Major Incidents?

[martin_d]

When there is a major service affecting incident, is it ITIL best practice to log an incident for each user that reports it, or log one incident for all?

Thanks in advance

[rjp]

This one does cause some 'debates' from time to time.

There are a few things worht considereing and none preclude the others.

Have a clear definition in place for a major incident and ensure there is a protocol dedicated to the handling of such.

Having said that - it's easy to say a major incident is an availabilty or capacity disruption that has gobal (or wide scope) - but sometimes it may only be the fact the you start to get a large number of duplicate incident reports that a major incident is detected. (Though with infrastructure monitoring technoligies maturing at the current rate this is becoming rarer.)

But on the other hand every report should be logged regardless. It's highly likely that when a major incident is occurring some poor sod will ring up and say 'X isn't working' and be told, 'yes, Y is happening and we are working on it' - but it turns out that the users report had nothing to do with an outage, and now he/she is sitting out there wondering how long it will be, and eventaully call back in a more frustrated tone.

So, yes log every incident.

But...won't the desk be swamped, and all those call back be a waste of time? Well, yes if you have crappy major incident protocols. One of the most important tasks for the service desk in a major incident is to get the message out to the community ASAP - with an intelligible description of the effect user can expect it to have on them, and regular progress reports. You'll get some who still call, but in this case they are only calling for an update, so you can log it as such and set it straight to resolved - because you gave them the update. Very useful data. Most won't, if they are confident they have been given good information and trust they will be informed as soon as the issue is resolved they will let you get on with it.

So best practice is logging every incident, but not just that.

[martin_d]

Thanks!

[Jamiey]

What if you have multiple services affected by the incident?

for example, failure of a data centre which takes out several customer systems. I'm correct that to assess impact you would need to have a call for each service.

A secondary question about Major Incidents is if you have support teams who would investigate and resolve incidents outw ith the service desk where would these incidents sit?

With the support teams doing the work or with one "lead" call with the support teams and further incidents either for services or users sitting with the Service Desk.

[OOSLVR]