Our preliminary experience of using COBEA for building distributed active application systems includes developing an alarm correlation system for network management in telecommunications. This work [13] shares motivation and scenarios with alarm correlation research being done in Nortel Technology [20], but offers a solution to the problem that differs in key design elements, and offers it on the COBEA platform. Alarm correlation including alarm filtering can occur at several levels in the progress of an event from the raising object (usually a network device) through any intermediate critical real-time controlling software to the network manager. These levels (in the order of the lowest to the highest) are: hardware element; real-time control; system management. Our focus is on the system management level.
Alarms can indicate possible problems (i.e. raise hypotheses), can confirm existing hypotheses or can be accepted (without change of state) by existing hypotheses or existing (confirmed) problems. We use the Composite Event Language to express the complex relations between alarms and problems/hypotheses by treating alarms as base events and problems/hypotheses as composite events. We employ the evaluation engine and composite event language parser implemented in order to monitor and trigger these composite events. The system manager supplies the alarms (base events) to the composite event server, which monitors the composite events (problems/hypotheses) and notifies the problem/hypothesis browser in the alarm correlation system. After a problem has been diagnosed, appropriate actions can be taken at the system management level for network restoration. The work has shown that it is feasible to support active alarm correlation using COBEA and the Composite Event Language, and has suggested directions to improve the language [13].
Currently, we are building a trial system that features a graphical user interface for registering, de-registering and browsing composite events, and an event generator which can generate events of any specified type at a given interval. Performance will be measured to see if the system is suitable for on-line real time alarm correlation. Some real-time issues are discussed in [7]. Our experience shows that an event mediator can be used as a front end active database that incorporates the existing network management information base which supplies the network configuration data, and as a proxy for some of the dumb devices which signal alarms but do not understand CORBA.