Archive

Archive for the ‘Complex Event Processing’ Category

Coral8, now at SAP

May 13th, 2010 6 comments

SAP acquires Sybase

Given that big companies buy other big companies left and right, this might not even be big news even if it is a big deal. For us event processing aficionados this now means that SAP owns Coral8 and Aleri code base. I would be surprised if this is not the end of those products as standalone CEP products…

 

Share/Save/Bookmark

StreamBase Update

May 3rd, 2010 2 comments

I have not looked at what StreamBase do for a while now. But as you might read in my previous blog entry I found some financial information about StreamBase and thought I’d take a quick look to see what they are up to. Or, what can you do with $48,000,000 USD?

A new idea they have is the component exchange. I like. This is something all infrastructure platforms need. A place where you can find plug-in components to your favorite tool. For example the Eclipse platform have thousands of plug-ins available on their marketplace.

So I really like the idea. But 18 components? That’s sadly not much of an exchange. It seems that there’s no third party components and StreamBase don’t seem to put much into their own exchange either. But still a good idea.

Another good place to check what’s going on is in the documentation section of the StreamBase site. They have good documentation and a quick check reveals that there are updates published with regular intervals. While browsing the "what’s new" section I smell Financial Markets all over the place. If I would be looking at this for the first time I would put this into the "tools for traders and other people on Wall St." category and not into the ‘generic CEP tool’

I did not bother to download, which I think you still can (a gold star to StreamBase for that) , as there were not enough interesting stuff to look at. Maybe I would be more excited if I were working in the capital markets.

 

Share/Save/Bookmark

$6M not enough for StreamBase (more like $48M)

April 29th, 2010 2 comments

It seems that StreamBase needs more money: www.sec.gov/Archives/edgar/data/1315537/000131553710000003/xslFormDX01/primary_doc.xml 

I understand that there’s 5.5M involved. Rest is sort of MBA talk, anyone care to translate this to us mere mortals?

Last year they got $6M if I remember correctly. Does this mean that StreamBase burns about 5-6M more than they earn per year?

 

Edit: 

Following the link posted  by Marc in the comments section I think (noticing that I don’t really understand what I’m looking at) StreamBase have got about $48M from investors since 05. Is that lots of money compared to what they have achieved?

But having raised $48M (daydreaming on how much we could do with that sum ;)  ), do that mean that they are spending more on development than customers are willing to pay for the software? Or do software companies have other reasons to take money from investors?

At least some investors think that a CEP company is a good place to put a $48M in, that must be a good sign!

Share/Save/Bookmark

CEP Updates

April 27th, 2010 Comments off

As you might have noticed, I have not had any inspiration to write in my blog lately. This is partly due to a high work load over here at ruleCore HQ. Lots of small things to fix before a new release and the GUI stuff just sucks up all my time.

Also, there seems not much interesting happening in the world of CEP. StreamBase have turned into a financial solutions provider just as I predicted. IBM, Tibco and Progress seems to work on their offerings but there’s not much excitement but the steady flow of gradual improvements to their products. Which is a good thing. But not much to write about.

One inspiring news is the the new Event Processing in Action book by Opher and Peter is more or less ready. I knew it was a good idea to suggest Opher as a author to Manning. I did some non-rocket science analysis and decided rather quickly that writing a book will steal way too much time from my other work. Reading what Opher writes, I was right… And these two guys are way better authors than me anyway. Maybe I’ll return with a more practical hands on companion books some day which can be read after you got the theory in their book. Or hopefully someone else beats me to it, saving me the trouble…

So if anyone have some more inspiring news about the state of the event processing world, please post them!! 

Another good news is that I’m going to Dagstuhl next month (anyone wanna share a cab from Turkismuhle?) , that ought to be great fun. The last time I did not have the guts to give a presentation. But this time I think I will do, at least a short one. With that kind of audience, there’s not much that I can say that they don’t already know. But I realized that there’s at least one topic that I’m better at than they are. [insert cliffhanger]. As Opher would say, more later (in Dagstuhl)…

 

 

Share/Save/Bookmark

The Reakt CEP Rule Language

April 18th, 2010 Comments off

 

 Reakt – The ruleCore CEP language 

A White Paper from ruleCore

DRAFT

 

Introduction

The Rulecore CEP Language – Reakt! – When you need to react immediately.

Reakt is a language for complex event processing, or CEP for short. It is designed to provide a powerful and productive tool for developers allowing them to quickly create solutions for detection oriented CEP scenarios.

Reakt is not a traditional programming language. Reakt is a business situation description language. By using a declarative approach it allows the developer to concentrate on what kind of situations to detect and not how

The design goal of Reakt is to provide a way for organisations to react immediately to critical situations. It achieves this goal by finding related events from streams of inbound events. What events a critical situation consists of, and how the events are related, are defined by the user using Reakt. Reakt allows the user to specify conditions and temporal relationships which must hold in order for the events to be considered a noteworthy situation. When the situation is detected by Reakt, an user defined real-time report is created which provides actionable information about the situation.

Allowing the enterprise to react immediately.

This short white paper gives an informal description of the language and explains the different language elements using examples instead of formal definitions.

Overview

Rulecore Reakt is a small domain specific complex event processing language designed for detecting situations by observing streams of events. A situation is a formal description of a combination, a pattern, of events as they happen over time along with optional restrictions among the events. A simple example of situations that you might want to detect could be

"A vehicle has visited zone A more than 10 times during the last hour"

or

"Event A comes before event B, unless event C has been seen"

Main Reakt language features:

 

  • Continuous Evaluation – Designed to operate on live streams of events as they happen.
  • Declarative – Rules and other items are specified using a high-level declarative approach.
  • Modular – Rules are defined using modular and re-usable building blocks.
  • Temporal – Handling of time is an integral part of Reakt. Timing restrictions and other temporal conditions can be stated using a number of declarations.
  • Location Aware – Reakt includes built in support to understand location information and other geographical objects such as zones. 
  • Implementation Independent – The elements of Reakt are defined using standard XML and are implementation independent. Different implementations can be created in order to provide specialized execution environments.
  • Automatic Life Cycle Management – Rule instances are created and deleted automatically in response to events. Rule instances are analyzed and deleted if their situation is determined to be undetectable.
  • Dynamic Context Management – Each rule instance maintains its own virtual view into the incoming event stream. The view provides a window into the incoming event stream in order to create a dynamic context for rule evaluation.
  • Separation of Concerns – Reakt uses reusable blocks for;
    • Selection of events from the inbound stream
    • Rule life cycle management
    • Situation definition
    • Rule trigger reporting

 

The design goals of Reakt is to provide a language which allows the user to describe complex situations consisting of multiple events with non trivial temporal and geospatial relationships. The language is declarative. Lacking any procedural elements provides a base for formal verification and automated optimization and analysis of the language.

A design assumption made early in the language design was that is is likely that machines will use Reakt to create and modify rules more frequently than humans. The rate at which new rules need to be created and old ones modified is assumed to be high. Thus the language was designed to be easily understandable by machines and at the same time being reasonably human readable for system developers.

The current version of Reakt uses XML for its syntax. XML was chosen to take advantage as much as possible of existing knowledge among the developers, known standards and existing tools for generating and parsing. It would also be possible to create alternative syntaxes for Reakt. For example to create a more compact human friendly representation for business users.

The Reakt language was designed to support execution environments which fits into an architectural style called Event Driven Architecture (EDA). In order be a natural building block in an EDA, the ruleCore Reakt language and its supporting execution environment, the ruleCore CEP Server, was designed to be completely event driven. This purely event driven approach allows all systems in a distributed messaging architecture to integrate with ruleCore using simple events as their only communication mechanism.

 

The System Information Model

The System Information Model, or SIM for short, is both the name of the information model used by ruleCore CEP Server where all information about different items (rules, situations etc.) can be found and the name of the run-time data structure modelled after the familiar DOM model, commonly used to represent information originating from XML. The SIM is part of the ruleCore CEP Server implementation and not the language definition. But as all the language elements declared are executed against the SIM it is described here briefly. Different implementations can implement varying information models.

The SIM is used for various purposes, for example:

  • Listing available definitions – All definitions of items such as rules, views, zones, entities, situations and actions can be found in the SIM. Definitions are created using the systems events, for example AddRuleDef, AddSituationDef and AddActionDef.
  • Listing user defined events – Before an event can be sent into ruleCore CEP Server, it must be defined using the AddEventDef system event. The SIM contains all user defined events
  • List of rule instances – When a rule instance is created, it’s state and internal data structures can be monitored by querying the SIM. The ruleCore CEP Server provides a query mechanism using XPath. But other implementations might query the SIM using other methods.
  • Monitoring situation progress – As a situation develops, its progress can be monitored by querying the SIM.
  • Examine view contents – Each rule instance is executed in an unique context of events called the event stream view. The view contains a window into the inbound stream of events and contains only semantically related events.
  • Referencing items – When an item such as a rule needs to reference other items it is done using references through the SIM.
  • Component Specific Data – Each plug-in component that extends the engine creates an entry in the SIM and may add any component specific information.

 

The SIM consists internally of dynamic data structures which are updated as needed when the internal state of the ruleCore CEP Server changes in response to inbound events. These data structures have an external representation which is the user’s view of the SIM.

The external representation of the SIM can be treated as a DOM document which can be queried using XPath and transformed using XSLT. XPath queries can be executed against the SIM using the SysInfoQuery system event.

If is also useful to note that the ruleCore CEP Server uses events for all tasks. Special pre-defined system events are used to create rules and other items in ruleCore CEP Server in addition to monitor the run-time state of the rule evaluation.

 

Structure of a Rule

The main language element in Reakt is the rule. Reakt uses a class of rules called reactive rules to provide its situation detection capabilities. Reactive rules should not to be confused with production rules or other types of rules which must be explicitly evaluated. A rule in Reakt is never explicitly evaluated, its evaluation must be automatically managed by the execution environment in response to inbound events.

A rule consists of a number of elements, the main ones being:

  • Initialization directives - Specifies which events can lead to the creation of a rule instance
  • Termination directives – Specifies what causes a rule instance to be deleted.
  • The rule level – Specifies on what level in the rule hierarchy instances should be created.
  • Trigger Directives – Controls how and when to report Rule triggering.
  • The View – A reference to a view, providing execution context for the rule.
  • The Situation – A reference to a situation to track and detect situations.
  • The Action – A reference to an action, which will generate an event when
    • the situation is detected, or
    • if the situation is determined to be undetectable.

General Rule Attributes

Each rule has a name and a attribute which can be used limit the number of rule instances that can be created of a particular rule. A common usage of the limit is to create a singleton rule, of which only one single instance can exist.

Rules at every level can publish their trigger events externally so that they are visible outside of Reakt.

All rule declarations specifies a level. Every rule instance is created on a specific level in a hierarchy of rules. Level zero is the level on which inbound events arrive. Thus the lowest level for a rule is 1 (one). A rule will only see events from a level directly below it.

For example, three levels of rules where the rule at level one sees the inbound events:

<Rule name="New Location" limit="1000" level="1"> … </Rule>

<Rule name="Zone Entry" limit="1000" level="2"> … </Rule>
<Rule name="Zone Exit" limit="1000" level="2"> … </Rule>

<Rule name="Zone Visit" limit="1000" level="3"> … </Rule>

 

Rule Life Cycle Management

Rule instances are automatically created and deleted based on directives in the rule declaration section.

The <Initialize> declaration controls when a new rule instance can be created. All rule instances are created in response to events. The <Initialize> section lists those events which can lead to new rule instances being created.

Create a rule instance when an event of type GPSPosition arrives.


    <Initialize>
        <Assert>
            <Event>
                <base:XPath>sim:EventDef[@eventType="GPSPosition"]</base:XPath>
            </Event>
        </Assert>
    </Initialize>

The <Key> declaration is the unique key for each rule instance. The key consists of one or multiple properties of the init events.

