Based on the second level correlation of events, it is identified if the event is of the type “warning” or “exception”.

A warning is an event that is generated when a service or device is approaching a threshold. Warnings are intended to notify the appropriate person, process or tool, so that the situation can be checked and the appropriate action taken to prevent an exception.

An exception means that a service or device is currently operating abnormally (however that has been defined). Typically, this means that an OLA and SLA has been breached and the business is being impacted. Exceptions could represent a total failure, impaired functionality or degraded performance.

In case the event is of the type “warning”, an alert can be sent out to the Event Analyst, who would then carry out actions required to close the event. Alternately, for some warning events, the system can also trigger auto responses that are standard actions automated within the system.

In case the event is of the type “exception”, an Incident Record, Problem Record or a Request For Change, may be created.