Terms and FAQ
Glossary and answers to common questions about running the application.
Glossary
- Virtual switch (VDS / vSwitch)
- vSphere Distributed Switch managed from vCenter for the whole cluster, or standard vSwitch on a single ESXi host. Physical uplinks (vmnic) lead to a pair of leaf switches – failure of one switch means only degradation.
- Port group
- A group of virtual switch ports with a common VLAN and teaming rules. A VM network card is connected to a port group; the port group is mapped to a VLAN in the physical network. Failure of a port group disconnects all its VMs (backup network only degrades).
- FOCUS
- FinOps Open Cost and Usage Specification – open standard for cost data format (FinOps Foundation). The application works with FOCUS 1.x columns.
- EffectiveCost
- Actual (amortised) cost after discounts. This is used to calculate overviews and billing foundations.
- ListCost / ContractedCost
- Cost according to price list or contractual price. The difference from EffectiveCost is savings.
- Sub-account
- Subscription, account, project or cluster with the provider (FOCUS SubAccount). In OpenShift a hosted cluster, in the data centre an IBM Power server.
- Customer and project label
- Kubernetes / cloud labels eywo.cz/customer and eywo.cz/project, by which costs are assigned. A renamed label can be connected with an alias.
- Allocated amount
- For containers, max(request, usage) per hour; for IBM Power, entitled cores × hours. Utilisation = actual consumption ÷ allocation.
- Entitled capacity
- Guaranteed share of processor cores allocated to an LPAR in IBM Power; basis for billing calculation.
- Capacity on Demand (CoD)
- Cores and memory installed in the server, activated by a license key as needed.
- NPIV
- N_Port ID Virtualization – virtual FC adapter LPAR with its own WWPN, which goes through VIOS directly to the SAN.
- WWPN
- World Wide Port Name – unique address of an FC port; by which zoning and mapping are done.
- Zone
- Rule in the SAN fabric that allows communication between host and disk array ports.
- Thin provisioning
- Volume only occupies actually written data in the pool; the allocated size is billed.
- HyperShift (hosted control planes)
- The control layer of customer OpenShift clusters runs as pods on a shared management cluster; the customer has only worker nodes.
- LAG / LACP
- Aggregation of multiple physical ports into one logical port (port-channel); LACP negotiates it. vPC / MLAG allows aggregation across two switches.
- Maintenance window
- Recurring time (weekly or monthly) when the service may be unavailable (downtime) or run with reduced redundancy (degradation). Defined by the service owner or application, including maximum outage duration.
- RACI
- Responsible (performs), Accountable (responsible and approves, exactly one), Consulted (consulted), Informed (informed).
- CI Version
- A configuration item snapshot valid from–to. A new version is created with each change from discovery, API, or manual editing.
- VLAN, SVI, VRF
- VLAN separates L2 segments; SVI is the L3 VLAN interface on the switch (subnet gateway); VRF separates routing tables.
- Impact path
- The chain of items from the simulated outage to each affected service, including components (ports, interfaces, zones, VLANs). The Impact path button in the impact analysis panel highlights it on the dependency map.
- Symptom (alert)
- An alert explained by the outage of the situation’s root item (according to the CMDB outage simulation). It is visible in the situation, sends no notifications, is excluded from noise metrics and is resolved together with the cause.
- Inferred cause
- An item without its own alert (monitoring does not see it) whose simulated outage explains alerts on several dependent items – e.g. a host on which five VMs alert. Event management creates one situation from them with the cause “inferred from topology”.
- Single point of failure (SPOF)
- An item whose sole failure completely disables a service or application. The High Availability card finds these by simulating the failure of each supporting item; logical components (applications, DB instances, clusters) are counted separately.
- Outage and degradation
- Outage = the item does not work. Degraded = it works without some functions or with lower performance (e.g. without the array management network, without the tape copy of backups, the carrier itself degraded). At risk = loss of redundancy: only one of the redundant components failed and the item keeps running without a backup; impact analysis shows it on the nearest dependent item and on the services above it (“no redundancy”) and it does not propagate further.
