Changes between Version 3 and Version 4 of GENIMonitoring/Alerts


Ignore:
Timestamp:
05/12/15 16:49:27 (6 years ago)
Author:
cody@uky.edu
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • GENIMonitoring/Alerts

    v3 v4  
    1717The publish/subscribe queuing system allows streams of raw metric data to be replicated between many processes in parallel.  This allows us to instantiate one or more complex event processing engines ''CEPE'' per replicated data stream and one or more queries inside of each CEPE.  We make use of the Esper [http://www.espertech.com/] CEPE.   
    1818
    19 ==== Esper Complex Event Processing Engine ====
     19==== Esper complex event processing engine ====
    2020Esper allows us to analyze large volumes of incoming messages or events, regardless of whether incoming messages are historical or real-time in nature. Esper filters and analyzes events in various ways, and respond to conditions of interest.  An example of the Esper CEPE architecture is shown in the figure below.
    2121
     
    2626==== Esper Queries ====
    2727
    28 In a typical database we query existing data based on some declarative language.  We can think of and Esper query like an upside down SQL, where if events occur in the future, results will be emitted.  The Using the ESPER query language, ''EPL'' (similar to SQL) complex events can are described.
     28In a typical database we query existing data based on some declarative language.  We can think of and Esper query like an upside down SQL, where if events occur in the future, results will be emitted.  The Using the ESPER query language, ''EPL'' (similar to SQL) complex events can are described. 
    2929
     30Consider the following EPL query:
    3031
    31 Consider the following EPL query: select count(*) from MyEvent(somefield = 10).win:time(3 min) having count(*) >= 5
     32{{{
     33select count(*) from MyEvent(somefield = 10).win:time(3 min) having count(*) >= 5
     34}}}
     35
     36* There exist a stream of events named ''MyEvent''.
     37
     38* In the ''MyEvent'' stream there are events that contain a field named: ''somefield''
     39
     40* In a 3 minute window, if ''somefield'' = 10 five or more times, emit data.
     41
     42Just as traditional relational databases, and their related SQL queries, use specific data type operations based on column data types, data streams processed by Esper are defined by strongly typed object classes.  In the previous EPL query the ''somefield'' field would have to defined as a numeric time in order for mathematical comparison to work.       
     43
     44For GENI Monitoring alerts, we use the LogTick class shown in the code block below:
     45
     46{{{
     47public static class LogTick
     48{
     49        String urn;
     50        String metric;
     51        long ts;
     52        double value;
     53       
     54        public LogTick(String urn, String metric, long ts, double value)
     55        {
     56            this.urn = urn;
     57            this.metric = metric;
     58            this.ts = ts;
     59            this.value = value;
     60        }
     61        public String getUrn() {return urn;}
     62        public String getMetric() {return metric;}
     63        public long getTs() {return ts;}
     64        public double getValue() {return value;}
     65       
     66        @Override
     67        public String toString()
     68        {
     69                return "urn:" + urn + " metric:" + metric + " timestamp:" + ts + " value:" + value;
     70        }
     71    }
     72}}}
    3273
    3374