B
Glossary

The following is a summary-level explanation for some of the key terms and concepts used in this book. Their meaning in the context of event processing differs from their meaning in other realms in some respects.

A-E-I-O-U features: Five kinds of business requirements that indicate the need to use event-processing techniques: a daptability with respect to change, management by exception, instrumentation of a system to measure and record events, responding to situations from outside the virtual enterprise, and responding to unanticipated situations.

agent: An entity, such as a person or software component, that is capable of action.

alarm fatigue (also called alert fatigue): The condition of a person who has received too many false alerts. This is a common issue in event-processing system design and operation because people tend to turn off systems that cause this problem. See also false positive.

alert: An event notification intended to cause a response.

business activity monitoring (BAM): A kind of business intelligence that provides access to current business performance indicators to improve the speed and effectiveness of operations. It is sometimes called operational intelligence or near-real-time, process-driven business intelligence. BAM uses CEP in most applications.

business event: Anything that happens that is significant to a company, governmental agency, or another organization in the course of its business. Examples of business events include placing a customer order, delivering a shipment, changing an address, executing a bank transaction, experiencing a power outage, and hiring an employee.

business event processing (BEP): 1. Any computing that deals with business events. 2. Event-driven CEP in which some of the application development is performed by people who do not work for the IT department (for example, businesspeople specify some event-processing rules or patterns).

causal: Necessary to have occurred first. Causality is an important kind of relationship that can be present between events. Event A is causal to event B if A had to happen before B could happen. Causality is necessary but it may not be sufficient. If A and C are causal to B, then B will not occur if A occurs but C does not.

CEP platform (also called CEP suite, event-stream processor): A software subsystem that includes CEP software and is designed to support event-driven CEP applications.

CEP software: Any computer program that can generate, read, discard, or perform calculations on complex-event objects.

communication-enabled business process (CEBP): A business process that leverages telephony or telephony-related technology. CEBP applications typically use a mix of web, Short Message Service (SMS), or other integrated computer and telephony technology to notify people or arrange joint conference calls to respond to a situation. CEBP is often used with directory services such as LDAP (Lightweight Directory Access Protocol).

complex event: An event that is an abstraction of one or more other events. It represents the collective significance of those events. Complex events represent summary-level insights that are more meaningful and helpful for making decisions than are the simpler events that contribute to it. “Complex event” can refer to an event happening or to a complex-event object. See also simple event.

complex-event object (also called complex event): An event object that is an abstraction of other events or event objects. Most complex-event objects are synthesized by performing CEP computations on base (input) event objects. See also composite event.

composite event: A kind of complex-event object that is synthesized by combining member events using a specific type of computation. Member events are any base events used in creating a composite event. A composite event includes its member event objects, whereas most complex-event objects include only a unique identifier for their base events or don’t contain generic information about their base events at all.

continuous intelligence system: An event-driven system that supports automated or partially automated decision making and runs in an uninterrupted manner. It is a complement to periodic intelligence systems that are request-driven or time-driven. Situation awareness relies on continuous intelligence systems.

contract: A statement by the developer of a component about what the component does; users of the component rely on this statement to design systems using the component.

crowd-sourcing (also called sensing of crowds): Obtaining information by tapping the collective knowledge of many people.

cyber-physical systems: Systems that conjoin information systems with physical systems, typically by leveraging event processing.

derived event: See synthesized event.

dissemination network: A set of channels and event-routing intermediaries that moves events among event producers, consumers, and event-generating EPAs. A dissemination network can filter events and route them intelligently but does not alter them.

event: 1. Anything that happens. 2. A state change. 3. A detectable condition that can trigger a notification. See also event object.

event channel: Any means of conveying event notifications from producers to consumers. A channel can carry events of multiple types. Events transported by a single channel may be consumed by multiple event consumers (the channel is said to fan out). Events transported by one channel may originate in multiple producers and be delivered to one consumer (the channel is said to fan in).

event cloud: A set of event objects that is not completely organized in any systematic way. It typically encompasses multiple event streams and channels.

event consumer (also called event sink, event handler, event listener): An eventprocessing agent that receives event objects.

event-driven: A characteristic of a person, software module, or other entity that acts when it detects an event. A person is event-driven when he or she reacts immediately upon finding out that something has happened, perhaps by seeing it or hearing about it. When software is event-driven, however, it is eventobject driven—it has received news about an event in a notification.

event-driven architecture (EDA): An architectural style in which one or more components in a software system are event-driven and minimally coupled. “Minimally coupled” means that the only relationship between the event producer and the event consumer is a one-way, “fire and forget” notification. The producer does not get a response associated with the notification back from the consumer, and a notification does not prescribe the action the consumer will perform. Something is event-driven without being EDA if it is not minimally coupled.

event-driven SOA: An architectural style in which the principles of EDA and SOA are implemented together.

event object (also called event, event entity): A record of an event. Intent is essential to the definition of event object—it is intended to convey information, not just store information.

event pattern detection: Searching a set of events (an event “space”) to find matches to a pattern.

event pattern discovery: A process of finding new event patterns. This is generally accomplished by people with the assistance of software. In machine learning, software can discover a pattern based on positive and negative examples and feedback such as thumbs-up and thumbs-down responses to categorizations made by the software.

event processing: 1. Any computation that involves event objects. 2. The design discipline of event processing, encompassing the principles, reference architectures, design patterns, and best practices related to computing with event objects.

event-processing agent (EPA): An agent that creates, discards, or performs calculations on event objects. A physical EPA is a software component. A conceptual EPA is an abstraction that performs logical functions. An EPA can be an event producer, consumer, or both. An EPA can be a consumer relative to one event and a producer relative to another event.

event-processing language (EPL): A high-level computer language for defining the behavior of event-processing agents.

