Tweak automatically detected incidents with DataMiner 10.2.5

Automatic Incident Tracking, which organizes your Alarm Console into different incidents occurring in your operation, can be a big help to keep an overview of what is going on in your system. As no automated system is perfect from the start, from DataMiner 10.2.5 onward we allow users to manually tweak the automatically created incidents—or even create new ones. This will help you keep your Alarm Console organized, and thus save massive amounts of time when responding to incidents.

The best of both worlds

The Automatic Incident Tracking feature, available since DataMiner version 10.0.11, will try to group alarms that belong together into a single “incident” in the Alarm Console. This keeps the Alarm Console organized and allows operators to see at a glance where their attention is needed.

However, as with all automatic processes, it can happen that not everything immediately works as it should. Maybe there is an extra alarm related to the incident that was not added by DataMiner, or maybe an unrelated alarm ended up in the incident. But from now on, you can take control of the automatically created incident, add or remove any alarm you want, and create a new incident from scratch if it was not detected automatically.

This combination of automation and manual tweaking allows you to combine the best of both worlds. Automatic Incident Tracking can process a massive amount of data in a matter of seconds, much faster than any human could. Out of all that information it tries to distill the most relevant grouping into incidents. However, a computer does not have the experience and deep knowledge of the system that a human operator has. That is why it can be helpful to let users look into an incident in detail and let them polish the AI’s work before handing off a fully described incident to the NOC.

All in just a few clicks

As of DataMiner version 10.2.5, you can edit an existing incident by adding extra alarms or removing unrelated alarms. If no incident has been made yet, you can manually create a new one. To better describe the incidents, you can also give them a custom name. All these actions are easily performed in a few clicks from the Alarm Console in DataMiner Cube. DataMiner 10.2.6 will also add the possibility to assign ownership of an incident, clear incidents that were created manually earlier, and add comments to incidents. Moreover, the incidents will now also be fully integrated with DataMiner Ticketing.

If the automatically created incidents do not fit your needs, there is also the option to create and manage your incidents completely manually. However, our AI team would also love to hear from you how they could improve the Automatic Incident Tracking feature to fit your needs! Contact us by email (ai@skyline.be) or simply share your ideas in the comments below.

Fully functional out of the box

Unlike traditional alarm correlation, Automatic Incident Tracking does not require any manual configuration or maintenance over time. It works completely out of the box and integrates well with different DataMiner features and applications, such as the IDP application.

To group alarms into incidents, it takes into account data from many different sources, such as how much time passed between the occurrence of two alarms, whether the alarms are on the same element, whether they belong to the same service, whether the associated elements belong to the same view, etc. Besides that, it can also learn from past alarm activity in your system through the Alarm Focus feature. You can even configure your own custom alarm, element, view, or service property to improve grouping (see docs.dataminer.services for more information). What’s more, we intend to improve this feature over time by adding more sources of data and making it more intelligent.

Looking ahead

Finally, I would like to answer a question that might be burning on your lips: does Automatic Incident Tracking learn every time you edit an incident or create a new one?

Well, not yet…

We do agree that this is a valuable source of data, and we are definitely planning to look into how we can best use this to improve incident recognition even further, as we are working towards the final dream of eventually eliminating the need for any manual actions whatsoever.