Event-processing system and method of constructing such a system

• US 5,691,917 A
• Filed: 05/05/1995
• Issued: 11/25/1997
• Est. Priority Date: 06/10/1994
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Company (HP Inc.)
• Inventors: Harrison, Keith Alexander
• Primary Examiner(s): Ramirez, Ellis B.
• Application Number:
  US08/435,490
• Time in Patent Office: 935 Days
• Field of Search: 364/514 B, 364/514 C, 364/551.01, 364/579, 345/200.11, 345/183.15, 345/185.02
• US Class Current: 717/127
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/064 involving time analysis

Abstract

A limited number of different types of event-processing node are provided for use as building blocks in constructing an event-processing system intended to receive and process event information about basic events occurring in a system being monitored, such as a telecommunications system. The event-processing system is constructed by interconnecting selected ones of the nodes into a network. Each event-processing node receives event data items in one or more input streams and processes these event data items to produce an output stream of event data items. Each event data item relates either to a basic event or to a combination of such events and includes event data that is indicative of the nature and time of occurrence thereof in the system being monitored. Generally, certain of the nodes effect processing on the basis of each input event data item taken individually, whilst other of the nodes are responsive to the presence of a predetermined inter-relationship between events represented by event data items.

Claims

1. An event processing system for receiving and processing event information about basic events occurring in a system monitored, said basic events comprising changes in state in said system being monitored, the event-processing system comprising:

a plurality of discrete event-processing nodes, at least one event processing node being coupled to said system being monitored, each operative to process event data items, each said event data item relating either to a basic event or to a combination of such basic events and having event data that is indicative of a nature and time of occurrence of said basic event or combination of events, as the case may be, in the system being monitored, each node receiving at least one input of said event data items which it processes to produce at least one output stream of said event data items; and

means for coupling said nodes to form a network of nodes in which output streams of at least some said nodes form input data streams of other of said nodes, said at least one event processing node coupled to said system being monitored and constituting an input node for receiving said event information in the form of at least one said input data stream, said nodes, as so coupled, facilitating assessment of system operation.

2. A system according to claim 1, wherein at least one of said event-processing nodes is a cross-event processing node operative to detect a predetermined inter-relationship between events represented by said event data items, the existence of said predetermined relationship being a necessary condition for the output of an event data item in a said output stream associated with the node.

3. A system according to claim 2, including a said cross-event processing node in the form of a product node for receiving a plurality of input streams of event data items, said predetermined relationship being between event data items present in said input streams and being satisfied upon the existence of event data items in said input streams that are in given time relation to each other, each event data item of the output stream relating to a combination of the events represented by the event data items of said input streams.

4. A system according to claim 2, including a said cross-event processing node in the form of an unless node for receiving first and second input streams of event data items, said predetermined relationship being between event data items of said input streams and being satisfied upon the existence of an event data item in said first input stream without the existence of an event data item in said second input stream that is in given time relation to the event data item of the first input stream, each event data item of the output stream corresponding to an event data item of said first input stream.

5. A system according to claim 2, further comprising a table node arranged to receive an input stream of event data items and to store event data therefrom including said time of occurrence, the table node being responsive to being interrogated with a specified time, to return event data current at that time;

said event-processing system including a said cross-event processing node for which said predetermined relationship takes the form of a given time relation between an input event data item and a particular event data item which, if it has occurred, has its event data stored in said table node, said given time relation being met if at a particular time said particular event data item was the most current item with event data stored in the table node, the cross-event processing node testing for this time relation by interrogating said table node with said particular time and examining the returned event data to ascertain if it indicates the presence of said particular event data item.

6. A system according to claim 5, wherein the event data stored in said table node for each said event data item comprises the value of a given parameter of the system being monitored;

said particular event data item of interest to said cross-event processing node, being any such item the stored parameter value of which lies in a predetermined range of values.

7. A system according to claim 1, wherein at least one of said event-processing nodes is a single-event processing node operative to effect its processing on the basis of each input event data item taken in isolation.

8. A system according to claim 7, including a said single-event processing node in the form of a filter node for selecting from an input stream any event data item the event data of which meets predetermined selection criteria, the selected event data items being output in an output stream from the node.