    <Key>
        <Property name="Vehicle"/>
        <Property name="Zone"/>
    </Key>

The key declaration allows for easy detection of situations per something

 

For example, the above key declaration creates rule instances which are per vehicle and zone. So there would be rule instances created for each unique combination of vehicle and zone.

The <Terminate> section determines when a rule instance is deleted. The <Terminate> section consists of a number of directives which allows for creation of flexible termination strategies. A rule could for example be terminated when it has triggered three times, when it’s view is empty, on a specific date and time or when a particular event arrives.

 
    <Terminate>
        <Triggered count="3"/> 

        <ViewEmpty name="ZoneEntry"/>

        <Time>2010-01-31T00:00:00Z</Time>
        <Assert>
            <Event>
                <base:XPath>sim:EventDef[@eventType="Location"]</base:XPath>
            </Event>
        </Assert>
    </Terminate>

 

Rule Triggering

A rule may trigger when one of two things happen; the situation is detected or it is automatically determined that the situation is undetectable in the future. Depending on the terminate declarations a rule can fire one or multiple times.

   

    <Trigger>
        <SituationDetected/>
        <UndetectableSituation/>
    </Trigger>

 

When a rule triggers, its action part is executed. The action part creates an event and thus the visible result when a rule triggers is a new event, created according to your specification.

 

Trigger Reporting

Related to rule triggering is the reporting of the rule triggering. The triggering of the rule and reporting that triggering is separated in two stages. Thus it is possible to postpone the report of a rule triggering. For example, it is possible to report rule triggering, or multiple triggerings, each minute or when the rule has triggered five times or whichever comes first. It is also possible to limit the trigger reports so that only a specified number of reports are created. The most common case is to create rules whose triggering is reported only once.

   <Report>        

        <Every trigCount="10" timeframe="00:10:00">
        <Max count="234"/>
        <AtTermination/>
    </Report>

 

References

The rule also contains a reference to the rule’s view, situation and action. All references in Reakt are specified using XPath and executed against the SIM.

The view reference contains a reference to a view declaration. The view provides the context in which the rule is executed

 

    <Views>
        <ViewRef name="ZoneEntry">
            <base:XPath>sim:ViewDef[@name='ZoneEntry']</base:XPath>
        </ViewRef>
    </Views>

 

The situation reference contains a reference to the situation which is evaluated in the context of the view.


    <Situations>
        <SituationRef name="ZoneEntry">
            <base:XPath>sim:SituationDef[@name="ZoneEntry"]</base:XPath>
        </SituationRef>
    </Situations>

The action reference contains a reference to the action part which generates a new event when the rule triggers.

   

    <Actions>
        <SituationDetected situationName="ZoneEntry">
            <ActionRef name="ZoneEntry" eventVisibility="external">
                <base:XPath>sim:ActionDef[@name="ZoneEntry"]</base:XPath>
            </ActionRef>
        </SituationDetected>
    </Actions>


 

Complete Rule Example

Here is a complete example of a rule.


<Rule name="ZoneEntry" limit="1000" level="1">


    <!– Create rule instance per Vehicle and Zone –>

    <Key>
        <Property name="Vehicle"/>
        <Property name="Zone"/>
    </Key>


    <!– Create a rule instance then the Location event arrives,

         if one does not exists per the key above –>

    <Initialize>
        <Assert>
            <Event>
                <XPath>EventDef[@eventType="Location"]</XPath>
            </Event>
        </Assert>
    </Initialize>


    <!– Delete rule instance when rule has triggered 300 times, the view is

         empty of at the specified time or when the Reset event arrives –>

    <Terminate>
        <Triggered count="300"/> 

        <ViewEmpty name="ZoneEntry"/>

        <Time>2010-01-31T00:00:00Z</Time>

        <Assert>
            <Event>
                <XPath>EventDef[@eventType="Reset"]</XPath>
            </Event>
        </Assert>
    </Terminate>


    <!– Report rule triggerings every 10th triggering of every tenth minute

         or at rule termination, report a maximum of 234 triggerings –>

    <Report>        

        <Every trigCount="10" timeframe="00:10:00">
        <Max count="234"/>
        <AtTermination/>
    </Report>


    <!– Trigger rule when situation is detected –>

    <Trigger>
        <SituationDetected/>
    </Trigger> 


    <Views>
        <ViewRef name="ZoneEntry">
            <XPath>ViewDef[@name='ZoneEntry']</XPath>
        </ViewRef>
    </Views>

    <Situations>
        <SituationRef name="ZoneEntry">
            <XPath>SituationDef[@name="ZoneEntry"]</XPath>
        </SituationRef>
    </Situations>
    

    <Actions>
        <SituationDetected situationName="ZoneEntry">
            <ActionRef name="ZoneEntry" eventVisibility="external">
                <XPath>ActionDef[@name="ZoneEntry"]</XPath>
            </ActionRef>
        </SituationDetected>
    </Actions>


</Rule>


 

The View

The rule declaration contains a reference to a view. The view provides the context in which the rule is evaluated. The view keeps related events together and selects only interesting events from the inbound stream of events.

Each rule instance contains its own private view instance. The view contains a collection of events. The view is kept updated based the stream of inbound events. The view provides a dynamically changing execution environment for the rule as each rule instance is executed in the context of its view.

The view consists of a number of declarations, each specifying a property of an event that must be true in order for the event to be present in the view.

All these declarations are evaluated to determine which events are present in the view of each rule instance.

Example of properties available:

 

  • The type view property is used to include events into the view only if they are of the specified type.
  • The maxage view property defines the maximum age for each event in the view. You could for example use the age property to let each rule instance see only events from the past 10 minutes.
  • The maxcount property defines the maximum number of events in the view. You could for example use this property to limit the view to contain only the last 100 received events.
  • The match property defines which event properties must match in order for them to be included in the same view. You could for example require that the property CustomerID matches on all events in the view, thereby creating a view which contains events about the same customer.
  • The assert property defines an XPath expression that must evaluate to true for all instances of a specified event type. The assert property could for example be used to compare a certain element in the event body with a constant.


<ViewDef name="ZoneEntry"> 

  <Properties>

 

    <!– All events in the view must be of types InsideZone or OutsideZone –>

    <Type>

      <Event>

        <XPath>EventDef[@eventType="InsideZone"]</XPath>

      </Event>

      <Event>

        <XPath>EventDef[@eventType="OutsideZone"]</XPath>

      </Event>

    </Type>


    <!– All events in the view must be from the same vehicle –>

    <Match name="vehicle">

      <Value>

        <Event>

          <XPath>EventDef[@eventType="OutsideZone"]</XPath>

        </Event>

        <Property name="Vehicle"/>

      </Value>

      <Value>

        <Event>

          <XPath>EventDef[@eventType="InsideZone"]</XPath>

        </Event>

        <Property name="Vehicle"/>

      </Value>

    </Match>


    <!– All events in the view must be from the same zone –>

    <Match name="zone">

      <Value>

        <Event>

          <XPath>EventDef[@eventType="InsideZone"]</XPath>

        </Event>

        <Property name="Zone"/>

      </Value>

      <Value>

        <Event>

          <XPath>EventDef[@eventType="OutsideZone"]</XPath>

        </Event>

        <Property name="Zone"/>

      </Value>

    </Match>


    <!– Keep only the last 100 events in the view –>

    <MaxCount>100</MaxCount>


  </Properties>

</ViewDef>


 

Situation

A situation describes an interesting combination of multiple events as they occur over time.

The situation detection capability of Reakt have the following features.

  1. Declarative – Complex situations are described using a high level declarative approach, avoiding complex procedural solutions using traditional programming languages.
  2. Temporal support – Support for describing temporal relationships between events. Timing restrictions such as deadlines for detection can easily be added.
  3. Extensible – The situation detector is designed to be extended with new task specific detector nodes.
  4. Monitoring – The detector is designed to be monitored and thus the progress of situation detection can easily be tracked.

 

As a situation describes an interesting combination of multiple events as they occur over time, it must start somewhere. A situation starts developing when a specific initiator event occurs. This is the first event in what could possibly be a fully developed situation consisting of multiple events. This also means that a situation has an exact point in time where is starts developing, namely the timestamp of the initiator event.

The situation develops over time and can either be detected at some point in time or automatically determined to be undetectable. A situation can develop over long periods of time and consist of a large number of contributing events. The ruleCore CEP Server provides a persistent rule state allowing rule instances and their situations to survive restarts and unexpected crashes.

The progress of a situation, as it develops, can be followed by submitting a query event to the ruleCore CEP Server about the state of a particular rule’s situation detector. The degree of completion of a situation can be monitored to provide an early warning about a situation which could possibly be detected soon.

For example, detect when a vehicle has been outside a zone for at least five seconds:

<SituationDef name="OutsideZone5s">

  <Detector>

    <After timeframe="00:00:05">

      <Not>

        <EventPickup>

          <XPath>Views/View[@default='true']/Events/Event[@eventType="InsideZone"]<XPath>

        </EventPickup>

      </Not>

    </After>

  </Detector>

</SituationDef>

The above situation example is detected when the innermost event pickup does not pick up any events from the view five seconds after the rule instance was created. If InsideZone events have arrived into the view during those five seconds the situation is not detected.

A situation is defined using a tree with detector nodes. The <Detector> node is the root of the situation detector. Each node can be either true or false depending on its semantics.

One of the central detector nodes is the <EventPickup> node which selects events from the view. It selects events by executing a XPath query against the view. If the query returns any events from the view, the <EventPickup> node becomes true.

The detector is evaluated each time it is possible that changes in the view or temporal conditions in detector nodes can affect the state of the detector.

 

Action

Actions are executed as the last part of a rule’s evaluation in response to a detected situation, or optionally when it is determined that a partially detected situation can’t be detected at any point in the future.

An action is used to create a new event. The new event is called the reaction event and is used to notify external systems about a detected situation. Different events can be created for a detected situation and for undetectable situations. 

The outbound event created by the action is created using a XSLT stylesheet. The stylesheet is executed in the context of the rule and can access all the events that contributed to the detection of the situation. The stylesheet can also access the events present in the view at the time the action is evaluated.

 

<ActionDef name="OutsideZone">
  <Event>
    <EventDef>
      <XPath>EventDef[@eventType="OutsideZone" and @eventClass="user"]</XPath>
    </EventDef>
    <Body>
      <XsltBuilder>
        <Stylesheet><![CDATA[
          <xsl:stylesheet>
            <xsl:template match="child::*">
              <base:EventBody>
                <xsl:for-each select="user:Views/user:View[@default='true']/user:Properties">
                  <user:VehicleId><xsl:value-of select="descendant::user:MatchedValue[@name='vehicle']"/></user:VehicleId>
                  <user:ZoneId><xsl:value-of select="descendant::user:MatchedZone/child::text()"/></user:ZoneId>
                </xsl:for-each>
              </base:EventBody>
            </xsl:template>
          </xsl:stylesheet>]]>
        </Stylesheet>
      </XsltBuilder>
    </Body>
  </Event>
</ActionDef>


Reakt is a trademark of Rulecore KB of Sweden.

 

Share/Save/Bookmark

DataMentors – First commercial…

February 23rd, 2010 15 comments

DataMentors is a company I was not aware of previously. Apparently they are branding some of their products as CEP, with some interesting claims:

GEMS technology is the first commercial event pattern language that includes an operator to express causality in the moment. This new real-time CEP technology enables companies to simultaneously examine historical, current, and predictive data.

Not sure what causality in the moment is. But I’m pretty sure that several other vendors would not agree them being first commercial to do anything with causality.

