Abstract-Event pattern detection is the one of the major techniques used for event correlation in network and distributed systems management. This paper focuses on the design issues of event pattern specification languages. The discussion is organized around the event operators in existing event languages that we think are problematic and around the temporal specification aspect. Semantic issues are discussed and various languages are investigated. The study has revealed weaknesses of design in semantic appropriateness and completeness of certain event operators, in flexibility of operator usage and timing specification, in effectiveness and efficiency of expressions, and in readability of the languages. Based on the findings, we propose a new event language called SEL, which attempts to avoid some of these problems. SEL is novel in its negation operator usage, the way followed-by semantics is provided, and how composite event time is determined in the presence of the negation operator. It is comprehensive yet relatively simple and intuitive to use. Expressions written in SEL appear to be very readable and easy to maintain. Keywords-event correlation, network management, event pattern detection, composite event, event expression I. . INTRODUCTION Event monitoring and analysis is crucial for managing networks and distributed systems. As one of the primary techniques adopted for this purpose, event correlation [1], [2], [3] aims at deriving more concise and meaningful information from potentially large volumes of lower level events. Detecting event patterns expressed in the form of event expressions is a common event correlation technique. This paper proposes a novel event pattern specification language, SEL. Event patterns are specified as event expressions which consist of events connected by event operators, constraints on event attributes expressed as predicates on the attributes, and constraints on time windows which delimit occurrence time of the patterns. Event languages are inherently more complex than regular expressions because events are dynamic, events have attributes, and event languages need to provide means so that sophisticated timing relationship between events can be specified. Our study of existing event pattern languages has revealed weaknesses of design in semantic appropriateness and completeness of certain common event operators, in flexibility of operator usage and timing specification, in effectiveness and efficiency of expressions, and in readability of the languages. Based on these findings, we propose a new event language, SEL, which tries to avoid some of these problems. SEL is novel in its negation operator usage, the way followed-by semantics is provided, and how composite event time is determined in the presence of the negation operator. It is comprehensive yet simple and intuitive to use. Expressions written in SEL appear to be very readable and easy to maintain. The language has shown its usefulness in SHAMAN network management scripting framework [4] and SDB, a SHAMAN application debugger [5] . The rest of the paper discusses the motivation behind SEL and briefly describes its syntax and semantics. More details and an SEL pattern detection algorithm can be found in [6] .
SEL focus on the specification of event patterns, and takes into account the appropriateness and completeness of event operators, effectiveness and efficiency of expressions, flexibility and readability of language REF .
SEL, a new event pattern specification language for event correlation
Proceedings Tenth International Conference on Computer Communications and Networks (Cat. No.01EX495)
Proceedings Tenth International Conference on Computer Communications and Networks (Cat. No.01EX495)
Computer Science