoring 的範圍是大於 Event Management, 所以三者的關係為 Monitoring -> Event Management -> Incident Management.

Incident 在很多的標準規範中都有使用到, 包括 ISO20000, ISO27001, COBIT, ... etc. 希望大家能夠熟知, ITIL 對它的定義為:

An unplanned interruption to an IT service or reduction in the quality of an IT service. Failure of a configuration item that has not yet impacted service is also an incident, for example failure of one disk from a mirror set.

一般人常會搞不清楚的地方就是線上備用系統故障也算是一種事故, 雖然不會影響系統服務.

ITIL 對 Incident Management 的定義為 :

Incident Management is the process for dealing with all incidents; this can include failures, questions or queries reported by the users (usually via a telephone call to the Service Desk), by technical staff, or automatically detected and reported by event monitoring tools.

事故的來源不只是網管系統, 還有使用者, 服務台, 技術人員等方面.

Incident Management 的目的是必考題, 相信大家都會朗朗上口,

The primary goal of the Incident Management process is to restore normal service operation as quickly as possible and minimize the adverse impact on business operations, thus ensuring that the best possible levels of service quality
and availability are maintained.

Incident Management 的主要任務是儘速回覆服務, 不應該花太多時間在解決事故上, 留給 Problem Management 去傷腦筋.