 

Furthermore:

GEMS ability to instantly compile data from thousands of disparate data-streams and conduct nesting pattern evaluations quickly and accurately is dependent on DataMentors’ software. DataMentors’ processing speeds are necessary to enable the GEMS technology to deliver insights and models instantly to end users, which result in higher levels of accurately predicting future events.

which a description one would expect from a company doing CEP.  Once again interesting to see that another company chooses to position their products as CEP-something. It’s probably not done on random, so they must think that there is something to gain from calling themselves CEP and not something else. Which I like, as it shows that CEP is, slowly, gaining some traction.

See rest here

 

 

Share/Save/Bookmark

Why did Sybase get Aleri?

February 19th, 2010 10 comments

I have tried to google around for something about the Sybase/Aleri deal. There is lots of the normal "information" which is corporate blahblabla without any substance. But I found one piece of info that actually have something interesting in it about what Sybase might have in mind for Aleri:

"In addition to slashing latency, CEP can also help to reduce warehouse storage requirements and help tame problems that were heretofore too costly to solve. By conducting analysis of a stream as it arrives, much of needed analysis and aggregation can be done without persisting details to the warehouse at all. If your data has no retention requirements, other than your analysis needs, you may be able to use CEP to greatly reduce your warehouse costs."  – http://www.beyeblogs.com/sybaseiq/archive/2010/02/inastreamofgood.php

Analytic BI + nifty real-time front-end for the datawarehousing guys would seem like a pretty good use for the Coral8 engine, I just assume that they will use the Coral8 engine and throw away the rest.

Apart from that, I don’t think this deal will turn into anything significant for the CEP community. Sybase will add some real-time features and give some nice shiny toys for their capital market customers that can be used to game the markets even further. But I don’t think they will have a generic CEP engine to offer in the future.

 

Share/Save/Bookmark

Not CEP – Yet…

February 17th, 2010 Comments off

"SenSage 4 includes a highly scalable real-time correlation engine, the Scalable Alert Server (SAS). Correlation is based on the application of threshold and scenario-based rules against multi-source, real-time event streams" – http://www.sensage.com/products/sensage-40.php

I wonder how long it takes before this product carries the CEP label…

 

 

Share/Save/Bookmark

The new CEP Book – EPIA

February 12th, 2010 Comments off

At last I had some time to read the new CEP book from Opher Etzion and Peter Niblett. The book, Event Processing in Action, has an eta of april 2010. But there is a preview from the publisher Manning Publications. Allowing us to read an unfinished book is a brave move by Manning. A bit like introducing agile methods into the book writing process; release early and often.

I have a really good feeling about this book. Power of Events by David Luckham was the book that sort of defined the field. It got everything started and more importantly introduced the idea that event processing is its own discipline.

What is needed is a book that summarizes the ideas that have evolved around event processing since David’s book. I think that Event Processing in Action will be that book. My gut feeling is that this book will define the event processing field for the years to come. It does a great job of putting everything into context and explaining how all the bits and pieces in this new field are related.

The early access edition can be found here if you are interested in a preview: http://www.manning.com/etzion/

 

 

Share/Save/Bookmark

Sybase did buy Aleri

February 4th, 2010 1 comment

 

Now it is official: http://www.sybase.com/detail?id=1067153

Unfortunately there is no new information in the  press release apart from the fact that they bought something from Aleri for an unknown sum.

 

Share/Save/Bookmark

Is Sybase Buying Aleri?

January 29th, 2010 12 comments

 

Does anyone know if this is true? Is Sybase buying Aleri? No surprise if they were, see my earlier post on predictions for 2010…

 

 

 

Share/Save/Bookmark

Free CEP Tool for Trading

January 25th, 2010 3 comments

Here’s a free tool that claims it provides CEP for building trading apps.

 Here: project.xceptra.com/

 Download from here: http://sourceforge.net/projects/xceptra

Sounds interesting, don’t have time to look into it now…. (Note to self: must check later)

Share/Save/Bookmark

Summer Internships in CEP

January 19th, 2010 Comments off

Complex event analysis specialist: Duties include evaluating existing methods and developing new approaches for complex event processing, identifying meaningful events within a large pool of events, event pattern recognition and evolution of event patterns over time. The candidate must be currently enrolled in computer science or similar graduate program and should have prior experience in machine learning, data mining and text mining. Programming will be required and working knowledge of programming/scripting languages such as Java, Perl, Python and  Matlab, as well as sufficient familiarity with database systems are highly desirable.

This might be interesting to some of my readers. Full text here

 

Share/Save/Bookmark

License Cost of Sybase (Coral8) RAP is…

January 18th, 2010 9 comments

 

I just found an interesting interview with John Chen, CEO of Sybase, the interesting part:

I’ve heard about your real-time analytics apps for Wall Street. Yes, our complex event processing software for risk platforms. The financial vertical is so excited about it, they are turning into design partners. They want to handle both structured and unstructured data in a more real-time basis.

Was this how you were able to grow despite all of the bank failures we’ve heard about in the past year and a half? The funny thing is that although there were bank and brokerage failures, trading volumes never subsided. The algorithms behind the trades are getting more sophisticated. We sold lots of [Sybase] IQ systems to do counterparty risk analysis, not only in the U.S. and Western Europe, but in China, where the firms tell me they don’t want to repeat the mistakes the U.S. made.

Are you worried that the SEC will rule that real-time trading systems like these give big firms an unfair advantage over smaller investors and should be outlawed? No, because everybody can buy one.

Well, anyone with a certain amount of money. It’s not that much money. And pretty soon, we will be releasing a hosted solution. Even small hedge funds will be able to come in and rent time. We are releasing it by June. It will cost about $37,000 a year, or 25% of the license cost.

 

The last question is the interesting one. I suppose it’s Sybase RAP he is talking about. The one that is actually Coral8 if I got is right. So they charge a nice 37k*4 for it. Much more than Coral8 ever did. $148k for a license is pretty expensive for anything than firms toying around with money on Wall St. The point being, in my predictions a couple of posts ago I said that I don’t think that CEP is going to spread to mainstream use this year. With a price tag of $148.000 it still a solution to very few problems…

But its nice to see that CEP technology is worth a lot in the right places. I hope Sybase sells and rents a lot of these.

 

Share/Save/Bookmark

ruleCore Internals – Our GUI Approach

January 13th, 2010 2 comments

As some of you already know we have spent lots of time on user interfaces lately. It’s a complete nightmare to decide how to create a gui these days. There are just too many options to choose from. Traditional client or web client? Flash or Silverlight? .Net or Java? Which Java framwork and so on ad infinitum…

For user interface work, we follow some guiding principles:

  • All user interfaces as web based. Runnable in your favorite browser. The reason for doing only web based, as opposed to traditional fat clients, is that we like to have some flexibility on what kind of client the application runs on.
  • The output should be plain html and javascript. This opens up creative mashups where our user interface is a part of a greater whole in ways we can not anticipate. Users (and children) tend to use everything in the most creative ways that we ourselves can not think of. So, we just assume that we are stupid and our users are smart.
  • A system integrator using our GUI  should be able to change layout and the overall look and feel of the user interface.
  • User interfaces should provide some real benefits. That is, they must be easy to use. No stupid things like popping up a editing window where the user have to write a script or enter some XML.

 

This lead us to the following approach for user interfaces:

We have a rather traditional three tier architecture. The data tier with a normal sql database sits and the bottom, providing data to the business logic tier which in turn response to request from the web tier. The database have other clients too. So its design looks like one would expect from a traditional relational model.

The business logic tier uses JPA with Hibernate to provide a nice object oriented model of the database. As there can be other clients to this data we need to be careful in keeping JPA in sync with all the other clients. This is an area where JPA needs to do more work. JPA seems to assume that it is the only client that accesses the database. So you need to be careful when letting other clients to access the database. But overall we a pleased with the JPA+Hibernate combo. We use a couple of Hibernate specific extensions as  plain JPA lacks some critical features.

We use Glassfish+PostgreSQL plus some own additions to provide a multi tenant database environment. All user’s data is protected at database level, so there is no risk of two users seeing others data as the user needs to be able log in into PostgreSQL in order for JPA to get access to the data. This is done using some home brewed connection management in Glassfish. The normal approach is to use one single db login from the app server and handle all the security in app server code. This is something I think is really a bad idea as a single bug can allow users to see each others data. That’s something we can’t risk.

In order to stich everything together we use SEAM from JBoss. It provides us with smart components both in the business and web tier. Seam provides us with server side state management, which is invaluable in a web application. In the logic tier there are a number EJB components that provides an API to get business data.

The visible parts of the web tier is done using JSF and UI components from Icefaces. The Icefaces components are usable as they are in most cases, but for some special cases we need to add other components. Mostly JQuery ui elements. For example, there is no Icefaces data picker component which allows you to pick more than one date. Very annoying. Overall Icefaces is a good choice for GUI work, but I would like to see a bit more mature components. I think Delphi had more mature components back in 1995.

Icefaces uses a lot of magic javascript to provide its smooth server driven updates and it takes some tricks to get it to work with other javascript frameworks such as JQuery. To get different frameworks to work together is the biggest problem with our setup. There are a number of things that can go wrong when you need to get JSF, Icefaces, JQuery, Hibernate, SEAM, JPA, JSP and a couple of other libraries to work together in one project. But when everything is in place, it gives us a very flexible environment to work in.

We rely heavily on CSS to do the layout and look and feel for our user interface. The idea is to give the css to our clients and allow them to move around different elements in the gui and changes colors and other layout elements. Normally all layouts start with a paper and pencil, from there its straight to a prototype in code. We do this back and forth a couple of times before the design starts to feel right. We don’t use any gui tools for doing the layout of the web pages. It’s all hand built using JSP, Icefaces and CSS. It would be nice to have a tool for this but we have not found anything that works with the setup we have.

Here’s an example on how it might look, this is a page from FleetNotice, the GPS real-time alert management system for fleet managers that we built ontop of ruleCore CEP Server:

A screenshot from FleetNotice Fleet GPS Alert Manager 

 

The above example uses our standard Black&White theme. It’s the standard CSS that we base everything on. The idea is to first have something that is very clean and then start adding colors and other fancy graphics.

All components except from the date picker is Icefaces. In this example they look just like plain html input boxes. The benefits from Icefaces are apparent first when actually using the interface. For example the "Output" box is validated immediately when the user types something into it. Not when submitting the page. The data picker is a JQuery component. We prefer to use pre-built components and avoid creating our own gui components at all cost. We try to support most major browsers. But as we use Icefaces and JQuery we are basically supporting whatever they support.

 

 

 

 

 

 

 

Share/Save/Bookmark

Nothing to See Here, Move Along

January 12th, 2010 5 comments

Here’s an interesting article about CEP:

http://architects.dzone.com/news/complex-event-processing-cep

It touches an interesting and perhaps a bit sensitive topic; CEP is nothing new. The author also makes an assumption that CEP equals streaming sql. Which is the view many people have on CEP. I think it’s StreamBase and Coral8 that did a good job on marketing CEP in the early days as a streaming extension to SQL.

There are of course other approaches: declarative rules, prolog style factoid things and scripting languages specially designed for event processing. Just to mention a few.

One other, perhaps also sensitive issue, that the author touches is that many CEP vendors don’t do CEP. They simply perform calculations on streams of data. This is also true. If you were following the market that became CEP a couple years ago you remember that most vendors that push "CEP" started as streaming data processing vendors. At first they did not use the word event at all. Then at some point many vendors discovered that the CEP label started to stick. A quick re-branding and voilà, everyone had this thing called CEP. 

 

CEP is like a train, once it gets up to speed...

This does not make these data stream processing tools better or worse technically. But it confuses the users. They read about event processing in theory and then when they try out the tools they just get confused as the package does not contain what the label says.

