The need for silent operations
There is an old proverb “Speech is silver, but silence is golden”. Considering how ‘noisy’ modern IT environments are, the proverb must really resonate well with ITOps teams. These days the noise is not just from alerts, but an endless stream of notifications, with dashboards and reports capturing humungous volumes of logs, events, and other data that drown out any important information within them.
But how did we get to this point?
To be honest, alert noise has always been a stumbling block for efficient ITOps. Every monitoring tool has been designed to get a real-time view of the technology component it monitors, which adds to the volume of alerts and metric data available. But modern architectures, leveraging microservices and hybrid cloud environments are more difficult to monitor, hence the market is shifting towards Observability tools which gather data, and generate alerts from not just metrics but also logs, traces and other data sources. While they are of great value to deep-dive into the behavior of technology components once an issue occurs, they also generate huge amounts of alerts which can be difficult to analyze. In environments where there are different monitoring/observability tools for different technology layers (applications, network, cloud, storage, databases and so on), the noise from redundant alerts can be ‘deafening’. Needless to say, modern ITOps teams yearn for ‘silent operations’ – where the alert noise is drowned out, to let the IT teams focus on the right issues.
Role of event management in modern IT landscape
To put it simply, every IT technology estate needs a solution that will face the streaming alert noise and announce, “You Shall Not Pass”.
That’s part of what Event Management solutions are designed to perform. Event management, a core capability of AIOps platforms, namely Digitate’s ignio™ AIOps , integrate with existing monitoring, ITOM and observability tools to gather all alerts getting generated across these products, then normalize, filter, suppress and aggerate alerts, and pass on only the genuine alerts to the right teams or trigger workflows for automated resolutions. Of course, that’s not all they do – they also help analyze, derive root-cause, and help resolve incidents faster, but we will cover more on that in our next blog.
The value of such a solution goes beyond just reducing the alert noise.
For instance, with event management, enterprises get a single place to observe and detect issues across every IT technology layer, free from noise and clutter. Unlike observability and ITSM tools which can only provide BI-type graphical analysis of events coming from other tools , event management also leverages AI-powered algorithms to accurately correlate, aggerate and provide deeper insights into the events and alerts,
Event management also leverages AI-powered algorithms that go beyond just ‘Business Intelligence-level data aggregations’ to provide an accurate snapshot of enterprise technology health. This includes not just infrastructure components, but also specific technologies such as batch jobs, ERP systems, cloud and so on. This approach simplifies full-stack observability effort and helps organizations deliver more value from existing monitoring investments.
With AI-powered event management, enterprises can also leverage advanced techniques to spot, triage and resolve genuine incidents, improving operational metrics such as Mean-time-to-Detect (MTTD), Mean-time-to-Resolve (MTTR) and Mean-time-to-Triage (MTTT).
Overall event management solutions help the enterprise improve their operational IT resilience.
Get AI on your side to elevate event management
Most event management platforms provide the ability to suppress irrelevant alerts, and correlate or group related alerts. But most event management platforms rely on a set of configured rules to leverage the tacit knowledge of the ITOps team to filter false alerts- an approach that is fast becoming obsolete as it cannot match up to the dynamic nature of IT environments.
That’s why you need AI on your side to successfully navigate today’s dynamic environment.
Modern event management solutions such as ignio™ leverage an ‘AI/ML Backbone’ to complement tacit knowledge-based rules, and provide a comprehensive solution for reducing alert noise, triaging and resolving events.
For instance, ignio can leverage understanding of normal behavior; and trends and patterns to set AI-based dynamic thresholds that help adapt event definitions to the dynamic nature of operations.
It augments this information with readily configurable rules for maintenance windows, duplicate events, and a host of other conditions that help to filter out every irrelevant alert.
Next it leverages patented AI/ML models to correlate and aggregate related alerts. Unlike most other event management tools which use rule-based correlation, ignio can perform Case-based reasoning ( for example, understanding if event A happens then there is 90% chance event B will happen) using historical occurrences, frequencies and relationships. ignio also has the unique capability to perform Model-based reasoning ( for example, understanding how events A and B are linked), by using situational data and technology models to understand relationships and dependencies.
Our blog on different reasoning techniques helps understand these capabilities in more detail.
Adaptive event management- Digitate’s unique approach
In the previous section we talked about rules-based reasoning and how event management tools leverage tacit team knowledge to create rules for alert suppression. While rule-based suppression is a necessity, it is also difficult to create as traditionally ITOps teams need to manually create an extensive number of rules to describe the various types of events that need to be suppressed. Managing these numerous rules is also a challenging task as huge number of rules make it difficult to decipher them later, and all alerts which match a specific rule are usually automatically suppressed, which may not be the right outcome in a changing environment.
That is why, with our recent Flamingo release, ignio now supports Adaptive Noise Reduction to systematically reduce alert noise with AI-based rule mining.
With this feature, there is no longer a need for ITOps teams to provide rules for suppression patterns, as ignio can automatically mine suppression patterns from the work notes of past events, using AI-based algorithms and semantic search. It can also identify ‘aged events’ which do not need a resolution.
Once the AI-based algorithms detect and understand the cause of irrelevant incidents, it can automatically create suppression rules using association rule-mining and present this to ITOps experts along with confidence levels (low, medium, and high).
So, all ITOps experts now need to do is approve the right suppression rules, after which ignio will enable auto-suppression of irrelevant events, if they match user accepted rules.
Leveraging AI to create rules drastically reduces the time and effort required to achieve optimum suppression. It can also continuously keep mining and creating rules for additional suppression opportunities, ensuring you keep reducing alert noise over time, no matter how the IT enterprise evolves or how complex it gets. This ensures you have a future-ready platform to enable operational resilience.
Don’t stop there: Automate to reduce incidents
Reducing alert noise and providing genuine alerts to the right teams is only half the battle won. Best-in-class event management solutions also leverage AI and automation to resolve incidents, self-heal common issues, and even predict and prevent events before they happen.
Our next blog covers events, incident response, and resolution and how these capabilities are enhanced by our recent Flamingo release. Stay tuned!