- Redundant group
- A group of carriers that stand in for each other – an application cluster, Db2 HADR, Oracle Data Guard, PowerHA, a VIOS pair, HyperSwap volume copies, Veeam nodes; without an explicit group also components of the same class (network devices only of the same role – a switch does not cover a firewall; interfaces only of the same purpose – a data interface does not cover a management one). The dependent item fails only when all members fail. Planned items do not count as members. Discovery sends the group in attributes.redundancy_group on the relationship.
- HyperSwap / policy-based HA
- Volume synchronously mirrored between two disk arrays; if one array fails, I/O runs from the other without interruption.
- Db2 HADR, Oracle Data Guard, PowerHA, SQL Always On
- Database high availability: primary and backup instances on different servers (here also on different frames and fields) with synchronous replication and automatic takeover.
- VIOS pair
- Two Virtual I/O Servers on an IBM Power frame; the LPAR has network and disks through both, so losing one VIOS puts the LPAR at risk (it runs without a backup) but does not take it down.
- SAN fabric A/B, core and edge switch, ISL
- Two separate SAN networks - each server and field is connected to both. The core switch carries the field, the edge switch hosts; they are connected by an ISL (inter-switch link).
- Hardened repository
- Linux server with local disks for Veeam backups with immutability - backups cannot be deleted or encrypted by ransomware.
- Backs up / is backed up
- Relationship of the backup platform (IBM Storage Protect, Veeam) to the protected CI. It does not affect availability; coverage of production servers by backup is calculated from it.
- Incident
- Unplanned interruption or degradation of a service. The goal is to restore as quickly as possible, not to find the cause (problem management handles this).
- Priority and SLA
- Priority P1-P4 = impact × urgency. The service SLA agreement determines the reaction and resolution deadline for each priority; incident suspension moves the deadlines.
- SLA agreement
- Agreed service level (e.g. Gold, Silver, Bronze): response and resolution deadlines by priority, working hours, required fulfilment and availability.
- Working hours (SLA calendar)
- The time during which the SLA time runs - e.g. 24×7 or Monday-Friday 8:00-16:30 excluding public holidays.
- Major incident
- A failure of an important service, which is coordinated by an incident manager and about which management and service owners are continuously informed.
- Service request
- A standard, pre-described request from the service catalogue – not a fault. It has a form, approval, deadline, and fulfilment steps.
- Change model
- A template for a repeated type of change: type, approval, need for a maintenance window, lead time, allowed item classes, and steps.
- Standard, normal and emergency change
- Standard is pre-approved and low-risk (e.g. gradual patching of hypervisors). Normal goes through approval. Emergency solves an ongoing incident or critical vulnerability and can be outside windows.
- CAB
- Change Advisory Board – riskier changes approved by the change manager together with owners of affected services.
- Team
- A group of people who own configuration items, services, and changes, and handle incidents and requests. The role “team” scope gives permissions to team items.
- Single source of truth
- The system whose data is valid. For VM and partition placement, this is the virtualization management tool (vCenter, SCVMM, HMC...), manual writing will not overwrite it.
- Event, alert, situation
- An event is a single monitoring report. Alerts are all occurrences of the same problem on the same CI (deduplication by fingerprint). A situation is a group of related alerts – typically one cause and its consequences.
- Probable cause (★)
- Alert on a CI that other situation alerts depend on according to the CMDB dependency map – e.g. a hypervisor under unavailable VMs.
- Flapping
- An alert that repeatedly switches between a problem and OK; instead of dozens of notifications, there is one situation with a 'flapping' status.
- Workflow
- Record statuses and allowed transitions between them, including who can perform them. Custom statuses map to system statuses that the application logic relies on.
- Notification rule
- When (event and conditions), what (template with parameters), how (e-mail, Slack) and to whom the message is sent.
- Service contract and contract line
- Contract with a vendor for infrastructure support. One row = one CI covered by the contract, with its own support level and coverage period.
- Vendor SLA (support level)
- What the vendor guarantees us: reaction and repair time within their working hours (e.g. 24×7 – reaction 2 hours, repair 8 hours, or next business day). Different from the SLA we guarantee to customers.
