Introduction

This introduction briefly describes complex event processing (also known as CEP) and gives an overview of the Active Correlation Technology and its role in complex event processing.

The business environment of today

Today, commercial and government organizations are dependent on electronic information processing through computer networks, and especially through the Internet. With additional technologies such as grid computing, organizations run mission-critical applications at any time and place in the world. Business processes, activity, and infrastructure, and thus our global society, are dependent on the information technology (IT) layer of organizations.

Organizations need to know what is happening with their business at all times. For example, they need to know whether mission-critical applications are available and working properly and how to detect and prevent a potential crisis in business processes, activity, or infrastructure. If a crisis occurs, they immediately need to understand the problem, how to fix it, and what caused it.

The significance of most events that pertain to business processes, activity, and infrastructure is never recognized or understood because the amount of information is too massive and too difficult to digest as it exists in individual, unrelated pieces. However, if the events are aggregated and correlated such that their relationships can be easily understood, they can yield a wealth of information.

The purpose of complex event processing is to get better information on events in real time.

Complex event processing

An event is simply a notification about something that has occurred.

Complex event processing is the derivation of high-level events from the analysis, correlation, and summarization of low-level events in event-driven systems. These high-level events, called complex events, are suitable for notifying people of business opportunities or problems in easy-to-understand terms or for triggering automated processes. Organizations can then operate more efficiently, with early warning of potential opportunities or problems, and with a better understanding of the root causes that change conditions in their business processes, activity, or infrastructure.

Event correlation is the process of defining and detecting patterns in event streams in real time and of implementing actions in response to related events. It is used to identify a problem based on its detected symptoms. Events can be correlated by cause, by time, by membership, or by combinations of these. Event correlation is an integral part of complex event processing.

The Active Correlation Technology

The Active Correlation Technology uses rules to detect patterns in event streams in real time. This technology is based on the understanding that in many cases, response actions should not be triggered by a single low-level event, but rather by a complex composition of events that are happening at different times and within different contexts. The Active Correlation Technology makes use of the relationships among events to provide awareness of business opportunities and problems. For example, based on the business awareness that is obtained through the correlation of events in real time, an organization can take the following types of actions:
  • Offer discounted shipping for some or all customers during a holiday sale.
  • Over the next 30 days, calculate the shipping cost based on the shipping carrier, the order amount, and the order quantity.
  • Send customers who purchase goods that are worth more than USD500 between 1 July 2005 and 31 December 2005 a USD25 gift certificate.
  • Notify an administrator if any order processing is not completed within 36 hours.
  • Notify an administrator if more than four login attempts to the same computer are detected within 30 seconds.

The Active Correlation Technology consists of the following primary items:

Active Correlation Technology rule language
An XML-based language for writing rules to correlate events. These rules can then be deployed to Active Correlation Technology runtime environments.
Active Correlation Technology engine
The Active Correlation Technology component that processes events according to the output of the Active Correlation Technology compiler.
Active Correlation Technology rule builder
A GUI for writing correlation rules in the Active Correlation Technology rule language.

An Active Correlation Technology runtime environment is an application in which the Active Correlation Technology engine is embedded.