Keep up-to-date with ITIL news. Low volume to-the-point bulletins...
ITIL in Practice from
ITIL Incident Management, question and answer
One of the ITILnews community have sent in the following question:
"When monitoring both the components and services, duplicate events can potentially be generated for the same fault - one for the component and one for the service. What is the best practice approach to this situation? Do you have both events create an incident and relate the component incident to the 'parent' service incident, or just create a component incident, or just create a service incident?"
In my experience, one needs to examine the value of raising two incidents in relation to one incident.
I would suggest an incident is raised for a failing component, which initially may be seen as the 'cause' of the incident, the subsequent 'effect' of the failing component may result in an impact upon the availability and/or performance of the Service, which from a Service Level Management perspective will no doubt need to be reported against and reviewed in detail prior to a weekly or monthly Service Review Meeting.
The impact of the failing component upon the service will no doubt reflect in the priority and the severity of the incident in question.
If a component was duplexed for example, where the work load was shared across two components and one of the components failed resulting in the second component undertaking the full work load, seamlessly and without interruption to the Service would an incident be raised for the Service in this scenario. I would suggest not, as the system/infrastructure had failed over as designed and without impact to the Service delivered.
Having read this response would you agree or have you more to add. Please let us know here at ITILnews using the comment box below.


2015-01-20 by "slothster"

If the duplexed component failed and the work load is being taken up by the failover / secondary compenent then I would say a incident still has to be generated. Of course this incident would have a low priority and severity however the failed component still needs to be fixed and this should not occur without an incident ticket as how do you expect the support team to be engaged to fix the broken component.

2015-11-26 by "rajorshib"

As per ITIL, all the Incidents should be logged in the Service Management tool. In this case Service Incident should also be created and related to the component incident. During problem management of the "Service Incident", it would be helpful to determine the root cause.

In addition the relationship of the component with the Service should be up to date in CMDB, so that while creating the Service Incident, both the CI (the service and the component) should be related to the Incident record.
There is 1 comment awaiting user validation. There is 3 comment awaiting publication.

Please submit any comments you have about this article.

Your feedback will help add value to the content for other visitors and help us develop the content for the benefit of all.

You will need to provide and verify your e-mail address but your personal information will not be published or passed on to others. To identify each post we take the part of your email address before the @ sign and use that as the identifier, so if you are your post will be marked "by john.smith".

NB: We respond personally to every post, if it calls for it.

If you prefer to respond without posting your comment please use our contact form.

Click the REVIEW button below to preview your comments.

Tags; ITIL,Incident Management
This article has been viewed 36448 times.
NB: This page is © Copyright and / or the relevant publishing author. You may copy this article only in it's entirety, including any author bio and / or credits, and you must link back to

Keeping up-to-date with ITIL...

Keep up-to-date with ITIL news. Low volume to-the-point bulletins...