- Termination notice period
- How many days before the end of validity we must give notice or decide to extend; the overview shows the last day.
- Retention
- Record retention period. Audit trail for 5 years and cannot be changed; configuration history according to settings.
Frequently asked questions
How do I connect Zabbix or Prometheus to Event management?
Monitoring → Event sources → at the source 'How to connect': Zabbix 6.4+ via Connectors (event streaming) or webhook, Alertmanager via webhook receiver, others via generic API. You need an API token for a service account with the 'Event source' role (Administration → Access and roles) and, in the Cloudflare variant, a Cloudflare Access service token.
Why didn't an alert turn into an incident?
Monitoring → Situations and alerts or Noise compression: the event may have been discarded by a filtering rule (e.g. informational), suppressed by a suppression rule or an ongoing change on the CI, or it's another occurrence of an existing alert (only the counter increases).
Does the application send data to AI?
Only for enabled AI assistant use cases (Admin → AI assistant) and only what the proposal requires; emails, phones, dates of birth, account numbers and secrets are replaced with tags beforehand. Customer data with a 'on-premise only' policy will only be processed by a model in your own infrastructure, and with a 'no AI' policy, no model will be used. Each call is logged in the proposals record.
Where do I set SLA?
Services → SLA. In the SLA agreements tab, you edit deadlines by priority and assign the agreement to services and customers; in the Calendar working hours and holidays, and in Request deadlines, catalog item deadlines. SLA fulfillment is in the first tab.
Where do I set incident, request, change and CI workflows?
Admin → Workflow. You select a record (Incidents, Requests, Changes, CIs), add or rename a status in the States table and set transitions in the Transition matrix by clicking on a cell: button description, permissions, required comment or field. Changes take effect in the record details within a minute.
How do I enable email and Slack notifications?
In Admin → Notifications → Channels. Briefly: for Resend (or SendGrid), verify the sender domain and create an API key, for Slack, create a webhook for the channel, then `npx wrangler secret put RESEND_API_KEY`, `npx wrangler secret put SLACK_WEBHOOK_PROVOZ` and `npx wrangler secret put SLACK_WEBHOOK_MAJOR`. The channel will then show 'secret set'. Set the sender to an address in your verified domain.
Why was the notification not sent?
Administration → Notifications → Sent shows the reason: missing channel secret, recipient has no e-mail, test address (.example), demo mode (delivery at demo dates is disabled) or service error (response code and text).
How do I find out who is fixing a faulty server and by when?
In the incident, the Vendor – support tab searches for support at the CI and at the hardware it runs on (VM → host, LPAR → Power frame). It shows the vendor, level, hotline and escalations; Report to vendor will start response and repair terms according to the contract. In the CI details, there is a Support and contracts tab.
Where can I see hardware without support and expiring contracts?
Finance → Contract overview: expiring and terminated contracts with the last notice day, coverage by class, list of hardware without valid support and what ends within 90 days. You set e-mail notifications in Administration → Notifications (Contract record).
How do I turn off demo data?
Admin → Settings → Demo data. The switch toggles the entire application to the production database; demo data remains in a separate database and can be enabled at any time. Only the platform administrator can switch.
Where are CMDB, operating systems, and changes after menu modification?
The menu is organised by area of IT service management: Services (service portfolio, SLA, request catalogue), Monitoring (situations and alerts, noise compression, rules and event sources), Service desk (incidents, problems, request fulfilment), Changes (changes, approvals, patching and vulnerabilities), Configuration (CMDB, data centres, lifecycle, data quality, enterprise architecture), Finance and assets (costs, billing, assets, purchasing, suppliers and contracts) and Administration (integrations, people and access, application settings). The fastest way is search with Ctrl+K – it also finds menu pages.
Why can't I change the VM host manually or from another source?
The VM and partition location is taken from the virtualization management tool (vCenter, SCVMM, HMC…). Another source or manual entry would diverge from it; discovery from another source would get an error with the name of the tool that manages the location.
How do I link a change to several incidents or a problem?
