Event-based systems, event-driven management systems, event-based applications, publish/subscribe systems, content-based networking, event-processing, incident handling events, intrusion detection events, application-flaw related events, configuration change events, and other similar typical event-related expressions capture so much semantic and complexity that each in turn deserves a special presentation. There is a growing consensus between practitioners and scientists on event taxonomy, event processing operations (filtering, correlating, aggregation, etc.), temporal representation, and the system requirements to receive, subscribe, process, and deliver events. Nonetheless, the hot industrial challenges in management systems to producing, handling and reacting to the events are shadowed by very simple, yet unsolved across the industry, definition, interoperability, and implementation problems.
The talk will briefly illustrate through use cases covering device instrumentation, network protocols, domain-oriented application, and management applications several angles of current concerns. The declared target is to identify challenges and raise appropriate questions, open to a large debate. Some issues may have immediate and simple solutions; others may be simply postponed, due to the lack of feasible and testable solutions.
At the device instrumentation level, we will tackle the loose and strong events forms, and their related notions of simple, complex, and pre-processed events, with examples from Syslog-based and SNMP-based systems. Issues related to the performance of parsing and tagging in normal and high speed networks will be analyzed. We will then focus on some versioning and version conversion aspects concerning SNMP-events' OIDs and naming, the inconsistency in definition/implementation of mandatory/optional recommendations, and the reliability and scalability in event systems at this level.
Generic concerns relate to the temporal issues; multiple timestamps make event processing difficult; some device types may not have clocks at all, others are slightly, yet uncertainly, non-synchronized, while some types of networks may be delay tolerant. A uniform representation of the timestamps is still under consideration in standards and it will be briefly discussed.
Linking the events to the system behavior raises the problem of a common syntax, if not a common semantic; alternatively, event conversions and format translations are needed. Domain-oriented events are the most challenging for system interactions and event processing, as we count a growing number of heterogeneous formats covering intrusion detection, accounting, fault, performance, incident, vulnerability, state change, etc. The message intended by this talk is that an educated event design and consistent implementation could dramatically reduce the set of real concerns, regardless the systems used to handle (transport, process, and react to) the events and a particular technology used for supporting a given design (CORBA, JMS, TIBCO.)
Without overlapping with the rich and diligently chosen workshop's topics, the talk brings into discussion several basic solutions under implementation in Cisco Systems, Inc. intended to be ported towards standards; they are especially related to reporting complex semantic behavior, embedded pre-processing directives, and smart buffering mechanisms for reliable events.
The dozens of remaining questions are open to the debate. Mostly, they are related to the workshop topics, but expand to the new industrial paradigms. Concepts such utility-based computing, autonomic computing, diagnosis-in-the-box, diagnosis out-of-box, adaptable applications, self-adaptable applications, and reflexive environments require a new approach of formalizing events, architecting event-based systems, and integrating such systems. Additionally, GRID systems bring into the landscape the concept of intermittent and partial behavior related to resource sharing that may require a special semantic on SLA/QoS violation events. Events related to traffic patterns and the dynamics of performance and availability changes in such environments requires particular metrics and processing, as well. Another hot area quite poorly covered in terms of event-related requirements is MPLS OAM and all aspects related to MPLS VPN. The talk will emphasize why these areas are perceived as hot coming industrial topics and where are the event-related challenging issues.
We end with a brief discussion on several references to the ongoing work, touching a few of the issues mentioned above, and opening a debate on other open questions not mentioned in this talk.
Petre is the IEEE ComSoc Committee Chair of Dynamic Policy-Based Control in Distributed Systems, and involved in the innovative NGOSS industrial initiative in TeleManagement Forum. Petre is also a Rapporteur in Study Group 4 at ITU-T. He has been an invited speaker to many international conferences, a tutorial lecturer, chaired several international conferences, and published many technical papers.
He is currently an Adjunct Professor at Concordia University, Montreal, Canada, a Senior IEEE member, and an ACM member. He recently founded IARIA, a non-profit organization for promoting new ideas and bridging scientific events across the world.