Just to not get the reputation of that guy that hates streaming data processing and streaming sql: The SQL based tools are great! Every single of them. But are they CEP? Well, not sure about that…

But the fun part is that nobody agrees on what CEP is anyway. So whom am I to say that some vendor does CEP or not. The CEP label seems to live its own life and ultimately its up to the (paying) clients to decide if they appreciate a product which is CEP-something.

 

 

 

 

Share/Save/Bookmark

Interesting Vendor using CEP

January 11th, 2010 1 comment

Just stumbled across this:

http://www.starviewtechnology.com/index.html

Seems like an interesting use of CEP. It looks like they are heavy users of CEP, but not positioning themselves as a CEP company. Using CEP "merely" as a tool to build their solutions. This kind of companies are good news for CEP. Its soon time to talk about an "active tier" in systems architecture amonside the data, integration,logic and presentation tiers.

Share/Save/Bookmark

CEP Predictions for 2010

January 7th, 2010 Comments off

In 1989 GM bought Saab Automobile (The car company part of Saab, not the fighter jet part). One would assume that the people set to lead GM are among the best leaders and smartest corporate leaders available. Now in January 2009 GM is shutting Saab down and from what I understand they never made any profits from Saab at all.

Does this sound like something smart people would do? Given the power of GM and 10 years, how come they totally failed with Saab?

Saab Logo

 

Who’s Getting Who?

In 2010 there will be a number of smart people buying CEP companies. A post on predictions would not be complete with some guesses on who will acquire the most interesting companies.

In 2010 I predict that CEP will find its way to people outside the core event processing community. As a consequence people with no background in CEP will find out what we CEP companies have been doing the past years. Those that will find these companies or their technology the most interesting are probably those that are drowning in real-time data. I would not be surprised if a major stock exchange, something like Reuters, SCADA company or an integration company buys one of the CEP vendors in 2010. Actually my best guess is that a CEP company is bought to be used as a base for SCADA solutions. SCADA is almost never mentioned when talking about CEP, but that’s where there will be some action in 2010.

If would need to name a company that I think will be acquired first, it would be Aleri. Maybe really soon? Who knows. The open source project Esper is also a good candidate to be bought or assimilated by another open source company. Maybe RedHat or Sprinsource are in the mood for some shopping?

The New Generation

Considering the small amount of pure play CEP vendors available, will there be anyone left after the wave of acquisitions that I think will happen in 2010?

This brings me to my next prediction. New CEP vendors will emerge in 2010! I think we will see several vendors with interesting ideas on how to do CEP. These vendors are in a good position as they can learn from the current vendors and take the ideas and develop them further without any concerns for existing users.

I would guess that at least a couple of them will fail, but maybe one or two will do OK and it will be among those that the new cool ideas will come from. I don’t think open source will lead the way here. From what I see, the open source community is good at taking existing mature ideas and creating good implementations of them. Not inventing new concepts and ways of doing things. Something that is required for the next wave of CEP. I have the distinct feeling that the current CEP tools are just the first wave. There will be at least a couple of waves before things settle and we get some kind of collective agreement on how CEP should be done. Compare to SQL in the database world.

The Great Escape from Wall Street

To many people CEP equals algo trading and other kinds (legal) tricks for gaming the markets. Several event processing companies talk a lot about capital markets and less about other application areas. It’s not that there’s a total lack of efforts in trying to capture other markets. But still, capital markets are where many vendors have done OK.

In 2010 I think that many of the leading CEP vendors are trying to figure out how to break out of the world of finance. I think they would love to find new markets and have started to probe into various fields in 2009. In 2009 many companies at Wall St. took some beating and I bet this made the life of the sales reps at the CEP vendors a bit more, well, interesting. My prediction is that they won’t come that far with the great escape in 2010. I think the vendors will find that the capital markets will suck up all their resources and moving beyond selling very expensive solutions doing all kinds of financial magic and trickery is not at easy as is sounds.

Driving in Snow

This year I have been driving in snow for longer than most winters. And the winter is not over yet. We have had temperatures around -10 C for a long time here in south Sweden where I live. Just a couple of hours to the north, they had -40.4 C (about the same in F) this night.

Snowtires from Nokia

Here my idea was to have some clever transition from snow driving to CEP, some authors are really great at doing that. But it seems that I’m not one of them. So I’ll continue just a little bit more about driving in snow before getting back to CEP.

The above tire is actually from my very own Saab. I read in the news that today is the last day for Saab. So now I’m driving a car which is not produced anymore. It will be interesting to see what that does to prices and availability of spare parts.

I think my transition had to do something with Saab being discontinued or that Saab have always had a performance profile. The Turbo Saab is somewhat of an icon here in Sweden.

The Cult of Performance

Whenever you talk to with other vendors, system integrators, clients, prospects that have heard about CEP they constantly focus on performance. It seems that the main perceived benefit of CEP is performance, and performance alone.

It’s simply seen as a way to do things faster than competing offerings. This is both good and bad. It’s good for CEP to be viewed as something that is needed when high performance is required. But it’s bad because Moore’s law will outrun us. If performance is the only selling point, then you can be sure that a normal desktop PC will replace you within a couple of years. Also, compared custom built code in, say C, any generic engine will most likely be slower.

But in 2010 I predict this will change. In 2010 CEP will find uses in other areas where speed in the not main selling point. I think that agility is a word that will be used more and more when talking about CEP in 2010. CEP solves many problems in a natural way, even if they could be solved using other tools. This is something that will be discovered by users outside the CEP community. We, the CEP community, know this already so it’s not a very bold prediction.

Show Me The Money

2010 will be the year when all kinds of psychedelic business ideas with no chance of ever generating profits will fail. Now it’s time to start making profits. Now more playing around. This is good news for CEP and bad news for Twitter and others. CEP is what I call a old school business idea. That is, there is a plan how to make money by providing something of value to a business. Our clients make money, we make money; everyone is happy.

Still, 2010 will not be an easy ride. Considering the amount of investments made in many of the CEP vendors, there’s bound to be some pressure to increase revenue and start making considerable profits. For example, a wild guess would be that the StreamBase’s investors would like to get back at least $600M. So how much profit do you need to make each year in order to justify that valuation? There’s lots of CEP licenses that need to be sold. The dependence on the capital markets can be a problem here. A guess would be that at least one of the current vendors will see some revenue related problems in 2010 in the CEP area. For the smaller vendors mainly doing CEP this can be disastrous. For bigger vendors where CEP products is just one part of the portfolio you might expect re-branding and other kinds of creative moves when they discover that selling CEP takes more time than they thought.

It sounds like I think that there’s no market for CEP. There is. But viewed from a customer point of view the CEP market is in a tricky phase. No standards, no agreed upon way to do CEP, we don’t even agree on what CEP is. This is confusing for the customers and I think many of them will build instead of buying during 2010. But the demand will increase, CEP solves real problems providing real benefits.

A Major Event

In 2010 I think something critical will happen that puts CEP in the spotlight. A customer success story or something that the press will write about. This will be the starting point of spreading CEP.  Unfortunately I think that the news about CEP that everyone will talk about can be rather negative. Considering the greed culture of Wall St. and the focus of CEP on capital markets, I would not be surprised that some clever uses of CEP will play a major rule in another PR disaster at Wall Street.

Another, not very bold, prediction is that there will be at least two CEP books published in 2010.

 

 

 

Share/Save/Bookmark

Who Cares About CEP?

January 6th, 2010 Comments off

Some (un)interesting facts about you, the reader of my blog:

  • There’s been more of you during the year. No dramatic increase, but some 30% more.
  • You guys eat lot of bandwidth! 30% more of you consume 4 times more! It must be the images.
  • On average, you come back five times.
  • You read about five blog posts, strage correlation to above fact.
  • You visit the blog evenly throughout the week, but Wednesday is the most popular "Marco on CEP" reading day.
  • It seems that reading the blog is something you do just before going home from work, 4pm-5pm is the most popular reading time.
  • Top countries you come from: USA, UK, France, Mexico, China, EU, Canada, Switzerland, Germany, Hong Kong, Denmark, Russia, Netherlands, Israel, Japan and Austria.
  • Top bandwidth wasting spiders: Yahoo Slurp and MSNBot.
  • Most of you do Windows (42%)…
  • But suprisingly most of you have the good taste to avoid IE, only 20% come here with IE.
  • If you found your way here by searching you most likely came from Google (57%) or billg’s search engine (38%). The old time search favorite AltaVista (if you are old enough to remember) reports eight (yes, 8!) hits.
  • You made about 200 comments and 2000 spammers tried get spam comments through the filters. If I remember correctly, no spam comments managed to get into the blog.

 

 

During the past year you have also seen some random photos in many of the blog posts. These are all my own. Most taken with my cell phone, so they are not as good as you would expect if you hire me to shoot your wedding or for other work. I have received a couple of mails asking if there is any connection between the pictures and the blog posts? The answer is; no. No connection at all. Just random images to break up the text. For those that don’t know it, I’m also a photographer. The above photo is actually from my back yard. It’s cold and there’s lots of snow here in Sweden.

 

 

 

 

Share/Save/Bookmark

A Must Read

January 4th, 2010 2 comments

I don’t have time to write anything today, but here’s three posts from the blog of Hans Gilde that I think everyone must read: one, two and three.

 

 

Share/Save/Bookmark

New Open Source CEP Platform

December 28th, 2009 2 comments

I have now added ActiveInsight into the vendors list.

So now there’s five open source projects to choose from when you something really cheap* (= zero dollars in license fee). I have not yet looked into their product in detail, but their web page says all the right things, so it seems that they understand this CEP thing at least on presentation level. If someone have used their product, please share your expericeces. What would be most interesting to learn is how they compare to the other open source products (Pion, Esper, Drools Fusion and IEP) . 

It’s a good start for the next  year to see another open source product in the CEP space, I hope there will be a couple of more in 2010. At least I heard rumours about a major fork to Esper that is being developed with a rather large number of developers on the project.

2010 is soon upon us. Maybe it’s time to be a Gartner wannabe for a while and do a bunch of predictions on CEP… Maybe in next post, so stay tuned

 

 

 * If you still prefer to pay for your CEP software, there’s Progress Apama, Tibco Business Events, IBM BusinessEvents, Rulecore, Aleri, StreamBase to choose from.

 

 

 

 

Share/Save/Bookmark

All is Good

December 23rd, 2009 Comments off

Soon it’s Christmas, at least in some parts of the world. The holiday that once had some religious meaning. Can’t even remember what it was all about, says a bit about my religion skills…

A couple of weeks ago I took a look at StreamBase, who are kind enough to provide free evaluation downloads, and they are certainly starting to get all bits and pieces in place. If you need to do real-time calculation on a data stream, this is probably one of the best ways to go about it. So stop all that custom development that you first thought of. Aleri/Coral8 is in the same camp so is might be a matter of taste which one to go for.

So if you have a continuous stream of data, perhaps some financial information that changes all the time like prices, then stop developing yourself and look at these tools instead.

Next I tried to see if I could find more about Apama, and Progress is going in the right direction with Apama. Not only that Mr. Apama is now CTO of Progress, but I like their approach with rules (working at ruleCore that would make sense, would it not? ;)  ) Expect lots of interesting developments from the Apama team next year. Maybe integration with other technologies like BPM engines?

A friend I know at IBM said that we could expect that it takes a couple of years to IBMify anything that they buy. The start is slow but when they get the speed up they can at best be unstoppable. So next year should be the year of AptSoft, er, IBM Business Events (with or without space? I can’t seems to never remember if it’s IBM or Tibco that uses the space there)

Speaking of Tibco, I think Tibco’s interest in selling CEP software is a good sign that there’s money to be made in the CEP field. Being the masters of building wealth by selling infrastructure software.

