A substantial amount of time as an IT administrator is spent explaining things to other people. This is one of the hardest aspects of the job. You detect an outage and the first thing that people always ask is “How did this happen? and ”What does this mean for the business?” The story that is derived from analysis, the ‘How It Happened’, has value to the organization. How to prevent issue from reoccurring, how to train people to recognize it, and what immediate actions to take in the future are all contained in this story. But, what we’re finding is that completed analysis is not viewed as a corporate asset and suffers from four IT knowledge preservation and transfer issues.

  1. Tool-to-Knowledge Distance The people that detect the outage and might perform initial triage of the problem report up to the next level of the organization. The “story” is transferred to them. This story is added to as the IT department goes through a more formal information gathering phase in preparation for creating the outage report. After the issue is resolved, not much attention is given to the story. If you’re lucky, it is left in some electronic form in Box, on Google Drive, or in a ticketing system. Many people will forget about its existence. The investigation tools and the story are separated and sent to different places. The next time something like this happens, (there’s always a next time), several team members will have left the organization. The remaining people will struggle with the same problem, and none will stop what they are doing to go to a separate place to find and read and use the story as a guide for the current problem.

  2. Vertical Knowledge Transfer Issues The story created by the IT administrator is relayed through at least two levels of the organization. Often, this turns into a bad game of “Telephone.” The person doing the initial troubleshooting relays what happened to a supervisor who speaks with a line-of-business owner and then, if needed, tells someone at the C-level. The technical description of the problem can be lost in lieu of how it affected the business. In a world where it is increasingly important for IT folk to understand business people and business people to understand the infrastructure that enables the business, clear communication is crucial.

  3. No Investigation Replay Reading static documentation of an investigation or analysis will never be the same as performing the investigation yourself. Seventy percent of learning is experiential. Documentation often doesn’t reflect the progression of steps the analyst took in successfully getting to the root cause. Understanding the analyst’s methodology and the sequence of steps taken is the key to being able to reuse the analysis for training purposes.

  4. Inconsistent Language Every analyst has an “incident documentation accent.” When documenting what happened, the analyst will chronicle the investigation steps, outline what caused him or her to follow specific steps, and define relationships between data objects in log data.  Inconsistencies in the lexicon used by team members in documentation makes the analysis harder to reuse. Misinterpretation of analysis not only means no learning takes place, it also can lead to a wrong or an early conclusion to an investigation.

Gemini Enterprise is focused on analysis knowledge preservation and transfer. A common ontology powered by Machine Reasoning identifies relationships between data objects. This addresses the issue arising from lack of language consistency amongst analysts. As analysts use Gemini Enterprise [https://www.geminidata.com/products/gemini-enterprise/] to investigate, the system automatically inserts the relationship information and documents the investigation. Any authorized team member can view a recorded investigation and understand what the analyst did and why. All investigations are contained in a built-in searchable Stories library and can be referred to at any point in during an investigation with no effort. Histogram functionality means an investigation can be replayed step-by-step. There are no questions about how an investigation was conducted and no question about the order of the steps. Finally, the analysis is stored as a narrative and as a visual representation created in an intelligent graph database. This means the investigation is understood across the analysis team and up to the C-suite. Using Gemini Data means IT Analysis is a corporate asset and an integral part of a learning organization.

Get a sneak peak showing how Gemini Enterprise can help you preserve analyst knowledge as a business asset.