METHOD FOR PERFORMING REAL-TIME ANALYTICS USING A BUSINESS RULES ENGINE ON REAL-TIME HETEROGENOUS MATERIALIZED DATA VIEWS

• US 20090031327A1
• Filed: 10/01/2008
• Published: 01/29/2009
• Est. Priority Date: 05/27/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Nesamoney, Diaz H., Krishnan, Vaikom B., Handwerker, Martin Lewis, Jazayeri, Nasrollah
• Granted Patent: US 8,464,278 B2
• Time in Patent Office: Days
• US Class Current: 719/318
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: Y10S 707/99938 Concurrency, e.g. lock management in shared database

Abstract

A method for performing real-time analytics using a business rules engine on real time heterogeneous materialized data views is disclosed. The method comprises processing of rows produced by views corresponding to events. The rows are processed according to business rules by a view engine. Views with conditions equivalent to rule conditions are subscribed to by a rule engine, which outputs action messages corresponding to the rule condition. Where the rule condition is satisfied, a statement to that effect is sent, with any available reportlets, to an alert engine. The alert engine handles alert states corresponding to the action statement, saves any corresponding reportlets, and generates a message to fire an alert to a notification engine. The notification engine formats the alert and sends the alert by a selected medium, such as email, a webservice call, or another network protocol.

Claims

1-29. -29. (canceled)

30. A method comprising:

detecting an event within a real-time stream of data received from an external system;

responsive to detecting the event, materializing a real-time view of the event;

using a plurality of user-defined specifications, wherein each individual specification sets forth a change to be detected in the materialized real-time view of the event and a corresponding action to be taken in response to the change; and

responsive to detecting the change set forth by at least one of the plurality of user-defined specifications, triggering the corresponding action of the at least one user-defined specification, wherein triggering the corresponding action comprises

selectively forestalling the triggering of the corresponding action until a particular event occurs, the particular event being specified in the at least one user-defined specification, and

cancelling the triggering of the corresponding action if the particular event does not occur during a specified time duration.

31. The method as recited in claim 30, wherein the corresponding action comprises an alert.

32. The method as recited in claim 31, wherein the alert is generated in an end user interaction system, and wherein the end user interaction system comprises a medium selected from a group consisting of e-mail, a web browser, a portal, a query and reporting tool, a spreadsheet program, voice, facsimile, wireless, an annunciator, and a personal digital assistant.

33. The method as recited in claim 30, wherein the plurality of user-defined specifications comprises a plurality of business views, wherein the plurality of business views are used to define business rules, and wherein the plurality of business views selectively comprises a business view to which context has been added, wherein the context comprises historical data.

34. The method as recited in claim 33, further comprising subscribing to a plurality of hidden views automatically generated in response to the real-time stream of data, wherein the condition of one of the plurality of hidden views is equivalent to a condition of one of the plurality of business rules.

35. The method as recited in claim 34, further comprising processing one of the plurality of business views and the plurality of hidden views, wherein a rule condition of the one of the plurality of business views is ascertained, wherein the corresponding action describes the truthfulness of the rule condition, and wherein the corresponding action is selected from a group consisting of fire, raise, lower, and no action.

36. The method as recited in claim 35, wherein the generating comprises:

determining that the real-time stream of data is ordered; and

serializing the statement accordingly.

37. The method as recited in claim 35, wherein the processing further comprises:

determining that the plurality of business views comprises a reportlet view; and

responsive to determining that the plurality of business views comprises a reportlet view, outputting a reportlet corresponding to the reportlet view wherein the statement includes the reportlet.

38. The method as recited in claim 35, wherein the generating comprises:

publishing a message wherein the message states that a rule on the view took an action selected from the group consisting of fired, raised, lowered, did nothing, for the event and the row and for a specified plurality of columns, wherein the group corresponds to an alert state for the business view; and

handling the alert state, wherein the handling comprises sending a request to trigger the corresponding action and selectively sending a corresponding reportlet.

39. A method comprising:

detecting an event within a real-time stream of data received from an external system;

responsive to detecting the event, materializing a real-time view of the event;

using a plurality of user-defined specifications, wherein each individual specification sets forth a change to be detected in the materialized real-time view of the event and a corresponding action to be taken in response to the change; and

responsive to detecting the change set forth by at least one of the plurality of user-defined specifications, triggering the corresponding action of the at least one user-defined specification, wherein triggering the corresponding action comprises tracking at least one of a raised and a lowered state for each unique tuple of a plurality of tuples.

40. A computer-implemented system for performing real-time analytics on heterogeneous data views, comprising:

a processor;

an agent recorded on a medium readable by the processor, the agent executed by the processor to detect an event within a real-time stream of data that is received from an external system;

a view engine recorded on a medium readable by the processor, the view engine executed by the processor to receive the event from the agent, to materialize one or more real-time views of the event, wherein the views comprise one or more business views and one or more hidden views, and wherein the business views are used to define one or more business rules;

a rule engine recorded on a medium readable by the processor, the rule engine executed by the processor to receive the materialized real-time views from the view engine, to subscribe to the hidden views, wherein each of the hidden views has a condition equivalent to that of one of the business rules, and to generate a message to take an action corresponding to the condition specified by at least one of the business rules, wherein the rule engine is further configured to selectively forestall the generating of the message until a particular event occurs, and to cancel the generating of the message if the particular event does not occur during a specified time duration;

an alert engine recorded on a medium readable by the processor, the alert engine executed by the processor to receive the message to take an action from the view engine, to handle an alert state corresponding to the message, and to generate a request to fire an alert; and

a notification engine recorded on a medium readable by the processor, the notification engine executed by the processor to receive the request from the alert engine, to format the alert as a notice, and to send the notice to a user.

