Event Management - Categories

There are three event categories defined in the best practice of ITIL. Each type must be managed in a different way, but each type is relatively easy to understand.

The three types of event category are Informational, Warning and Exception.

Informational events are typically events within normal operating boundaries. They are the types of “good” events that tend to fill most IT Service Management tools. These events are typically an indication that something has worked as it should.

Warnings are an early indicator or potential indicator of trouble. However, we need to understand that a warning is a flag to something being “unusual”, not necessarily negative (e.g. someone logs in after 6 weeks of inactivity)

Exceptions are the most typical precursor to incidents, but they will not always lead to an incident (e.g. a CPU spikes above the set threshold as a power user starts a processing job). Exception events will generally be of interest to IT Operations staff as they may be a sign of more trouble to come.