Situation Detection

From RuleCore Support

The powerful situation detection capability is the heart of the ruleCore CEP Server and is made possible by the flexible design of the situation detector. The situation detector is a main component of the ruleCore CEP Serverand is responsible for efficiently evaluating and keeping track of the situation detection process.

The situation detection capability of ruleCore provides the following benefits:

1. Declarative - Complex situation are described using a high level declarative approach, avoiding complex procedural solutions using traditional programming languages.
2. Temporal support - Support for describing temporal relationships between events. Timing restrictions such as deadlines for detection can easily be added
3. Extendable - The situation detector is designed to be extended with new task specific detector nodes.
4. Monitoring - The detector is designed to be monitored and thus the progress of situation detection can easily be tracked.

As a situation describes an interesting combination of multiple events as they occur over time, it must start somewhere. A situation starts developing when a specific initiator event occurs. This is the first event in what could possibly be a fully developed situation consisting of multiple events. This also means that a situation has an exact point in time where is starts developing, namely the time stamp of the initiator event.

The situation develops over time and can either be detected at some point or automatically determined to be undetectable. A situation can develop over long periods of time and consist of a large number of contributing events.

The progress of a situation as it develops can be followed by submitting a query event to the ruleCore CEP Server about the state of a particular rule's situation detector. The degree of completion of a situation can be monitored to provide an early warning about a situation which could possibly be detected soon.

Business situation detection provides the capability to recognize and respond to significant patterns of business, technical infrastructure and external events as quickly as possible. The immediate detection of business situations are required in many different kinds of business environments where there is a need to react to valuable situations as the happen. Events can be sent into ruleCore from a variety of sources such as CRM, RFID, GSM, web portals or SCM systems, just to mention a few possible event sources. By combining events from different sources across the enterprise, the situation detector of the ruleCore CEP Server can immediately detect corporate wide behavior patterns, for example interesting or alarming customer/supplier behaviour.

Context

Each rule contains a reference to one situation, but a situation can be used in multiple rules.

The situation is evaluated in the context of the rule in which it is used. Thus the situation sees normally only the events in the rule's view. Thus each situation instance may see different events as each rule instance contains its private event view.

The view provides an dynamic context in which the situation detection is evaluated. The situation is automatically evaluated when the view changes due to new inbound events selected into it or that time passes and changes the amount of events in the view.

The view is a model of a real world context in which to detect situations. A particular situation could be detected in different contexts. For example, a error condition with more that 100 errors during the last hour might be of interest to detect per server or per service.