Intelligent Event Processing

Intelligent Event Processing (IEP) act as central intelligence facilitating efficient event routing between internal and external producers. These can be, for example, the different monitoring use cases, as well as consumers like Alert Management, Notification Management and others.

In addition, it serves as a unified event processing platform that operates based on rules for both automatically and manually triggered events. This allows for streamlined and centralized event handling through an event log viewer and the use case specific alert inboxes.

The following graphic demonstrates potential incoming events and available outgoing events:

Intelligent Event Processing involves the unification of incoming and outgoing events from SAP Cloud ALM applications and external sources to enable efficient event processing and forwarding. Additionally, the system provides the foundation for intelligent correlation of events, such as linking manually generated notifications with automatically generated alerts for more comprehensive analysis and response.

To achieve this, Intelligent Event Processing is using events when something of importance is happens. SAP Cloud ALM can process these events, which are of interest in a SAP solution landscape. Some examples for such events would be:

• Issues with Data flow between various cloud services.
• Large backlog in a Business Process spanning across various cloud services.
• Critical Health of cloud services.
• Critical Status of various deployed applications.
• A planned maintenance is scheduled for a cloud service.

Events in Intelligent Event Processing are subject to a three-phase lifecycle: Event Creation, Event Processing, and Event Reaction:

The Event Creation is based on the monitoring application in SAP Cloud ALM. Events are created for issues detected in managed services or systems. Additionally, events from 3rd party applications can be ingested into SAP Cloud ALM.

After the event creation, Event Processing is able to handle the alerts with respect to normalization, enrichment, deduplication, and correlation.

Based on the resulting event groups, event clusters, and event rules, the Event Reaction can trigger follow-up actions like:

• Alert creation in the alert inbox of an application.
• Email notifications to defined recipients.
• Incident creation or update.
• Operation automation workflows.

The following screenshot displays the Event Settings interface:

The settings for the Intelligent Event Processing are usually done in the configuration of the respective monitoring use cases. For this you would usually perform the following setup steps:

1. Create the monitoring configuration with filters and thresholds in the monitoring configuration.
2. Go to the Event Settings in the monitoring configuration to define them for the specific monitoring object.
3. Define assigned actions for downstream processing.

If multiple event processing rules match for the same event, all rules are processed.

Events in SAP Cloud ALM can result in different possibilities for event actions, like Alerting, Ticket Creation, Operations Automation, or Notification as shown in the following diagram:

In detail, an event can therefore result in:

• Alerting, which would create alerts visible in monitoring applications with information for root cause analysis and flexibility to trigger manual actions to resolve the issue.
• Ticket Creation, which could be, for example, a ServiceNow ticket, or another in another ticket type in a further ticket system via any REST based endpoint.
• Operations Automation, for example for health checks, error resolution, or further processing in SAP Build Process Automation (SAP BPA), SAP Automation Pilot, SAP Workflow Management, or SAP Intelligent Robotic Process Automation.
• Notification via Email or other unidirectional notifications via messaging channels like MS Teams, Slack etc.

Watch this video to gain insight into the tools employed within the integrated Incident Management process:

The Intelligent Event Processing app provides an overview of the event situations and actions triggered by different SAP Cloud ALM apps based on the selected managed components and time frame.

The screenshots below display the Intelligent Event Processing Application:

An event situation is a grouping of events over a defined period of time.  There are two types of Event Situations, stateful and stateless events:

• Stateful events are opened, optionally updated, and closed after a certain time. This event type is used to report for example disruptions when the state changes.
• Stateless events are triggered and receive no further updates. This event type is used to report, for example, the occurrence of an erroneous log message.

Stateful events and stateless events trigger different actions like creating alerts, sending emails, creating or updating tickets, or starting an operation flow. The type of action, which is triggered is defined in the relevant rules.

In the Intelligent Event Processing app, you can access the event action logs and the event payload traces.

The event action logs:

• Shows an overview about events raised in the SAP Cloud ALM tenant.
• Shows the creation time, duration of the event situation, and the state of the event situation.
• Provides details about the actions triggered for the event.
• Shows errors and error messages, which happened at the event action execution.

The event payload trace allows:

• The enablement of payload tracing on demand for specific events for the next 24 hours.
• To capture the last ten event instances with the source payload sent from the monitoring application.
• An analysis of the event payload stored from the last 48 hours.
• To gain insight into the full event details to optimize the mapping in the resource notification to send as much as possible information to external systems.

To learn how to use the Intelligent Event Processing app's filter option for specific event situations and utilize the Event Details view to analyze failed Operation Flows, watch the following demonstration video. This video will also show you how to find the root cause of a failure within the Action Log for an event situation:

You can follow along with this demonstration either by using the SAP Cloud ALM Public Demo tenant or your own SAP Cloud ALM tenant, if this use case has already been set up. To do this, simply select the Operations group and then choose the Intelligent Event Processing tile.

The screenshot below provides an example of the External API Management Console:

Events that trigger external actions are using the External API Management in SAP Cloud ALM. With the Console of the external API management, it is possible to:

• Gain insights into the results of the external API call.
• See the full(*) payload of the API request sent to the external API as seen by the partner API (request after mapping, response as sent from the partner API).
• See the full(*) payload of the API request as seen by SAP Cloud ALM (request as sent before mapping rules have been applied and the response after mapping).

For more information about the possibilities for external Chat & Ticket tools, see the lesson "Chat & Ticket Integration" in the "Integration" unit of this learning journey.