event-processing network (EPN): A set of EPAs and channels connecting them. An EPN has at least one event producer, one consumer, and the dissemination network between them.

event producer (also called event source, publisher): An agent (EPA) that emits event objects. Producers include devices in the physical world, transactional applications, and continuous intelligence applications.

event provenance (of an event object): 1. A description of the sequence of steps by which an event object is generated. 2. Data items used to record the steps in the process by which an event object is generated.

event stream: A sequence of event objects arranged in some order, usually the order of arrival at a consumer. Event streams are usually in motion—for example, arriving in notification messages. However, an event stream can be at rest in a file or database.

event-stream processor (ESP): 1. CEP platform. 2. A CEP platform that is optimized for handling one or a few event streams, each of which has a high volume of events (thousands or hundreds of thousands of notifications per second) that must be processed very quickly (for example, in a few milliseconds each).

event type (also called event class, event schema): A description of the data items held in a particular kind of event, including their structure, the manner in which the data is encoded, and the operations that can be performed on them. All event objects are instances of an event type.

false negative: Failing to report an event that should have been reported.

false positive: Incorrect reporting of an event that does not occur.

fat-finger trade (in trading operations): An erroneous trade in which the amount or price is different from what the trader intended. For example, a fat-finger error may result in a trade of a million shares of a stock when the desired trade was only a thousand shares. The name “fat finger” derives from possible errors caused by a person with a fat finger who accidentally types extra zeros in the amount to be traded or leaves his finger on a key for too long.

instance agility: The ability to handle each instance (iteration) of a business process in a unique manner.

instantaneous event: An event whose beginning time is the same as its end time. It is the opposite of an interval event. In some approaches to event processing, all events are instantaneous (each happens at a point in time).

interval event: An event whose beginning time is different than its end time. It is the complement of an instantaneous event.

intermediary (in an event-processing network): A software agent that is interposed between two or more EPAs. Channel intermediaries provide messagehandling services but don’t perform any computation on event objects within notifications. An EPA intermediary is an event consumer and event producer that performs computation on event objects.

latency: The time it takes for a system to respond to an input.

notification: 1. An event object packaged in a form that can be conveyed from an event producer to an event consumer. 2. An event-triggered signal sent to a runtime-defined recipient. See also transactional notification and observational notification.

observational notification: A notification that reports an event but doesn’t directly change anything in a transactional application or in the physical world.

PC-cubed: Six factors that are increasing the prevalence of event processing. Suppliers are offering products with improved price, pervasiveness, and performance. This results in technology push. Consumers are seeing a growing amount of celerity, connectedness, and complexity in their business activities. This results in demand pull.

process agility: The ability to change a whole process to support new kinds of products or services.

publish-and-subscribe: A pattern for decoupled communication in which the identities of the consumers are defined in independent entities, subscriptions, rather than being built into the publisher or the channel. Publish-and-subscribe systems consist of publishers, subscribers, consumers, event-generating EPAs, and dissemination networks. Publishers generate data, such as event notifications. Consumers receive data. Dissemination networks include channels, subscriptions, and subscription managers. Subscribers send subscriptions to the subscription manager at run time or startup time. Subscription managers ensure that published information that matches each subscription is delivered to the corresponding consumers. A subscription manager is usually an eventrouting intermediary agent, but a publisher sometimes acts as the subscription manager. See also subscription and subscriber.

REACTS: Six sets of metrics relevant to cost/benefit analysis of business problems that may be suitable candidates for event-processing approaches. REACTS encompasses the relevance of information, effort in tailoring a user’s interest profile, accuracy of detected events, completeness of detected events, timeliness of responses, and safety, security, privacy, and provenance of information, and system reliability.

request-driven: A characteristic of a person, software module, or other entity that acts when it receives a request from a client or consumer agent.

service-oriented architecture (SOA): An architectural style in which software systems are modular and some components (service providers) are distributable, discoverable, substitutable, and shareable.

simple event: An event that is not a composition of other events and is not synthesized or otherwise abstracted from other events (the complement of a complex event).

situation: A combination of circumstances that is meaningful to an observer. In the discipline of event processing, a system is said to detect a situation when it finds a simple or complex event that a user of the system deems to be meaningful for any reason. A situation reflects the fact that some event data item, combination of data items, or pattern match instance has met some criterion that indicates a threat or an opportunity. A situation may be inferred from the occurrence of an instance of an event pattern. A situation typically leads to a response.

situation awareness (also called situational awareness): Knowing what is going on so that you can decide what to do.

smart infrastructure: Infrastructure augmented by information technology, typically including EDA and CEP.

spam: Information received by an agent that is unsolicited and irrelevant to the agent.

subscription (in publish-and-subscribe communication): A specification that defines which messages should flow to which consumers. It contains instructions to be used by the dissemination network that delivers the messages. A subscription is a discrete entity, separable from the publisher and consumer components. In some publish-and-subscribe systems, subscriptions make it possible to add, drop, or change publishers and consumers dynamically at run time. In others, subscriptions are determined at startup time.

subscriber (in publish-and-subscribe communication): An agent that generates a subscription. In many systems, the consumer is also the subscriber. However, in other systems, the subscriber is the event publisher or a third party.

synthesized event (also called derived event): A complex-event object that is generated as a result of applying a method or process to one or more base event objects.

time-driven: A characteristic of a person, software module, or other entity that acts at a specified time. A clock notifies the entity when to commence action.

time stamp: A data item in an event object that records the reading of a clock. Time stamps typically refer to when the event occurred, when the event object was created, or when it arrived at a consumer.

transactional notification: A notification that reports an event and directly causes something else to happen in a transactional (operational) application.

window: A bounded segment of an event stream. For example, the events in the last ten minutes are a moving window.