The presence of these big players in the CEP field is what actually makes "CEP Software" its own segment. Now we see that customers are actually asking for "solution based on CEP", not that our beloved customer always know that they are asking for. But at least they are asking for it. I would say that this formation of a CEP market is thanks to the collective marketing efforts of all these big vendors. We smaller vendors can’t create a new field within IT. But we can work in one, created by the big ones.

In addition to the bigger ones, there are a number of small vendors too. Providing parts of the solution which sometimes might be a better solution, for many reasons, than going with the bigger vendors. There’s of course our very own ruleCore, there’s the free and gratis open source Esper, we have EventZero, SQLStream, RTM,  Pion, WestGlobal, Truviso and other small vendors all building companies around CEP technology. All with their own twist to it.

What about Microsoft? Did I forget them? No, not at all. There’s StreamInsight. But it is way too early to say in what form it will be available in the future. But at least someone at Microsoft thinks that CEP is worth putting developer dollars into. Somebody did convince his manager to give him a budget to build this CEP thingy and actually got an approved budget to work with. Another very good sign. But I would expect that, following Microsoft tradition, that their offering will be mostly usable in a pure Microsoft world. Don’t expect something that fits smoothly into your brand new EDA/SOA master piece. I would guess that the same is true for Oracle’s CQL. CQL adds interesting capabilities into their RDBMS, which is good. Provided that you use it. For others, it might not be that interesting. I don’t think anyone buys a Oracle license just for CQL.

That sort of sums it up. If we can avoid abandoned open source projects, companies that run out of cash or products being dropped we can look forward for a very exciting year for CEP in 2010.

 

Share/Save/Bookmark

Difference Between Events and Data

December 14th, 2009 2 comments

With Christmas approaching rapidly I struggle to get a ton of small tasks done before it’s time to take a couple of days off and eat way too much food and candy. This year I actually hope for some snow. Here it starts to get dark at 3pm or so, with some snow it would not at least be completely dark. And of course everything looks prettier with some snow and the sounds of the city are much more softer with snow on the ground.

 

Lately I have been reading Event Processing : Designing IT Systems for Agile Companies by Mani Chandy and Roy Schulte. They present a good list of principles an event driven application should follow in order to actually implement EDA:

  • Report current events. Things that happen right now. Not (old) historical data
  • Pushes event - A producer creates and event and publishes it. Not the other way around. In EDA, a system never queries for event. It receives them.
  • Process events immediately – Don’t store events and query them later, that’s a task better left for databases
  • Know nothing of event destinations – Just fire away events and assume someone else will route them to proper destinations.
  • Events are not commands – You don’t know anything about event destinations, per above bullet, so you can’t command them to do anything.

 

So if you look at a CEP system, which should naturally fit into an EDA. Then the CEP system should obviously follow the principles above. (advertisement: ruleCore CEP Server does, it was built to be a component in an EDA)

With an EDA and lots of available event processing systems that you can use as high level components, we have a very smart way to assemble enterprise wide systems. This is something SOA is not very well suited for. Everything is too coupled in SOA. But with a nicely designed EDA and a bunch of CEP, or other event processing agents, you are a step closer to actually creating an EA which your CEO will love.

So to my original question. What is the difference between data and events? Data is something that is your primitive entity that holds business information in a tightly coupled SOA or database centric architecture. Events are something carries around your business data in an EDA.

When moving from databases and SOA to EDA, you need to stop having a data centric view of the world and start thinking of events instead. Otherwise your EDA project is doomed.

If you look at the bullets above. You can learn a couple of things:

Report current events: If multiple systems receive the same report (event), they must somehow be able to know that it is the same report they are looking at. So events must have globally unique id.

Pushes events: If some other systems are to push an event to me, I need to know how the event is defined in order to make sense out of it. So everyone will need to share event meta data 

Process events immediately:  Later is too late. So I can’t use a query to process the event I receive as I need to do it now. Not query later.

Know nothing of event destinations: The implication of this is that I really don’t know who is listening and on what. So I need to publish events whenever I do something some other entity might be interested in. Now or sometime in the future. So basically you need to publish every potentially interesting event from every system.

Events are not commands: SOA style you know lots of things about other systems and know what you can ask them to do. In EDA, you just sprinkle around events and hope for something interesting to happen. This scales way better and does not cost a fortune to manage.  

So before you can ever dream of having a nice EDA in place with CEP components in place doing all kinds of interesting processing you need to start thinking about events and not data. Programmers are used from kindergarten to think in query/respond patterns so this is something that will take some time to get used to. So I still think EDA and CEP in the mainstream is at least a couple of years away.

 

 

 

 

 

 

 

Share/Save/Bookmark

New CEP Player?

December 3rd, 2009 1 comment

 

Note to self – look into these when time permits: http://www.activeinsight.net/

 

 

Share/Save/Bookmark

So, What is This CEP Good For?

November 26th, 2009 2 comments

When talking to other developers I need to explain, at least once a week, what this CEP stuff that I’m working on is good for.

Developers, with a slightly simplified view of the world, falls into surprisingly few categories.

- There’s the database guys, they solve everything with a database in the middle.

- There’s the Java crowd, everything is built around a application server. They don’t like the database guys.

- Then there’s the poor souls (a joke, I promise) stuck in .net lalalaa land. They use at least two products from Microsoft in each solution. They fear the Java crowd.

- Then there’s the free spirit Linux coder. He (She…) codes in php, mysql, python, perl, bash or whatever it takes to make it work. They never understood why the others complicate things.

That’s it. Ok, there’s the wannabe coders too. They write macros in every application that supports it. And they proudly display their achievements to other non-coders.

So, for this crowd (drove, sloth, wake, train, murder, charm, crash or whatever a collection of programmers is called) I often need to explain why we need just another technology…. easy. yeees…

 

From now and I’ll try to explain things using pictures and non-technology. Here’s my first attempt:

 

FleetNotice - Geofences and more.

 

This is a screen dump of FleetNotice (think real-time temporal geofence and much more), an application built ontop of ruleCore.

Basically what is does is to tell a poor guy who is sitting at his console looking at 348 couriers moving downtown manhattan if all his couriers are doing the right thing. Or to be more precise, it tells him when someone is doing something they are not supposed to, otherwise it shuts up. Looking at 348 moving icons and trying to figure out if somebody is doing something wrong is mildly fun. So he calls in help in the form of FleetNotice.

So, back to explanation. What if you would be required to code this application without CEP? Pick your favorite tool – Application server, database or just plain code.

How long would it take? How complex would the resulting application be?

With a CEP server like ruleCore it’s just a matter of a couple of rules. About 20 or so to do more or less all types of monitoring that a sane person can think of.

FleetNotice can produce alerts like this without breaking a sweat:

"Alert me if Couriers Ben, Jerry and Mr Smith diverts from their designated route for more than five minutes and they take more than 20 minutes between the waypoints (40 minutes is ok if it’s between 4pm and 6pm on fridays, except last friday of month), but only on working days. Also alert me if the courier does not arrive before 6pm to it’s destination and alert me also if he does not leave the starting point before 1pm"

And to add to misery you must deliver the alert within one minute to the operator and if the server reboots in the middle you really can’t loose track of things. And yes, there’s not only Ben, Jerry and Mr Smith in reality. I made those up. In reality they are thousands of moving objects.

So, there’s the case for CEP that most developers understand. Or at least they slowly start to appreciate the beauty of CEP. It’s not a replacement for their beloved databases or application servers. But for the right type of problems, it’s feels so much more natural.

 

Get it?

 

 

 

 

 

 

 

 

 

 

Share/Save/Bookmark

State of the CEP

November 15th, 2009 3 comments

I realized that I have not had any time to do some creative googling on CEP for long.

I tried to get a feeling on what kind of progress is made in the world of CEP.

My first stops didn’t require any googling at all.

Old timer Aleri which bought (merged with or whatever…) Coral8 seems to be doing alright with customers in the capital markets. Sort of what I predicted, that Aleri would be marketed more or less as a provider of tools for the capital makets and not a generic CEP platform. But no news on what they are doing with the Coral8 they bought. Some googling reveals that many of the Coral8 team left and are now on other positions. So Aleri will indeed have a interesting exercise in bringing Aleri+Coral8 into a coherent product.

StreamBase seems to follow Aleri and talk mostly about different kind of things in the capital markets. The language of capital markets is just too strange "Dispersed liquidity amongst multiple FX venues leads to an increase in trades, a decrease in order sizes, and makes it extremely difficult to gain complete market visibility. This results in inefficient executions and higher execution costs", say again? So I stopped after two clicks on the StreamBase web site.

I tried to figure out how long the assimilation of AptSoft into IBM have gone and it looks like ongoing progress. Lots of things are in place but large companies work slowly. I tried to do some googling and asking around and it seems that IBM don’t have a single customer on BusinessEvents in Sweden. Yet, I hope.

For Generation Gratis, there’s Esper which are continuing development and pusing out new releases now and then. Gratis don’t pay the bills so there’s an traditional license for the "pro" version of Esper. Latest news is that the HA (High-Availability) version is now finished, in the pro edition. Good work by the Esper team, I know how painful these things are to add to an existing product. I have not tried it, but the marketing material contained some impressive features.

The EPTS have had some additional meetings and there seems to be some progress, but too little and too slow in my opinion. Although I can’t really complain as I’m partly (very small part though) responsible for that as I have not had time to do any EPTS activities at all. Sadly.

Progress Apama seems to be one vendor that are trying actively to reach outside the capital markets. There’s mention of work done in transportation and logistics (good choice I must say, this is our (ruleCore) area of interest too) , telco and energy. With the size of Progress, not too big and not too small, my best guess is that Apama will be one of the most interesting solutions in the future. (alongside ruleCore ofcourse ;)  )

One of the most secret and perhaps best CEP tools, Agent Logic,  was acquired by an integration company a while ago and it is hard to say what they are going to do with it. But now there’s one less pure play CEP company around. This seems to be a trend which I’m not sure if it is good or bad.

Truviso seems to have some really nice things going on that I need to look at some day. If you need less capital markets and more CEP then my guess is that Truviso is a good candidate to include in your evaluations.

I think progress in CEP world is going in the pace I anticipated. CEP requires that developers learn a new way of thinking and that will take some time. So my 2012 mainstream guess a few years back is still valid.

Meanwhile, we have lots of interesting things to work on. Back to some fancy GUI coding here at ruleCore HQ…

 

 

 

 

Share/Save/Bookmark

A Business Case for CEP

November 11th, 2009 Comments off

Ever wondered why you need CEP:

Traditional tool at t+30 minutes: Here’s a report that hereby notifies you that you just lost $9M.

CEP Tool at t+1 minutes: I just detected a situation which is an indication of ongoing fraud.

 

 

"Over 130 different ATM machines in 49 cities worldwide were accessed in a 30-minute period on November 8," Agents Rice said. "So you can get an idea of the number of people involved in this and the scope of the operation."

Here is the amazing part: With these cashers ready to do their dirty work around the world, the hacker somehow had the ability to lift those limits we all have on our ATM cards. For example, I’m only allowed to take out $500 a day, but the cashers were able to cash once, twice, three times over and over again. When it was all over, they only used 100 cards but they ripped off $9 million." – from here

 

Share/Save/Bookmark

Who’s Time is it Anyway?

November 6th, 2009 3 comments

So… if you find two times laying around in a database, say 9pm and 6am, how would you (and the amazing CEP software that you are writing) calculate the number of hours between 9pm and 6am the next day?

Sounds simple? 

Well, as we all know assumptions are the mother of all fuckups.

The first assumption that is normally made is that these two times are times in our current time zone.

The next is that these are times both from the same time zone.

These times are not usable is you don’t know for sure what time zone they refer to. Your 9pm does not happen at the same time as mine.

