Download Managing Event Processing Networks

computing). Often the context of events is relevant: The reason why a message got lost
may be that a required pathway was no longer existent when the message was sent.
•
Dynamic causal models are one form of event processing. Events in event streams are
automatically processed to include genetic information indicating which other events
had to happen in order for them to happen. The genetic data in an event allows the
events in its causal ancestry to be immediately uncovered by other EPAs, making their
operation more efficient and accurate. Causal information must be recognized across
multiple event streams. Extracting and developing accurate causal models for C2
environments is another research issue.
•
Flexibility: CEP queries are flexible and configurable at runtime so the user can rapidly
adjust them if needed. This includes starting a new query against an ongoing event
stream, that either considers only new events, only old events, or both.
•
Efficiency: Many applications produce relevant events at rates of millions/minute. CEP
supports high event rates through query optimization, efficient pattern matching
algorithms, as well as distribution of event processing.
CEP supporting these two features is part of Stanford University's RAPIDE project. We developed an
extensive set of tools that supports logging, mining, storing, and viewing of events in real-time. RAPIDE
events are related by time and cause. Each relations builds a partial order on all the events. A formal
pattern language [3] supports the construction of filters and maps, constructs that aggregate simple events
to complex events on a higher level of abstraction [4]. The same process can be used to query complex
events, thus building a more and more abstract view of the system.
B. Event Processing Networks
In order to accurately reflect the complex nature of real computing environments, effective event
processing must be component based. A variety of different components need to be able to process a
broad spectrum of events from different technologies.
We have built Event Processing Networks (EPNs) consisting of any number of Event Processing Agents
(EPAs), namely event producers, event processors, and event consumers. Figure 1 shows an overview
over the three categories, with thin arrows indicating the (logical) flow of events from producers through
processors to consumers.
The EPN is supported by an event service. The event service provides repositories for events and event
schemas, templates for processors, and a consumer registry. Event Schemas define the format of events
forwarded by the event service. The event repository stores events. Processor templates are predefined
templates that can be activated to filter, aggregate, or otherwise process events. The consumer registry
keeps track of which consumer is interested in which events.
4