Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 3 of 5

Alerting, event routing and ownership

10 min

Listen to this lesson

0:00 / 7:37

An alert without an owner is worse than no alert: it trains people to ignore the channel. In SAP Cloud ALM, alerts and notifications come from Intelligent Event Processing (IEP), the component that routes events between producers and consumers. The design work is deciding, for each event, who must act, how they are told, and what happens if they do not.

How events flow

  1. Event raisedA monitoring app detects a situation, for example an IDoc in error or a job running too long
  2. Rule appliedEvent processing rules, usually created by the monitoring app's event settings, decide the actions
  3. ActionsAlert in the app's inbox, email, ticket in the ITSM tool, chat message, or operation flow
  4. HandledOwner acknowledges, works the runbook, confirms the alert
  5. ClosedConfirming an alert implicitly closes the related event situation
The event path in SAP Cloud ALM, based on SAP's Intelligent Event Processing description.
The Sign-Off Table · thesignofftable.com/academy/sap-bas-401

Some details matter for design. SAP distinguishes event situations, which open, may update and later close, from stateless events, which open and close at once, such as a specific application log message; stateless events cannot be updated or auto-closed later. Event processing rules are normally created and managed in the source monitoring app and shown read-only in IEP; SAP describes manual rules in IEP as for exceptional cases. Not every action is available for every use case (Business Service Management, for example, does not create alerts), and IEP's overview shows triggered events and failed actions with error messages, which is where to look when an expected email never arrived.

Event situations open, update and close; stateless events open and close at once and can never be updated afterwards.
The Sign-Off Table · thesignofftable.com/academy/sap-bas-401

Ownership by design

Event typeOwner (acts)ChannelEscalation
EDI order or invoice in error (1710 or 1910)Integration specialistAlert inbox and ticket in the ITSM toolMaria after 2 hours in business hours
Nightly billing job failed or lateOperations analystEmail and ticketSam if not resolved by 06:00
Payment run failedOperations analyst with AnaEmail and chatDan immediately
CMP technical health criticalSAP ECS (technical) and Sam (business impact)SAP incident; Contoso alert for awarenessPer RISE incident priority
Bank statement flow in Integration Suite failedIntegration specialistAlert inboxDan's treasury contact by 10:00

Extract of Contoso's alert ownership matrix (illustrative). Every row has one acting owner.

Acting ownerOne named role that works the alert and confirms it
EscalationWho is told if the alert is not handled in time, and when
InformedProcess owners and key users who need awareness, not action
RunbookWhat to check first, how to fix or work around, when to raise an SAP incident
Four things every alert definition needs before it goes live.
The Sign-Off Table · thesignofftable.com/academy/sap-bas-401

Under RISE, ownership also crosses company lines. When CMP's health turns critical, SAP ECS acts on the platform, but Contoso still decides what it means for the business, informs users and confirms the resolution, because the R&R makes sign-off of incident resolution a customer task. Route such events to Sam for awareness rather than duplicating SAP's technical response.

Severity and timing need the same care as ownership. A failed EDI invoice at 23:00 can wait for the integration specialist's morning if the customer collects invoices at 08:00; a failed payment run on the day suppliers must be paid cannot. Write the business deadline into each alert definition, so the escalation time follows the business, not a generic priority table. Wave 2 adds a twist: Monterrey works in a different time zone and its own month-end calendar, so alerts for company code 1910 need owners who are awake when they fire.

One acting owner and an escalation timed to the business deadline: if the payment run alert is not acknowledged, the next person is told before suppliers are paid late.
The Sign-Off Table · thesignofftable.com/academy/sap-bas-401

What would you do?

During hypercare, an alert for 'payment run failed' goes to a shared mailbox read by six people. One Friday, the payment run fails; everyone assumes someone else is handling it, and suppliers are paid three days late. What is the root fix?

Key points
  • Intelligent Event Processing routes events to alerts, email, ITSM tickets, chat or operation flows.
  • Rules are usually managed in the source monitoring app; IEP's overview shows failed actions.
  • Every alert needs one acting owner, an escalation, informed parties and a runbook.
  • Test alerts by triggering them on purpose before go-live; under RISE, route platform events for awareness.

Check your understanding · not graded

Lesson check

  1. 1. Which action is not something IEP can trigger, according to SAP's description?

  2. 2. What is a stateless event in SAP Cloud ALM?

  3. 3. Where are event processing rules normally created and changed?

  4. 4. What makes an alert ready for production?