Normally, if you come this far, the next assumption seems to be that is enough to have an offset from CET for each of these times. So you would assume that 9pm CET-10 and 6am CET+4 would give you the correct answer.

Wrong again.

You need to consider the evil of daylight saving time. If some countries and regions time is shifted forward and backward twice a year. And the beauty of it is that the rules for when this is done is specific to regions and coutries. So countries lying in timezone CET+1 could have different rules for when daylight saving is done.

Another assumption is that the days on which daylight saving is done never changes. Wrong too. They don’t change too often. But the do change. So basically you need to look this up from some reference data which need to be updated every day in order to stay on top of things.

So if you have come this far you might get it right.

First, you need to know in what time zones each of these times are assumed to be. You need the specific version of the time zone. For example if the first time is a departure time from Cocos Islands you need to know that they might be at GMT+6:30. Yes, another complication. Not all time zones are at an even hour boundary. If the other time is an arrival time to Australia and their Central Western Time, they might be at GMT+8:45.

So by now you might have realized that a time like 9pm is not usable if you don’t know in what location it is assumed to be in and what day it is.

You need the exact date also when calculating the difference between 9pm and 6am the next day as it might be that night daylight saving kicks into effect, and this would mean that you either skip on hour or add one magic hour.

Basically this is not rocket science. But there’s lots of small things to consider and most of the times developers will get this wrong.

Try testing your CEP software. Specify a time period which spans over a night when the daylight saving adjustment is done and see if it does the right thing.

 

 

 

 

 

 

 

 

Share/Save/Bookmark

Wintertime – Did your CEP fail?

November 1st, 2009 Comments off

A couple of days ago we changed to wintertime here in Sweden. This is done by adjusting the clock one hour backwards.

Later on we adjust back to summer time again. So two times a year the clock is adjusted on specific days.

Sounds simple? Right… For example, here’s a simple thing that most get wrong:

How many hours are there between 9pm and 6am the next morning?

answer and explanation in next post ;)

 

Share/Save/Bookmark

A New CEP/EDA Book

October 23rd, 2009 Comments off

Past week I have been reading a new book on CEP/EDA:

 "Event Processing – Designing IT Systems for Agile Companies" by K. Mani Chandy and Roy Schulte

It approaches both EDA and CEP from the conceptual and business angle. Although I have just read a couple of chapters I can say that it’s a good read for anyone interested in CEP.

There seems to be no or very little technical detail in the book. It’s more about the ideas behind CEP and tries to explain the business case for CEP. The first chapters gives and answer to "why event processing?" and "why now?"

 As there are no books at all about the new era CEP this is a welcome addition. Plus it’s written by two people that have a place in the CEP Hall of Fame. Even though Luckham’s Power of Events kicked off the CEP area, a lot have happened since that book. This neo-CEP needs new books as the ideas have matured and now weunderstand better where CEP fits into the big picture.

So get it and read it. It’s easy to read as there is not technical details. For more technical book you’ll need to wait for Opher’s book.

 

 

Share/Save/Bookmark

Cloud – What Deployment Options?

October 19th, 2009 Comments off

I did some googling to see what deployment option various Cloud/SaaS products offer.

I’m doing some thinking on what route our future cloud service strategy should follow. As of now, I see three major ways of delivering ruleCore as a cloud service:

1) Build data center yourself (Well, not yourself as in you personally, It’s more about buying someone to do the work). Get a number of servers and some storage and own everything yourself. It’s will cost less (yes, google/amazon are not that cheap) if you’re going to do lots of processing. The drawback is that we will be sitting with lots of hardware which needs some life cycle planning and possible rather large investments now and then.

2) Build support for deployment into a well known cloud. Like google or amazon. The benefits are you are getting some brand recognition and an execution environment with a high level of confidence built into it. There’s little internal selling to do when deploying into these as people tend to trust big players more that small. The drawback is that third party cloud services will be very expensive when you need lot of continious processing power.

3) Build a vmware (or other virtual server) kit that our customers can deploy onto which ever hardware they want. It’s more job for us and updates, patching and that kind of stuff requires lots of work to be completely automated. In 1) and 2) we don’t need to automate every single task. Some tasks are not worth automating. But if our clients are running on their own without us accessing the servers everything need to be automatic.

A fourth would be to sell an appliance, but I don’t like those so that’s not an option.

The major question is what our customer will prefer in a couple of years…

 

Share/Save/Bookmark

ruleCore Internals – The Sequencer

October 1st, 2009 Comments off

Rulecore is built to be used as a component in a distributed environment, the buzz-word compliant description would include some use of SOA and perhaps EDA with some mention of ESB. Our definition of component is a rather large box. It’s not a Java bean or .net assembly or anything of that size. Think more of it as a stand alone server, which you talk with using events.

As a component of a distributed environment we must assume a heterogeneous environment. That is, lots of different systems with no central authority controling them all.

This usually (almost always) implies the use of several unsynchronized clocks and varying event transmission times. As a result of this, events arriving to ruleCore will in nearly all cases not be picked up in the same order as they were originally emitted.

This is important, so I’ll repeat: 

- Events can be sent from multiple sources which do not co-ordinate the event generation process in any way.

To make the rule authors life a bit simpler, the ruleCore CEP Server creates one single unified event stream of all these inbound events. This unified event stream have two nice properties:

  • All events in the stream are arranged in order by ascending time.
  • All events have unique timestamps, that is you don’t find two events with the same timestamp.

So, the rule author does not have to care about where the events come from and can assume that they are all neatly ordered.

To allow for receiving events from un-synchronized event sources, the ruleCore CEP Server conains a sub-systems which we call The Event Sequencer.

The Event Sequencer makes sure the requirement of an ordered event stream is fulfilled at all times by putting the incoming events on hold for a certain amount of time before releasing them to the ruleCore engine. The engine is where the actual rule evaluation is done. The maximum amount of time for which the event is put on hold is a configurable parameter, making it easy to adapt the sequencing to the particular operating environment.

Incoming events whose timestamp is older than the maximum age are instantly rejected. Incoming events with a timestamp in the future may or may not be kept for sequencing, this is a configurable option.

The fact that two events can’t have the same timestamp might feel a bit strange. Can’t two independent sources generate an event with the exact same timestamp? Well, yes they can.

But life would be much, much more simpler if they could not.

So we do some tiny tweaking of the timestamps to make sure that no two events happen at the same time. If the have the same timestamp, we create an synthetic ordering. This might feel a bit uncomfortable from a theorethical viewpoint. But in practice it works great and simplifies things a lot.

For example, when creating a rule which should react to a sequence of events, things would get a bit complicated if we would could not assume that any two events are always after each other, in some order. The the semantics of a sequence, for example, would be overly complicated without gaining too much real benefits.

As events are (in the ruleCore event model anyway) notifications about some real-world activity, it’s very rare that two events actually happen at exactly the same point in time given enough timer resolution.

Also remember that ruleCore is build to run in "business time". That is, it deals with sequences and time periods which are on a scale that makes sense in a business environment where humans are involved in the processes on which the rules of ruleCore reacts to. Weeks, days, hours minutes are the common scale and it’s very rare that seconds are used in reality. Sub-second timings are seldom of interest when dealing with some kind of business process involving actual humans.

 

 

 

Share/Save/Bookmark

ruleCore Internals – Our dev env

September 27th, 2009 Comments off

Continuing my series of ruleCore Internals today It’s time to look at our development environment… So if you’re not a geek. This is not interesting to you.

 

Work here is done completely on Linux. Everything runs Linux. The servers on which the ruleCore ‘cloud’ is running are Linux and so are the developer’s workstations. We use Linux as it’s the best tool for developers. It gets the work done and allows us to be flexible as it’s easy to find tools for all parts of the development cycle.

But lately we have starting to see Mac as an alternative. There are a number of small problems with Linux which might lead us to Mac some day. We love tools that just work, so that we can spend more time creating ruleCore code. With Linux,  we can spend hours with seemingly simple tasks.. Like trying to figure out why printing suddenly stopped working? Mac OS X seems to be a bit more polished and "just works", so we’ll certainly keep it on our radar screen as an alternative for developing on. I would love to see see a more polished Linux distribution which works in a commercial software development setting where there’s always too little time to get the next set of features ready.

Under Linux we write code (obviously). Most of the code is written using Netbeans. Why not Eclipse? Our experience shows us that we have much less problems with Netbeans. We prefer to spend time coding and not fighting with our IDE. Basically we don’t need any advanced features from our IDE. Basic editing and debugging is enough.

For source code management we have our trusty subversion. Normally we check out and commit from within inside Netbeans. But sometimes the subversion plugin breaks down and we need to use the good’ol command line.That’s one of the strengths of Linux, you can most of the times track down problems and find workarounds. Compared to a Microsoft environment where finding problems can be totally impossible and you have to spend days with reinstalling everything.

Most of the code is written in Java and Python. With some additional Unix shell (bash) scripts to glue everything together. Both Java (offcourse) and Python is well supported in Netbeans. Java support just great but sometimes the Pyhon mode behaves strangely. That’s basically our biggest complaint against netbeans. It’s bad support for Python. The other thing that could improve is how to share projects among developers. It’s a pain to check in everything required to run a project. But overall netbeans is a good tools and gets the work done (Well, not in the same class as visual studio from Microsoft, but it’s enough for our needs…)

When coding in Java we use Glassfish as our app server and PostgreSQL as database. For GUI work we are in the framework hell using a clever combination of JSF, Seam, JPA and IceFaces. Java and all it’s frameworks are great in one way, but takes some time and skill to set up everything.

In the Python world we tend to use just plain Python, no frameworks or few other dependencies. So all Python coding feels very simple as there is not multiple frameworks to learn, just Python.

Almost forgot. There’s actually another database besides PostgreSQL used; BerkeleyDB. It’s used for internal purposes by the engine to provide the basis on which we build transactional crash recovery.

When everything is done, it’s deployed on Linux too. We don’t run those servers ourselves. There’s other guys that are awesome in building vmware clusters with all kind of features for scalability and uptime so we really don’t want to do that ourselves. So we just buy processing power and storage from these guys.

We also use the Mule ESB as a way to transport and distribute events. We don’t want to spend time in implementing transport protocols for event transport or spending time in creating integration infrastructure. Mule gives us that more or less free. We’ll not completely free. We had to extend Mule to read it’s configuration from a database (postgres) and do the configuration programmatically instead of using the standard way of XML. Mule comes with so many transport protocols so we can easily get events in and out of ruleCore to just about every system out there.

The event sequencer is running as a component inside Mule. It could run in an app server of as a stand-alone service but it fits nicely into Mule for now.

The most common question I get about this setup is why we use Python? Is not Python very slow? Well, it’s slower that Java most of the times. But sometimes developer productivity is more important than raw speed. My guess is that we do five times more in Python than in Java. With the event-driven architecture we have, we don’t base our performance on running fast on one single server anyway. Our scalability strategy is instead to add lots of cheap PCs. And sometimes a slow system is better than a non-existing one. Python allows us to create things that would be too expensive (taking too much time) otherwise.

 

 

 

Share/Save/Bookmark

Go to RuleML 2009

September 25th, 2009 Comments off

 

Want to learn more about rule technologies, applications and standards?
Want to discuss latest research results and developments?
Want to get in touch with the industry and research experts in rule-based systems and technologies?

Don't miss RuleML-2009 - early bird registration deadline ends on September 25th

           http://2009.ruleml.org/registration

---------------------------------------------------------------------------


                      RuleML 2009
                                      
3rd International Symposium on Rules, Applications and Interoperability
         November 5-7 2009, Las Vegas, Nevada, USA
                  
               http://2009.ruleml.org/

      co-located with the 12th Business Rules Forum

             ----------------------------

We cordially invite you to participate in the 3rd International Symposium on
Rules, Applications and Interoperability (RuleML-2009) - the premier event
addressing research, applications and standards for rule technologies and
rule-based event processing technologies. It takes place in Las Vegas,
Nevada, USA, Nov. 5-7, collocated with the 12th Business Rules Forum, the
world's largest Business Rules event.

