Event Processing blog

Rendering Unto Caesar - The Role of the Business User in CEP

"Render unto Caesar the things which are Caesar's
and unto God the things that are God's"

A recent posting in the Enterprise Decision Management Blog entitled "Can we trust business users" addresses a topic that seems equally pertinent to the CEP market. I think there is a tendency to become so enamored with the technical virtuosity of new technology that we may lose sight of who the real users are. In terms of the development of CEP applications, an understanding of the prospective roles of business users vs. that of IT developers seems to be an evolving thing. Apama has long been a proponent of the participation of the business user in the process of building CEP-driven applications. In Capital Markets, the notion of "empowering the trader" has been a key element of our strategy and the Apama product offers a graphical development tool, Event Modeler, that focuses on that constituency. We have another RAD tool that is intended for developers who can create applications in our event processing language, as well.

We are beginning to see third party validation of the value of this approach from outside of Capital Markets, as well. For example, a report from Forrester Research published earlier this year indicated that early adopters of CEP have tended to come from the line of business rather than IT because "developers and architects often know painfully little about these [non-traditional, non-IT] events and how they are used to run a business." That Forrester quote is certainly not intended to diss IT. It just recognizes that there are lots of different kinds of events that are important to a business and not all those events are traditional IT-aware or IT-generated events. In order to make sense and respond to such events, it seems quite logical that providing tools that are amenable to a more "business" oriented audience is important.

But I would argue that it is not just the nature of events - and their varied sources - that suggests a strong correlation between CEP and business users. It is also the nature of the CEP-driven applications themselves. CEP applications are not "one and done", they tend to be iterative and evolving, because they are crafted to respond to what is happening and what is happening is often a frequently changing set of conditions. Or, if the conditions are not changing, how you choose to respond to them may be changing. So you need to continually calibrate and revise.

In another Forrester report published earlier this year, this characteristic was noted within the context of a review of Business Activity Monitoring best practices. Event-driven BAM is a particularly strong use case for CEP and the report stated that BAM efforts "are typically never-ending projects" with a "high degree of change." That makes sense since BAM monitors 'business activities' and the nature of most businesses will change over time. So to support BAM applications, it seems perfectly logical to provide tools for business users who can take on some role in the initial development and ongoing operational calibration of these applications. There is clearly an important role for developers in building these applications – no one would suggest otherwise, but we best not forget what the “B” in BAM refers to.

What seems to be emerging is the notion that we are should not look at CEP and/or BAM deployments as discrete, finite projects with clearly prescribed end dates. They are continuously iterative projects that must evolve to remain effective. That’s the environment in which they operate. Given that, perhaps we should not see the roles of business users and IT as fitting within well prescribed boundaries. The development and ongoing management of these applications will have evolving roles for the line of business user and for IT over time. We might expect IT-centric development to have a more dominant role in the initial deployment, but over time the goal might be to have the line-of-business assume greater and greater roles - because the business will be the dominant user and best positioned to react to changing circumstances.

Perhaps the EDM blog posting says it best, though it expresses it within a "business rules" context. “Too many rules specialists focus on rules that will get executed and not enough on the people that will maintain those rules, although this is where the success of the project resides.” That is quite the same for CEP and BAM. There is a role for business users, driven by the nature of events and the continuously evolving nature of the applications that are “event-driven.” And it is incumbent on the technology provider to offer tools that will facilitate that evolution. All the CEP performance in the world will be of little use, unless that performance is well-aligned with the needs of the business.

So we might debate who is the metaphorical Caesar and who is God in CEP development, but the success may well rest on giving each their due.

Asia Report: Fighting White Collar Crime

Hello from Hong Kong. As always it is fascinating to see how CEP is evolving in Asia. One trend I am observing is the huge interest in Hong Kong in rogue traders and white collar crime – and how CEP can be used to detect and prevent this – before it moves the market. Obviously the original rogue trader, Nick Leeson, is well known here. But there has been a great deal of interest in more recent goings-on, at firms such as SocGen. Amazingly, until a couple of years ago, insider trading was not illegal in Hong Kong! Now we have a highly volatile market, with a lot of uncertainty, huge event volumes and a real problem of seeking out and preventing rogue trading activities, as well as managing risk exposure proactively.

Of course CEP provides a compelling approach. In market surveillance - the ability to monitor-analyze and act on complex patterns that indicate potential market abuse or potential dangerous risk exposure can allow a regulator, trading venue or bank to act instantly. Banks want the reassurance that they are policing their own systems. Regulators need to protect the public. The media and public here find this fascinating.

On the topic of a different kind of white collar crime – consider using CEP to detect abuse in the gaming industry. The gambling phenomenon that has propelled Macau to overtake Las Vegas as the world’s biggest gambling hub is also an exciting opportunity for CEP. We have customers using CEP to monitor and detect various forms of potential abuse in casinos. Events that are analyzed to find these patterns include gamblers and dealers signing on at tables, wins and losses, cards being dealt etc. It is possible to detect a range of potential illegal activities, ranging from dealer-gambler collusion to card counting.

