Application And Research Of Complex Event Processing In Centralized Monitoring Of The Distributed System

Currently, most companies focus on IT infrastructure monitoring for unified management and scheduling, improving the performance of business applications. For the monitored massive events, how to effectively use them together to get more valuable information is significant. However, when large-scale IT resources are centralized monitoring under the distributed systems, it returns large numbers of complex events, the problem for failure analysis and process uncertainty is too large, such as human factors causing the event correlation detection not accurate or slowing the response time. Service interruption or exception suddenly may affect a large number of customers’usage and result in service delays or even ultimately bringing significant losses. In this paper, we research the complex event processing technology to solve the event correlation, connecting with the application requirements in terms of improvement, in order to speed up the response time and improve the detection accuracy.Firstly, this paper introduces the present situation for the application of complex event processing system at home and abroad. Considering the demand for the network monitoring project, we do in-depth study and discussion. First of all, this paper analyzed the existing monitoring framework, researched the acquisition methods of events, event representation, the event representation style and so on, and then summed up the problems existing in the monitoring. For the feedback problems that exist in the monitoring events, such as the returned event quantity is big, events processing speed is slow, due to the rule definition not accurate producing a large number of redundant events and results in processing the event difficulty and response not timely, the paper puts forward methods from two aspects to solve.On one hand, in order to improve the speed of query processing, this paper used the relationship engine and event engine, a combination of two methods, to do the multiple query optimization. Based on how to schedule the rules’schema in multiple query rules, from the perspective of minimizing CPU usage, this paper proposed a multiple query optimization method based on the query cost, using the greedy algorithm to optimize the rules engine, then the event correlations are implemented effectively, improving the speed of event handling.On the other hand, for rule definition is not accurate, external random factors such as the reasons for the uncertainty caused by a large number of events and alarm events problems, we propose the new solutions based on the Dempster-Shafer (shorted as D-S) evidence theory. While the existing event processing systems are on the premise of the association rules predefined, for the unknown or uncertain events, it cannot correlate them. Moreover, many of predefined rules are based on subjective experience, it may not be accurate in practice, coupled with the impact of environment, the derived common sets of rules are very difficult to apply for the failure analysis. The D-S evidence theory is able to handle the events that are uncertainty or lack of condition, even if the information is incomplete or inaccurate, it also can be reasoning, it is a kind of transformation model. From this perspective, we extend the complex event processing system and propose a new intelligent solution, using the D-S evidence theory based on information fusion method to automatically locate events causes, thus reducing the alarm of redundant information. This method not only solves the limitations whose detection conditions are inaccurate or inadequate that results in the root cause cannot be detected or analyzed timely, and plays a good role in the failure to obtain the potential of information and uncertainty analysis, it offers leverage by considering the real-time and accuracy in detecting events.Finally, the experiments verify theoretically the rationality and validity of the proposed methods.