RuleML-2009 has evolved from an annual series of international workshops
since 2002, international conferences in 2005 and 2006, and international
RuleML Symposia since 2007, to the premier event on rule-based systems
addressing industry developments, standards and academic research at the
same time. RuleML-2009 is in the top 100 venues for impact factor (71):
http://citeseerx.ist.psu.edu/stats/venues. It is supported by W3C, OMG, ACM,
EPTS, AAAI, ECCAI, IAAIL, ACM, Belgian Business Rules Forum, MIT Sloan CIO
Symposium, BPM Forum Belgium and a listed EU ICT technology conference.

We are building an excellent program with renowned experts as keynote
speakers, tutorials, standards panel sessions, Open Source Day, W3C RIF
workshop, Int. Rule Challenge with prestigious prizes, etc.

MAKE RULEML-2009 YOUR SHOWCASE!

Submit to the 3rd Int. Rule Challenge at http://2009.ruleml.org/challenge
 

*******************************************************************
RuleML-2009 highlights and news:

* 3rd Int. Rule Challenge

"Demonstration of benchmarks/evaluations, demos, case studies / use
cases, experience reports, best practice solutions, rule-based
implementations/ tools/ applications, demonstrations engineering methods,
implementations of rule standards"

* Rule Open Source Day 

"Discover how Open Source Rules solutions are being deployed in the
marketplace and how they compare to proprietary solutions"

* Lunch Panel on Standards for Business Rules 

"Want to learn more about latest business rules standard in W3C, OMG, OASIS,
ISO, RuleML and how these apply in the enterprise business arena"

* W3C Rule Interchange Format Standard Workshop

* Keynotes and special talks by                                      
   Sandro Hawke (W3C) about W3C RIF                               
   Donald Chapin (OMG) about OMG SBVR and ISO Terminology standards

   Paul Vincent (TIBCO) about CEP and Rules                       
   Jans Aasman (FranzInc. CEO)                                    

* Tutorials by                                                       
   Mark Proctor (Drools) - Drools Tutorial                        
   Christian Saint Marie (ILog/IBM) - W3C RIF Tutorial            
   Larry Goldberg and Babara von Halle - Decision Management      
   Guido Governatori (NICTA) - Business Process Compliance 

* Tracks on 
   Rule-based Event Processing
   Rule Systems on the Web       
   Rule Transformation and Extraction
   Process and Data
   Rules and Norms
   Rules and Uncertainty

* RuleML-2009 Springer LNCS proceedings published
* 3rd Rule Challenge CEUR proceedings to appear
* IEEE TKDE special issue on Rule technologies to appear Dec. 2009
* Forthcoming RuleML-2009 special journal issue  
*******************************************************************


Supported by
===================================================================
W3C, OMG, ACM, AAAI, ECCAI, IAAIL, ACM, Belgian Business Rules Forum
MIT Sloan CIO Symposium, EPTS, BPM Forum Belgium

Sponsored by
===================================================================

BBN Technologies
Franz Inc
NICTA (National ICT Australia) Ltd
Corporate Semantic Web
Logic Programming Associated Ltd
ruleCore
JBoss RedHat
Modelsystems Ltd

(sponsoring opportunities: http://2009.ruleml.org/sponsors)
===================================================================

 

Share/Save/Bookmark

What About Time?

September 11th, 2009 2 comments

In my ruleCore Internal series (well, there’s only one post this far so it’s not much of a series yet) I thought of writing about time. There’s actually lots to say about this simple concept.

Meanwhile there’s these:

A really good summary of the different aspects of time. Maybe I’ll write my "ruleCore Internals - Time" article by answering these questions…

 

 

 

 

Share/Save/Bookmark

ruleCore Internals – The Big Picture

September 7th, 2009 2 comments

As the ruleCore CEP Server is available as a service you really don’t have to care about any details of how things work. But as we techies are curious by nature I get regularly questions about the internals of ruleCore.

So here’s the first ruleCore Internals short article…

 

If we look at the ruleCore architecture we find two distinct components. The Event I/O front-end and the back-end of rule processing engines.

Event I/O: When an inbound events is sent into ruleCore it hits a layer of event transport protocol adapters. We use the Mule ESB in order to avoid spending time in implementing every possible transport protocol ourselves. Mule gives us 30+ protocols so it should be enough for most cases. In the illustration there is just some of the most interesting protocols mentioned. Apart from the obvious ones like raw TCP/IP sockets and web service there’s a cool one called XMPP, which is the protocol used by Jabber and Google Talk. It allows you to use your IM client to talk to ruleCore. Cool eh!

the transport protocol layer can also include features such as throttling and accounting or other thing that you like to do as close to the client as possible.

We use most protocols in a slightly special way. As ruleCore is event driven and in the best of worlds everyone would like to send events using JMS, WebSphere MQ or other messaging products, but they don’t so we have to deal with synchronous transport protocols. We have a asynchronous feeling to all transport protocols. For example if you send an event using a WebService you will get a "ok" as return and the only argument to the call is a string containin the event in XML. So even the synchronous protocols are used in a asynchronous fashion. Results are sent back to the client using outbound events (not shown in the illustration above)

As the inbound stream of events is generated by totally unsynchronized sources we feed these, after a security check, into a Sequencer.

Sequencer The sequencer re-arranges and sorts events from multiple sources into one nicely ordered event stream. This allows the rules to operate on a event stream which have known properties. The most important one being that the events are ordered and that duplicates are removed. This allows the rule model to be much simpler.

The rules see only one single stream of events. Making like much much simple when writing rules. There simply no stream abstraction to care about. The rules just see a logical stream of events and its not interesting from what system they come from.

Sometimes we call this our Event Fusion layer. It fuses events from different sources and creates a structured stream out of them. Other functionality that can be put into this layer if to pre-filer or aggregate events.

You could for example do throttling by sending events to the engines each 10th second if the rules does not need more resolution. You could also aggregate events into a higher level event.

After sequencing the events are distributed to a number of back-end rule evaluation servers. This is done using a very simple (internal) protocol which uses IP to send of the events to each engine. You need ofcourse be careful here to which engine you send events to that you don’t mess upp the rule evaluation.

 

 

Share/Save/Bookmark

More on StreamInsight (CEP from MS)

September 6th, 2009 5 comments

Here’s a good summary of links on StreamInsight from Microsoft:

http://www.sqldevelop.com/blog/resources-for-cep-and-streaminsight/

StreamInsight is Microsofts entry into the CEP arena. They went for the SQL approach too. I wonder when the next wave of CEP systems start to emerge which are not a hack of an old concept. SQL is not in any way optimal (but it does not suck either) base for inventing a CEP language. 

It’s just too painfull to create anything but trivial CEP logic. Just as it is painfull to create anything than trivial SQL databases…

If you think of it, what are the odds that a set oriented language would be the ideal candidate to deal with streams of events? It’s an engineering shortcut, you can re-use lots of ideas and most likely build upon existing code.

But is it the optimal way to do CEP? No way… But it’s a great start for CEP.

 

Share/Save/Bookmark

Agent Logic is Acquired

September 2nd, 2009 2 comments

Agent Logic is sold:

"Informatica Corporation, the world’s number one independent leader in data integration software, today announced that it had completed the acquisition of Agent Logic, a leader in the Complex Event Processing (CEP) software category. CEP enables enterprises to rapidly detect, correlate, analyze and respond to data-driven events. The combination of CEP and data integration enables organizations to be more responsive, adaptable and agile."

So, one of the best (if not the best) CEP software has a new owner… And here’s why.

 

Share/Save/Bookmark

Coding Season

August 31st, 2009 Comments off

Earlier today when I took my bike to work I realized that our short summer is now definitely over. It’s windy and 13 degrees with some rain and that’s not optimal conditions for a pleasant bike ride.

The nice part is that it feels more ok to sit inside and code during the fall and winter than in the summer. It’s generally unpleasant to be outside during the winter around here so one can spend more time coding without feeling that there’s another beach that must be visited.

We do a part of the ruleCore technology stack in Java. This winter there will be a lot of JavaEE coding going on. Here we use a combo of JPA, JSF, SEAM and ICEfaces to produce server-side logic and user interfaces. One thing that annoys me is that everything about this kind of development is so complex. It seems that we need to start off by assembling bits and pieces together before we can actually write any code. Although the resulting setup is both powerful and flexible, but it takes hours and hours to get everything configured. It seems that we developers are given half ready tools which would be more suitable for a tool vendor than programmers which are trying to write code to solve business problems.

I understand why some code in .net as everything seems to be more polished in that world. But sadly there are no sane execution environments for .net code so we are stuck writing code in Java as there are all kinds of nice options for deployment.

Sometimes I feel like returning to the roots and use emacs and a C compiler as my only tools. I’m just looking for a good excuse to write some CEP code in C. Plain C with pthreads running on a a large box can do some wonders when it comes to performance. I would love to spend some time doing some old time systems programming for a change.

 

 

 

Share/Save/Bookmark

CEP Patterns – Draft 0.1

August 25th, 2009 3 comments

[I have started to write a short article on patterns in CEP, here's the first draft and comments are most welcome.]

A very common and interesting problem in event processing is the detection of complex events.

As the Complex Event Processing (CEP) field is pretty young we still have some problems with terminology. You will find different terms used for pretty much the same thing. There’s “event patterns”, “composite events”, “event correlation”, “complex events” and “situations” all used to describe the same concept.

Although the main idea is the same – Allow users to describe a specific and interesting combination of multiple events over time.

What differs is what kind of combinations the user can describe.

 

The existing tools and languages gives the user different ways by relating events, for example:

  • logically (and, or…)
  • temporally (within 10 seconds, no later than 10 seconds after X)
  • semantically (all events must relate to the same business entity).
  • spatially (events in the same geographical region)

The goal is to provide the user with an easy way, graphically or textually, to describe complex combinations of events. Some tools prefer graphical tools, some uses XML and others use something that look more like a programming language.

 

I will use the term “situation” to describe this complex combination of events. Thinking of situations is in my opinion the most user friendly approach to this problem. A situation starts at some point, develops over time and is detected when a last triggering event occurs. The situation consists of multiple events and you might want to track the progress of the situation as it develops too. A neat and easy to understand concept as it is similar to how we normally think about everyday situations.

 

If you don’t like the term situation, then you can just replace it with one of the other terms. Many prefer other terms too. Aleri and StreamBase talks about event patterns. IBM’s Amit uses the word situation too. Esper (BEA) talks about patterns and I think Apama does that too. The term “composite event” is used more in the active database community. So products which has their roots in the Event-Condition-Action (ECA) paradigm of the active database world would probably call it composite events. I think that AptSoft have been calling it “event correlation” and so does many systems monitoring tools.

