Develop > Processes and Best Practices > Problem Management Workflows > Problem Detection, Logging, and Categorization (process SO 4.1)

Problem Detection, Logging, and Categorization (process SO 4.1)

The Problem Detection, Logging, and Categorization process starts when the Problem Coordinator determines that a problem needs to be opened in order to investigate an existing or potential problem. This process can be started in response to a single incident, a series of related incidents, or a single interaction. The process may also result from the proactive investigation of a potential problem.

The Problem Detection, Logging, and Categorization process should include reference to information that assists analysis, such as:

  • Asset and configuration
  • Change management
  • Published workaround information from suppliers
  • Historical information about similar problems
  • Monitoring event logs and other data collected by system management tools

The incident(s) or interaction(s) that initiated the problem should be referenced, and relevant details copied from the incident(s) or interaction(s) to the problem. If the Incident Analyst has identified a workaround or temporary fix, this should be included as well.

A problem ticket is created. All relevant details of the problem must be recorded so that an accurate historic record exists. Other details like impact and category of the problem are also identified.

The following figure illustrates the Problem Detection, Logging, and Categorization workflow:

Problem Detection, Logging, and Categorization process

Process
ID

Procedure or Decision

Description

Role

SO 4.1.1

Review closed incidents

Periodically, the Problem Coordinator must review the closed incidents to detect new problems or to match incidents to existing problems that have not been resolved. Analysis of incident data may reveal similar or reoccurring incidents, which means that a permanent fix must be found. Select incidents since the last review by using the following criteria:

  • Major incidents (high impact)
  • Incidents resolved through a workaround or a temporary fix that is not matched to a problem.
  • Suspected problems (as identified by stakeholders)
  • Candidates for problems

All closed incidents that are not resolved through a permanent fix, temporary fix, or workaround must be matched to existing problems. Or, a new problem must be created. Incident management staff may have linked incidents to existing problems already (for example, if a workaround has been applied).

Problem Coordinator

SO 4.1.2

Incident caused by outstanding problem?

If the incident is caused by an outstanding problem, the workflow moves to SO 4.1.3. If the incident is not caused by an outstanding problem, the workflow moves to SO 4.1.4. It is important to link incidents to existing problems to monitor the number of reoccurring incidents. This helps you to identify problems that are not resolved. The incident count is the number of times that this particular problem has resulted in an incident, and is updated in the problem. The incident count influences the prioritization of problems by indicating the frequency of occurrence and thus the business impact of this issue.

Problem Coordinator

SO 4.1.3

Relate incident to outstanding problem

If the incident is caused by an outstanding problem, the incident must be linked to the problem. If required, the problem is updated and the Problem Analyst is notified (for example, when a workaround has been applied).

Problem Coordinator

SO 4.1.4

Create new problem ticket

Create a new problem ticket that captures all the relevant data, such as:

  • User details
  • Configuration Item (CI) details
  • Date and time the problem was initially logged
  • Description
  • Details of all diagnostic or attempted recovery actions taken so far

The Problem Coordinator can estimate the resources and costs that are required to resolve a problem during any stage of the Problem lifecycle. These details are entered in the problem record, and are used to decide the next course of action for the ticket.

Problem Coordinator

SO 4.1.5

Categorize problem

The Problem Coordinator categorizes the problem into a specific domain (for example, hardware, software, or security).

Problems can be categorized in the same way as incidents, so that the true nature of problems can be easily traced in the future, and meaningful management information can be obtained. Other information (such as the estimated cost and estimated effort) is entered, if it is available at this stage. These fields can be updated at a later stage if new information becomes available.

If the problem is not categorized in the appropriate category, the Problem Coordinator can change the category, which initiates a new workflow.

Problem Coordinator

SO 4.1.6

Link incidents to problem record

The Problem Coordinator links all related incident records to the problem record. The Problem Coordinator also captures other information, such as the impact (from SLM), urgency, and subcategory of the problem.

Problem Coordinator
SO 4.1.7 Prioritize problem and identify major problem The Problem Coordinator identifies whether it is a major problem based on the impact and the organization’s priority. Problem Coordinator

SO 4.1.8

 Problem investigation to be Deferred? If the problem investigation must be deferred, move the problem to the appropriate status. If the problem investigation does not need to be deferred, go to SO 4.1.9.

Problem Manager

SO 4.1.9 Defer the problem investigation

The Problem Manager defers the problem investigation for a specific period of time. The reason for deferring the problem is detailed in the ticket. Periodically, the Problem Manager reviews the deferred problems to determine the appropriate action.

Reasons for deferring problem include the following:

  • The likelihood of recurrence is low
  • The cost of resolving the problem is very high
  • There is currently no plan to investigate the problem
Problem Manager
SO 4.1.10 Assign Resources The Problem Coordinator determines the skills and personnel that are required to resolve the problem, and assigns personnel to resolve the problem. Problem Coordinator