How events are processed using rules


Rules are associated with a specific rule phase based on their type; each phase represents a logical stage of event processing. The cell processes each incoming event one phase at a time and evaluates each event against one rule at a time. Internal events are always processed before external events. The order in which the cell evaluates events against rules is determined by the order in which the rules were loaded.

The following figure identifies the rule phases and shows how event processing proceeds, and the following table describes the phases.

Event processing rule phases
Event_processing_rule_phases.png

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Cell rule phases

#

Rule phase

Description

1

Refine

Validates incoming events and, if necessary, collects additional data needed before the event is processed further

2

Filter

Identifies events that must be discarded

3

Regulate

Evaluates events, and, if evaluated as true, collects duplicate events for a time period

If a specified threshold of duplicates is reached, the Regulate phase passes an event to the next processing phase.

4

New

Determines which events in the event repository must be updated with new information from new incoming events

During this phase, the following events are observed:

  • Actions are triggered that must be performed just before a new event comes in.
  • Previously received events are updated, and the new event optionally might be dropped.

    Note

    This is the last opportunity to prevent an event from entering the event repository.

5

Abstract

Evaluates events and, if certain conditions are met, triggers the generation of abstraction events

An abstraction event is a summary event based on other events that are occurring.

6

Correlate

Determines whether any events have a cause-and-effect relationship

7

Execute

Specifies actions to perform when a slot of a new event matches a condition or a slot of an old event is modified to satisfy a condition

8

Threshold

Specifies the actions that must be performed when a certain number of duplicate events have been received over a certain time period

9

Propagate

Determines whether an event is forwarded to another cell or integration product

10

Timer

Specifies actions to be executed when a timer has expired

A timer can be set in the New, Abstract, Correlate, Execute, Threshold and Delete phases.

11

Delete

Triggers actions to ensure that data integrity is maintained when an event is deleted from the event repository during the cleanup process

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*