9. A system according to claim 7, further comprising clock means for providing a time reference corresponding to that used to provide the timestamps of the event data items, the event processing system including a said single-event processing node in the form of a delay node for receiving event data items in an input stream and for delaying the output of each such event data item in an output stream until a predetermined time period after the said time of occurrence associated with that item, the delay node judging when said predetermined time period has elapsed by referring to said time reference.

10. A system according to claim 1, further comprising output action means for receiving a said output stream and effecting a corresponding action in response to the event data items thereof.

11. A system according to claim 1, wherein for each type of said event-processing node in terms of the processing effected thereby, there is provided functional processing code for carrying out that processing, each said event-processing node having associated data including:

first data, the same for all nodes of the same type, that identifies said functional processing code relevant to that node type whereby the functional processing code is shared by all nodes of the same type; and

second data, specific to each node, including data that identifies for each of said at least one output stream associated with the node, the destination of the stream.

12. A system according to claim 11, wherein the means for intercommunicating said nodes comprises means for passing an event-data-item pointer from one node to another.

13. A system according to claim 1, wherein a said event data item relating to a combination of basic events comprises a set of component event data items, this structuring being recursively implemented for each component event data item until each component event data item directly relates to a said basic event.

14. A method of building an event processing system for receiving and processing event information about basic events occurring in a system being monitored, said basic events comprising changes in state in said system being monitored, said method comprising the steps of:

providing a library of event processing nodes each operative to process event data items, where each event data item relates either to a basic event or to a combination of such basic events and has event data that is indicative of the nature and time of occurrence of said basic event or combination of events, as the case may be, in the system being monitored, each node being intended to receive at least one input stream of said event data items which it can then process to produce at least one output stream of said event data items; and

selecting nodes from said library and coupling said nodes to form a network of nodes in which output streams of at least some of said nodes form input streams of other of said nodes, at least one said node constituting an input node for receiving said event information in a form of at least one said input stream, said nodes, as so coupled, facilitating assessment of system operation.

15. A method according to claim 14, wherein said library comprises nodes of the following types:

single-event processing nodes each operative to effect its processing on the basis of each input event data item taken in isolation,

cross-event processing nodes each operative to detect a predetermined inter-relationship between events represented by said event data items, the existence of said predetermined relationship being a necessary condition for the output of an event data item in a said output stream associated with the node.

16. A method according to claim 15, wherein said single-event processing nodes comprise node of the following types:

a filter node for selecting from an input stream any event data item the event data of which meets predetermined criteria stored in the node, the selected event data items being output in an output stream from the node; and

a delay node for receiving event data items in an input stream and for delaying the output of each such event data item in an output stream until a predetermined time period after the said time of occurrence associated with that item, the delay node judging when said predetermined time period has elapsed by referring to said time reference;

and wherein said cross-event processing nodes comprise nodes of the following types;

a product node for receiving a plurality of input streams of event data items, said predetermined relationship being between event data items present in said input streams and being satisfied upon the existence of event data items in said input streams that are in given time relation to each other, each event data item of the output stream relating to a combination of the events represented by the event data items of said input streams;

an unless node for receiving first and second input streams of event data items, said predetermined relationship being between event data items of said input streams and being satisfied upon the existence of an event data item in said first input stream without the existence of an event data item in said second input stream that is in given time relation to the event data item of the first input stream, each event data item of the output stream corresponding to an event data item of said first input stream.

17. A method according to claim 16, further comprising nodes of the following type:

a table node arranged to receive an input stream of event data items and to store event data therefrom including said time of occurrence, the table node being responsive to being interrogated with a specified time, to return event data current at that time;

a said cross-event processing node in the form of a table-referencing node for which said predetermined relationship takes the form of a given time relation between an input event data item and a particular event data item which, if it has occurred, has its event data stored in said table node, said given time relation being met if at a particular time said particular event data item was the current item with event data stored in the table node, the table-referencing processing node testing for this time relation by interrogating said table node with said particular time and examining the returned event data to ascertain if it indicates the presence of said particular event data item.

18. A method according to claim 14, wherein for each type of said event-processing node in terms of the processing operations effected thereby, there is provided functional processing code for carrying out that processing, each said event-processing node having associated data items including:

first data, the same for all nodes of the same type, that identifies said functional processing code relevant to that node type; and

second data, specific to each node, including data that identifies for each of said at least one output stream associated with the node, the destination of the stream.