In the change detail, Addressed records card → Link: choose the record type and enter its number. From an incident, problem or request detail, link an existing change by its number in the Changes card. The link the change originated from cannot be removed; others can be unlinked by the requester, implementer, change manager or record owner.
What happens to the problem and incidents when the fix change completes?
A problem with a documented root cause moves to Resolved and references the fix change; without a root cause it gets a log entry asking you to add one. A failed change returns the problem to analysis. Incidents and requests get a log entry with the next step (verify and resolve with code “Resolved by change”) and reporters are notified.
A reported incident is actually a request (or vice versa). What do I do?
In the incident detail use Convert to request (choose a catalogue item), in the request detail Convert to incident. The new record takes over the description, item and reporter, the deadline runs from the conversion and the original record is cancelled with a link to the new one.
Why does losing one switch of a pair show neither an outage nor degradation?
The server is connected to both switches, so it keeps running – only without a backup. Impact analysis shows this as “at risk” on the nearest dependent items and on the services above them (“no redundancy”) and does not propagate it further. For a change on such a switch the service owner is informed but does not need to approve. If the second switch failed too, it would be an outage.
What does a situation with an inferred cause mean?
Several items alert at once and share a carrier (host, datastore, switch) that raises no alert itself – monitoring does not see it. The application verifies in the CMDB that an outage of this carrier explains all the alerts and creates one situation with the cause “inferred from topology”. Check the carrier in monitoring; from the situation detail you can simulate its outage on the map.
Why can't I complete the change?
The change model defines the change steps. The change can be completed only after all steps are ticked off in the change detail.
How are incident SLA terms calculated?
From the incident opening based on priority (e.g., P2: reaction 30 min, resolution 8 hrs). The pause time is added to the terms. The reaction is fulfilled by taking over for resolution.
How do changes from discovery get into CMDB?
Collection scripts (HMC, vCenter, SCVMM, cloud API, OpenShift, storage, SAN, network) send items to POST /api/cmdb/discovery with an API token for a service account. Each attribute change creates a new version; in the CI details, there is a history with value comparison and status at any date. During full synchronisation, items not found by discovery are marked and removed after a set period.
Why can't I find the patching term?
Some affected service has no maintenance window, its maximum downtime is shorter than the change, or service windows do not overlap. Try a longer horizon, shorter intervention, or gradual patching of individual CIs with redundancy.
Why did the costs for the month change even though it has already ended?
Providers (especially Azure and AWS) calculate costs several days after the end of the month. Generate billing grounds after the 5th day of the following month and approve them before sending – an approved ground does not change.
What if the customer has no label?
Rows without a label are displayed as „(no customer)“ or „(no project)“. Fill in the label on the namespace / source or add an alias.
Can I correct the ground after approval?
Return it to draft, correct the data or template and re-generate. The submitted template can only be cancelled and a new one generated - it will get a new number.
How do I upload data from my own script?
Send FOCUS lines to POST /api/ingest/focus with an admin token (see Import and API). For multiple parts of one file, send the same upload_id.
What does „No single point of failure“ mean?
The application simulated a failure of each CI that the service relies on (servers, frames, VIOS, guests, datastores, volumes, disk arrays, SAN, and network), and no single failure took the service down – it merely degraded it. The application does not examine combinations of failures at once; you will verify these in impact analysis by selecting multiple CIs.
Why is the production server listed as unbacked up?
It has no „is backed up“ relation – discovery did not find an IBM Storage Protect or Veeam agent for it. Cloud VMs are not counted in coverage, as they are backed up by the provider.
Why does a failure of the network or tape library only degrade the service?
The disk array serves data over SAN; without the admin network, it loses management, monitoring, and IP replication to DR, but still runs. Without the tape library, backups continue to disk, but only tape copies are missing. Such relations have the „degrade only“ flag.
How do I use the application on my phone?
Menu opens with the Menu button top right; it also contains role and theme selection. Wide tables scroll horizontally – a faded border indicates continuation. The dependency map opens as a tree; in Graph view, swipe to pan and pinch with two fingers to zoom.
Where are cloud passwords stored?
Nowhere in the application. The connection only contains a link to the vault; collection scripts load secrets themselves.