Event Models – Continued
I had some very good comments on my previous* post about event model semantics.
The issue: What are the fundamental properties of an event, and what are their semantics. The prime candidates seem to be:
- Id
- Type
- Detection timestamp
Others, which could be present, but might not be required:
- Location
- Entity
- Occurrence time stamp
- Event class or category
Lets look at some practical examples..
<ZoneEntry id="bd79d85a-12c1-4a1f-9047-3dc34fcab2cc" time="2008-12-13 20:45:44">
<Header>
add stuff here tomorrow
</Header>
<Body>
add stuff here too tomorrow
</Body>
</ZoneEntry>
I’m using XML here as an example, but it could as well be something else… In this example we have an event of type ZoneEntry, it was detected just a couple of minutes ago and its globally unique id is bd79d85a-12c1-4a1f-9047-3dc34fcab2cc.
As we can see I envision the event to contains two containers, one if the header and the other is the body.
The header contains information about the event itself, for example which events it depends on, security related information, information about the event sending system and other meta data type of information.
The body is the actual payload of the event.
This is a good start, lets continue adding to it tomorrow. But until then, lets enjoy the weekend.
* Due to an unfortunate snafu (that is, I messed things up) my previous posts are not available currently, they are not lost. Just sitting in a SQL dump ready to be imported whenever I have the time to figure out how…
Just testing, does this work?
It seems to me that the simplest way to figure this out would be to envision existence of a global event-server/router. Myriad devices (or systems) send their events to the server in a “standard” format and the server delivers events to any system/application that may be interested in particular events. It would be like having a generic interface for any type of device (system). What information would the imaginary event-router need to accomplish this? How would an event object look like?
What happened to the old posts?
Forget my previous question, I should have read this post till the end first…
Would ID necessarily be be unique? It would be more convenient, but is it needed? Also, what about some kind of field about the sender of the event?
Damir, I think you are on the right track with your idea. For an event model to work it must capture the essence on the event concept. So the same event format should work with a huge number of different systems. In order to do so it is very important that the semantics are well defined. In order to manage to do this we need to keep things as simple as possible.
Hans, I think Id must go in there. I’ll see if I can build a case for that…
As for source, instinct says no… Senders are a technical term and might not be interesting when looking at an event, that needs explanation too…
Few more points to consider:
Id
——-
A remote sensor in the Arctic measures air temperature and pressure. Every minute, the sensor sends data via a satellite link to a government weather office server. Our CEP application has an input adapter for the weather office data.
Who creates the EventId, and how? The Sensor, the weather office server or the CEP application?
Entity
——-
Joe works for XYZ Ltd. To enter the building Joe swipes his RFID card. The card has a fixed/unique ID number. A card reader at the door sends the event data to the CEP server.
To whom or what does the event EntityId belong; Joe, the RFID card or the card reader?
Time
——-
Keeping in mind that small micro-controller based devices are notorious for not having synchronized clocks–or at least assuming this to be true–how could one obtain reliable TimeStamp data?