COMPLEX EVENT PROCESSING SYSTEM AND METHOD

• US 20130031251A1
• Filed: 03/31/2011
• Published: 01/31/2013
• Est. Priority Date: 03/31/2010
• Status: Active Grant

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Roxburgh, David
• Granted Patent: US 9,170,910 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route

Abstract

A complex event processing system comprises a complex event processing engine (52) and an event harvesting system, wherein the event harvesting system is operable to monitor a computer network (10, 21, 22, 31, 32, 33), generate simple event reports in response to the result of monitoring the network and pass these to the complex event processing engine for processing. The event harvesting system comprises a central configuration control module (51, 53) and a plurality of capture node modules (41, 42) each of which is operatively connected to the central configuration control module. Each capture node module is operable to receive configuration instructions from the central configuration control module to determine what simple event reports are to be generated by the module and in response to what conditions detected on the monitored computer network. The central configuration control module includes an interface (51) in the form of a web server for receiving configuration instructions from a user of the system and for processing these configuration instructions and sending them to a specified capture node module for causing the module to operate in accordance with the specified configuration instructions.

Claims

1. A complex event processing system comprising a complex event processing engine and an event harvesting system, wherein the event harvesting system is operable to monitor a computer network, generate simple event reports in response to the result of monitoring the network and pass these to the complex event processing engine for processing, wherein the event harvesting system comprises:

a central configuration control module; and

a plurality of capture node modules each of which is operatively connected to the central configuration control module;

wherein

each capture node module is operable to receive configuration instructions from the central configuration control module to determine what simple event reports are to be generated by the module and in response to what conditions detected on the monitored computer network, and wherein

the central configuration control module includes an interface for receiving configuration instructions from a user of the system and for processing these configuration instructions and sending them to a specified capture node module for causing the module to operate in accordance with the specified configuration instructions.

2. A system according to claim 1 wherein one or more of the capture node modules is configurable into a non-invasive mode of operation.

3. A system according to claim 1 wherein the complex event processing engine is operable to infer the occurrence of complex conditions based on the detection of combinations of occurrences of plural simple events, the occurrence of each simple event being detectable based on the data captured by a single capture node.

4. A system according to claim 3 wherein the complex event processing engine is operable to detect the occurrence of complex conditions which are not detectable solely on the basis of the data captured by a single capture node, or which are only detectable based on data captured by a single capture node using statistical analysis over a time period.

5. A system according to claim 1, wherein each capture node module is a generic module capable of being configured into one of the following specific types of capture node:

a network sniffer operable to extract information from packets of data flowing on a network or a log picker operable to extract information from log files.

6. A system according to claim 1 wherein the capture node modules and the head end node include a heartbeat mechanism whereby each active deployed capture node periodically communicates with the head end node even where no simple event occurrences have been detected by the capture node module, to provide a level of assurance to the head end node that the capture node is still operating correctly.

7. A system according to claim 1 wherein the head end node incorporates a listener module which is operable to receive registration requests by external components whereby any external component which registers with the listener module for notification of the occurrence of a particular complex event as detected by the complex event processing engine, is notified by the listener module whenever such an occurrence is actually detected by the CEP engine.

8. A method of detecting the occurrence of complex events on a network, the method comprising:

deploying a central configuration control module and a plurality of capture node modules each of which is operatively connected to the central configuration control module onto a legacy network to be monitored;

transmitting configuration instructions from the central configuration control module to each capture node module to specify what simple event reports are to be generated by the capture node module and in response to what conditions detected on the monitored computer network;

transmitting to the central configuration control module configuration instructions from a user of the system;

processing these configuration instructions; and

sending them to a specified capture node module for causing the module to operate in accordance with the specified configuration instructions;

wherein

the capture node modules monitor the computer network to generate simple event reports in response to the result of monitoring the network and pass these to a complex event processing engine associated with the central configuration module for processing to identify the occurrence of complex events based on the received simple event reports.

9. A method according to claim 8 wherein one or more of the capture node modules is configured to monitor the computer network non-invasively.

10. A method according to claim 9 wherein all of the capture node modules are configured to monitor the computer network non-invasively.

11. Carrier means carrying processor implementable instructions for causing a processor or processors to carry out the method of claim 8 during execution of the instructions.