 

So, what kind of situations would you be interested in detecting and thus in having an easy way of describing:

 

  • Any number of events in a set – This is the equivalent to the “or” in any programming language. It’s common to require the detection of a situation consisting of any/n number of known events. A typical example would be to detect events which all indicate an error. You might like to know when ERROR or BAD_ERROR or FATAL_ERROR have occurred. A little twist to the normal semantics of the programming language or is that you might like to see n number of the possible events before considering them to describe a fully developed situation. For example, you could require that A or B or C or D occurs but add to that you really like at least two of them to occur.
  • All events in a set – Continuing with the programming language metaphors, this is the equivalent to the ‘and’ operator. A situation can consist of a number of events which all must occur before we consider the situation to be detected. The situation will obviously start with any event in the set and will be considered detected when the last event occurs. In between we can see that the situation is developing and might be interested in the degree of completion of the situation. If 2 out of 10 events have occurred, we might like to know that there is still 80% to go. But if we have seen 8 out of 10, we might be building on an application which could benefit from an early warning saying that it is probable that the situation is soon detected.
  • Sequences – A sequence of events might be the most common situation used in different CEP applications. A sequence starts with a first initiating event and is detected when the last terminating event occurs. Sequences also develop over time. We have the first event in the sequence as the starting point and can track the progress of the sequence as it develops much in the way as described in the previous bullet. A situation described as a sequence is detected at the point in time when the last event occurs. Actually there are a number of different types of sequences that you might be interested in detecting, but I won’t go into the fine details of sequence semantics in this post.
  • Non occurrence – It’s not only events that your event processor receives that you might be interested in. Missing events can be equally interesting. Thus there must exist a good way of describing situations which consists of events that did not occur as we expected them to. In order to describe an event which does not occur you must always include a deadline. It would make no sense to say that a situation is detected when event A does not occur. For how long would we then wait until we can conclude that A will never occur? What you really would like to say is that the situation is defined as “trigger when A does not occur within 10 minutes” or something similar. The deadline could be an offset from a known point in time or a fixed time such as lunch time. 
  • Rate – Too high or too low. A common scenario in operations monitoring is when something happens too slowly of too quickly. Many other areas will also benefit in knowing when something happens at an unexpected rate. The tempo of orders to the sales department could for instance be used as an indirect indication on how your web shop is doing. Rates are commonly specified as X events over a period of time. For example 1000 events during the last 10 minutes.
  • Related in time – When you need to detect multiple events which are related by timing constraints you are usually out of luck if you are trying to solve the problem using your traditional tools (like SQL databases). It’s also hard to create custom code to do near real-time tracking of thousands of events and their temporal relationships. No, don’t even think of using one thread (ok, maybe in Erlang) for each situation as there can be thousands and thousands of these at any given point in time. Typical timing constraints on events which make up a situation is that they all occur within a certain time frame, one event occurs within X minutes relative to another event or that events occur during a specified period of time or on a particular day.
  • Semantically related – Many typical event processing applications are fed with events describing something that happened in/to/at some kind of entity. Like a room, a server, a person, a car, a business process, a web service or something else identifiable. As you can see the entity does not have to represent something in the real world. A Unix process can be considered as an entity even if it’s just an abstraction inside a CPU. Situations are typically specified to only consider events which are somehow related semantically. For example originating from the same room and describing something a known groups of persons just did.
  • Spatially related -Events originating from the same area of from entities close to each other. Or other (geo)spatial conditions. Related by being on the same road, city or other area.
  • Trends – A trend describes the tendency for something to go in certain direction. A typical situation found in systems management is when disk usage increases more than 1% in a week. Here we are interested in detecting a situation which will develop during a long period of time. When describing a trend you can have a known “normal”. Your situation detector must have a way to start from this normal value and track progress as your situation develops. A more advanced solution would help you figuring out what normal behavior is. Historical events could be used to calculate your base values. You could for example conclude that 1% increase in http traffic is normal each month and that’s what your hardware upgrade plans can cope with. Here you would like to detect when the increase is faster than that any month.

     

To summarize I see that the following situations/event patterns/composite events/complex events are very common:

  • Any n events in a set.
  • All events in a set 
  • Sequence of events.
  • Non occurring events.
  • Event rate 
  • Temporally related events
  • Semantically matching events.
  • Events describing a trend.

      

We should really give these cool names as is common for software design patterns.

 

I’m starting to build a catalog of commonly seen situations and these are my starting point. you are welcome to add to this list. I’ll only add situations to this list. There are many other things you can do with an complex event processor which are outside of my scope for now…

 

 

Share/Save/Bookmark

Up to Speed

August 10th, 2009 Comments off

Now it’s time to start working again after a nice summer break.  I’m trying to catch up on my google alerts and see if there’s something interesting.

First thing that I found is that Oracle now has support for registering queries in 11g. If I got it right you can now dump in a query into the db and get a notification when the result set of the query changes. This is really really cool. It might be one of the most interesting things related to CEP this year. Now you can basically build your SQL based CEP stuff in Oracle’s db.

On the business front I notice that Senactive have been acquired by a company called UC4. So one less CEP player left then. It also seems that Vhayu have bee acquired, -2 CEP players then…

There seems also be a new report from Forrester which many CEP companies quote favorable parts from. It’s always a good sign then these research firms thinks there’s money to be made on writing about CEP.

Paul Vincent from Tibco have drawn a nice CEP history timeline which gives a good overview of the CEP world as of today and some perspective as to where the products come from. Although we started a bit earlier (in 2003 if I remember correctly) than the illustration suggests. Actually first design drafts to ruleCore are from 2001. It’s nice to look through them and see that some ideas have actually survived to today’s product.

From Opher’s blog I notice that CEP is climbing on the hype hype cycle as seen by Gartner. If I get the graphics right CEP is some 5 years from mainstream according to Gartner. CEP vendors does not seem to agree if you read comments on various blogs. No surprise there. But it is about the same lines as we think over here, we have for long predicted 2012 as the year when CEP starts to take off. Until then, it’s wise not to burn too much fuel if you like to stay in business. Meanwhile, it seems that at least some argue that CEP vendors need to treat developers better.

My summer quiz seems to have attracted zero (0) interest :( So I don’t even bother posting the answer.

I read a lot about Twitter in the CEP blogs now. Is it just me, but I really can’t understand the greatness of this Twitter thing… My guess is that in two years it’s forgotten and placed somewhere among the rest of the hyped up websites that pop up now and then. Before that the founders will rip some VC off and move to some warm cosy place. And for CEP, not interesting at all from where I stand. It’s more a parsing and text analytic problem as I see it.

Anyway, nice to be back at work and it’s good to see that the CEP community is moving forward and I hope that all of you that work with CEP will have a really nice fall doing all kinds of cool CEP stuff…

Here’s some Swedish pine for you:

 

Share/Save/Bookmark

Summer time + quiz

June 26th, 2009 Comments off

 

I’ll be away for the keyboard for some well earned rest during the summer. Meanwhile, here’s a summer CEP quiz:

When detecting nested sequences of events, how many different types of sequences do we need to completely be able to express all kinds of sequence semantics?

Nested sequences are sequences where the items of the sequence can consist of other sequences. Something like:

Sequence( Sequence(E1 or E2), Sequence(E2 or E3) )

is nested…

Answers can be supplied as comments to this post and I’ll give you the right answer in a number of weeks.

 

 

 

 

 

 

 

 

 

Share/Save/Bookmark

Context Management

June 8th, 2009 Comments off

In Event Processing (EP) and it’s sub-disciplines CEP and ESP there’s a very important concept called context. For some reason the IT world chooses as generic names as possible to all kinds of important concepts which would benefit from a more specific and inspiring name.

The context in is one of the defining features of EP. It’s something you need to understand and be friends with in order to really appreciate the power of EP.

Unfortunately it seems that there are some confusion about what a context is. Which I understand, being such a generic term and a concept used in various places outside CEP.

The event processing context is, in short, the set of events that you see when executing your CEP rules, procedural code or your streaming version of SQL.

The most trivial context is the event that you just received, for simplicity just assume that you receive one event at the time. The concept of "events that happen at the same time" is too confusing anyway.

A more complex context can be constructed by keeping any number of the events that you received. For example the last 10, or the events received during the last 10 minutes. Commonly this kind of context is referred to as a window in many products.

An even more advanced context can be constructed by applying different kinds of conditions to events in order to determine if they should be included in the context. For example, that they should be emitted by a car which is currently in Stockholm. You could also use various types of event relationships to determine if events should be included in the context.

The context can include events which you receive as time goes by, you select some of these to be included in your context. The context can also contain historical events which have occurred before you started your processing. As time goes by, events are inserted and removed from the context.

If you are in a hurry, read only this: an event window is not the same thing as a context. An event window is a type of context!

To decide what events should be included in the context, a large number of factors can be considered. Depending on your type of CEP system you might find context management which takes into account:

  • Semantics
  • Location
  • Event causality
  • Temporal relationships
  • Historical events
  • State
  • Reference data

and so on…

A rich context could for example be, all events that:

  1. Are notifications about new GPS locations of entities of type heavy vehicle, and
  2. The events occurs during working hours, and
  3. The vehicle is located in Construction Zone X. and
  4. The cargo of the vehicle weights over 40 tons, and
  5. It travels on a road classified as temporary, and
  6. The driver is listening to Iron Maiden

Well, ok. I might made the last one up. But I hope you get the general idea; All of the above must be true at any point of time for the event to be included in the context.

Also note that in this case we would probably have one context per vehicle.

In the context you have a bunch of events which are all related somehow, possible in very complex ways. By using these events as an input to whatever processing your system is doing, your processing logic will be much simpler than if you were operating on the raw stream of events.

So, rich context management avoids processing the raw stream of events and gives you a easy way to select only those events in which you are interested.

 

 

 

 

 

Share/Save/Bookmark

Different Types of CEP

June 5th, 2009 Comments off

As a part of an interesting discussion in our plans to take over the world^H^H^H^H^H^H to understand what our clients think is difficult with CEP I ended up in doing a improvised presentation on what EDA and CEP is good at.

 I ended up with the following bullets which I made up along the way:

Detect when a complex state change happens.

Here I tried to do an analogy to a more traditional RDBMS system. How would you detect that a number of tables have been changed over time in a very specific way? I hoped that this would give a good mental model on what CEP is trying to achieve.

In database terms, it rather messy to write the SQL and/or procedural code to detect changes to multiple tables. All agreed that things get even more messy when there’s timing constraints involved. Suggestions ranged from triggers to flashback queries but even the hardcore DBAs and database coders agreed that they would rather avoid looking at these type of queries after a couple of years – "What the hell did I do here??"

Drive calculations

 Another good example of what can be done with CEP is to drive online calculations. Rapidly changing data fed to an algorithm which produces a constant stream of output values. I showed some example of Coral8, StreamBase to get an overall understanding of how these could be used in the capital markets. As no one worked with anything even remotely related to the world of finance we sortof had to invent use-cases.

Instead driving calculation of business metrics was agreed to be one of the major areas for this type of processing as these can be found in more or less all companies. There’s always a dashboard which needs to be as close to real-time as possible. For example "Tempo of production during the latest 13 minutes."

Event warehouse

A database full of events can be used to do some really interesting analytics. If we have long sequences of events which can be related to each other using different kinds of correlation rules we can find lots of interesting things. Here I tried to make people understand that there’s nothing magic about CEP. If you know how to do data mining you can apply the same techniques to events. Events are just a special type of data from this point of view. Just call the events for data structures of tuples (which actually some CEP vendors do) and you can pretend that you are processing normal data.

Simulation, what-if?

If everything is driven by events then we can save the stream of events a reply it. This is like being able to tweak the history and do it all over again to understand how we should have done in order to avoid certain situations. We can also replay history and try to build rules which detect new types of situations.

Control systems

 High performance processing of sensor data is something that has been done for ages. Google for SCADA and you’ll find tons of systems doing that. The ‘problem’ is that all these systems are custom built from ground up. There has been missing critical infrastructure software to build upon. When building a traditional dataprocessing system one normally starts with a database and perhaps an application server. These kind of system components have been missing for real-time processing of data. Within CEP, there’s now a category of CEP software which is suitable for this.

 

 

The response to this "CEP thing" was mixed. A couple of persons realized the value of CEP at once and a large portion remained very sceptical. Which partly validates my theory that CEP is not for everyone (no it will not replace databases even though some CEP vendors say (said) so). A good subset of business problems are suited for CEP and that’s enough to keep at last a couple of CEP vendors running.

 

 

 

Share/Save/Bookmark