41. The system as recited in claim 40, further comprising a reportlet engine recorded on a medium readable by the processor, the reportlet engine executed by the processor to receive the stream of rows from the view engine, to subscribe to the views and, where the views include a reportlet view, to generate a reportlet corresponding to the reportlet view, wherein the alert engine is also for saving the reportlet.

42. The system as recited in claim 40, further comprising a context engine recorded on a medium readable by the processor, the context engine executed by the processor to provide context to the view engine, wherein the context comprises historical data relevant to the views, and wherein the context is added to the views, and to retrieve the context from a context connection.

43. The system as recited in claim 40, wherein the rule engine is further executed to determine that the event stream is ordered and, responsive to determining, to serialize the event stream.

44. The system as recited in claim 43, wherein the rule engine comprises a rule serializer for performing and serializing.

45. The system as recited in claim 44, wherein the rule serializer comprises a function selected from a group consisting of a hash table from an identifier corresponding to the event to the action, and a circular, doubly-expanding array of the action corresponding to the event.

46. The system as recited in claim 40, wherein the alert engine performs the handling by a handler selected from a group consisting of:

a red-black balanced binary tree of raised rows corresponding to a set of ‘

for a specific’

raise columns and a lower index corresponding to a set of ‘

for a specific’

lower columns, wherein the lower index comprises a pointer to one of the raised rows that must be removed to perform a lower action;

a red-black balanced binary tree of raised rows;

a red-black balanced binary tree of raised values wherein a ‘

for a specific’

clause corresponds to a single column; and

a hash table of raised values.

47. The system as recited in claim 40, wherein the notification engine comprises:

a notice factory receiving the request from the alert engine, to perform the sending; and

a format factory receiving a formatting request from the notice factory, to perform the formatting according to the formatting request.

48. The system as recited in claim 47, wherein the notice factory comprises:

an email notifier to send the notice wherein the notice comprises an email;

a web services notifier to send the notice to a web-based application; and

a notification persistence engine to persist the notice for later querying through an interface by a portal.

49. The system as recited in claim 47, wherein the format factory comprises:

a HTML reportlet formatter;

a text reportlet formatter;

a PDF reportlet formatter; and

a spreadsheet reportlet formatter.

50. A system for performing real-time analytics on heterogeneous data views, comprising:

a processor;

an agent recorded on a medium readable by the processor, the agent executed by the processor to detect an event within a real-time stream of data that is received from an external system;

a view engine recorded on a medium readable by the processor, the view engine executed by the processor to receive the event from the agent, to materialize one or more real-time views of the event, wherein the views comprise one or more business views and one or more hidden views, and wherein the business views are used to define one or more business rules;

a rule engine recorded on a medium readable by the processor, the rule engine executed by the processor to receive the materialized real-time views from the view engine, to subscribe to the hidden views, wherein each of the hidden views has a condition equivalent to that of one of the business rules, and to generate a message to take an action corresponding to the condition specified by at least one of the business rules, wherein the rule engine is further configured to determine that the message includes a clause to track at least one of a raised and a lowered state for each unique tuple of a plurality of tuples;

an alert engine recorded on a medium readable by the processor, the alert engine executed by the processor to receive the message to take an action from the view engine, to handle an alert state corresponding to the message, and to generate a request to fire an alert; and

a notification engine recorded on a medium readable by the processor, the notification engine executed by the processor to receive the request from the alert engine, to format the alert as a notice, and to send the notice to a user.

51. In a computer system for monitoring business activity, a computer-readable medium having a computer-readable program code embodied therein for causing the computer system to:

detect an event within a real-time stream of data that is received from an external system;

responsive to detecting the event, materialize one or more real-time views of the event, wherein the views comprise one or more business views and one or more hidden views, and wherein the business views are used to define one or more business rules;

subscribe to the hidden views, wherein each of the hidden views has a condition equivalent to that of one of the business rules;

generate a message to take an action corresponding to the condition specified by at least one of the business rules based upon the received stream of rows;

determine that the message includes a clause to selectively forestall the generating of the message until a particular event occurs, and to cancel the generating of the message when the particular event does not occur during a specified time duration;

handle an alert state corresponding to the message;

request that an alert be fired;

format the alert as a notice; and

send the notice to a user.

52. The computer-readable medium as recited in claim 51, wherein the computer-readable program code further causes the computer system to:

where the views include a reportlet view, generate a reportlet corresponding to the reportlet view; and

save the reportlet;

wherein the notice includes the reportlet.

53. The computer-readable medium as recited in claim 51, wherein the computer-readable program code further causes the computer system to add context to the views, wherein the context comprises historical data relevant to the views.

54. The computer-readable medium as recited in claim 51, wherein the computer-readable program code causes the computer system to generate at least by determining that the event stream is ordered, and, responsive to such determination, serializing the event stream.

55. In a computer system for monitoring business activity, a computer-readable medium having a computer readable program code embodied therein for causing the computer system to:

detect an event within a real-time stream of data that is received from an external system;

responsive to detecting the event, materialize one or more real-time views of the event, wherein the views comprise one or more business views and one or more hidden views, and wherein the business views are used to define one or more business rules;

subscribe to the hidden views, wherein each of the hidden views has a condition equivalent to that of one of the business rules;

generate a message to take an action corresponding to the condition specified by at least one of the business rules based upon the received stream of rows;

determine that the message includes a clause to track at least one of a raised and a lowered state for each unique tuple of a plurality of tuples;

handle an alert state corresponding to the message;

request that an alert be fired;

format the alert as a notice; and

send the notice to a user.