As a final thought - having met with some of our customers that operate both in Hong Kong and mainland China, it is clear that China is a massive market opportunity for CEP. Exciting times ahead for CEP in Asia.

Dr. John Bates on Fox Business News

As readers of this blog know, Apama was chosen by the UK regulatory agency, the Financial Services Authority, to provide the CEP technology that delivers real-time market surveillance as part of the the FSA's SABRE II project (FSA/Apama Announcement). In a recent interview by the Fox Business Network, John Bates discussed how Apama can be used to detect patterns of suspicious trading behavior - much like Apama is so often used to identify and respond to market patterns in support of algorithmic trading applications.  The link below will take you to the Fox URL that plays the video.

Fox Business Interview with Dr. John Bates

 

The Opportunity for Business Intelligence: Is it Evolution or Revolution?

Some recent news on improvements and changes in approaches to BI architectures caught my eye. New technologies suggest that there maybe alternatives to traditional BI architectures (see the recent posting by Curt Monash on in-memory BI and Philip Howard of the Bloor Group on data warehouse appliances).  Though I am not intimately familiar with these new approaches, they seem to suggest the kind of blazing speed and application to some areas, (for instance in-memory analytics and activity monitoring) that overlap with the capabilities of CEP applications.

Maybe a new turf war is on the horizon.

In an article in DM Review earlier this year, Larry Goldman of AmberLeaf took on the daunting task of whether a new event processing technology is required to support a more responsive BI architecture. Larry posed a series of questions for determining whether you should go the CEP route or can make do with existing technology. In light of the new commentary referenced above, I’d like to augment/question some of the thoughts in the Goldman article to show that there are other criteria that argue for going the CEP platform route and that, as we are fond of saying, it’s not just about ‘feeds and speeds.’

(Excerpted from DM Review January 2007, Customer Intelligence: Event Processing Alphabet Soup) with comments interspersed:

1. Do I already have competencies in real-time messaging and streaming? If you do, you may not need an application [specifically designed for CEP}. If you don't, these products may decrease the learning curve.

Agreed that one may have competencies in real time messaging and streaming in terms of accepting the data and storing it, but are you processing it as it arrives?  You must also consider what benefit you can draw from handling this data ‘in flight’ vs. persist, query and analyze?

2. Can my reporting infrastructure handle operational BI, scaling to hundreds or thousands of users? If it cannot, these tools may be able to scale without forcing you to be a performance guru.

Can my infrastructure handle operational BI?  What is operational BI? I believe it’s the notion that traditional BI tools do great at mining vast quantities of captured, processed and transformed data to produce graphs, charts and metrics.  But how do you transform those graphs and charts and metrics into actions – this is what operational BI is looking at.  And this is where the intersection with BAM, CEP, and EDA comes into play.

3. Can users easily identify or specify events to track? If they can't, these tools may help you identify and monitor events without IT involvement.

Can users easily identify or specify events to track?  One of the things that I think is on the forefront in CEP is technology that can determine or detect meaningful patterns, rather than be programmed or setup to react to known/defined patterns.  We see this as a major wave for CEP evolution.

4. What does real time mean to me? How fast do I need to make decisions? Do I have the people or the processes to react in real time?

I don’t disagree with that.  This was central to the recent Roy Schulte presentation on BAM at the Gartner CEP conference in Orlando (September 2007).  Roy has created strata to show that there are different applications and verticals that have different perceptions of real-time, ranging from those measured in milliseconds (e.g. trading) to those measured in minutes and hours (e.g. supply chain management).

5. Perhaps there is a 5^th question here and that is one that presents the unique capabilities of CEP to the audience.  Do I need to monitor event data across time windows (A and B happen within X of one another [or not])?  Do I need to monitor large numbers of permutations of each rule simultaneously?  Do I need to derive or infer activity from my event flows?  Traditional query based approaches struggle with these issues especially if the demand or query refresh rate is high.

As the world of traditional BI architecture evolves and users look to determine whether CEP based architectures are appropriate, it is important to note that there may be additional benefits to the use of CEP rather than just ‘trading up’. Why not look at the two technologies as two parts to a greater solution? Augmenting an existing BI infrastructure with CEP is one approach (in which one applies event processing logic to the streams before they are passed into the data warehouse/analysis layer) as is augmenting a CEP solution with analytics/KPI from an existing BI infrastructure. There are opportunities for both sets of technology and collaboration in this instance may help to clarify rather than obfuscate for the target user.

 

Thank You Gartner - Event Processing Conference #1 In the Books

Between September 19^th and 21^st, Gartner held its first conference on Complex Event Processing and Business Activity Monitoring in Orlando, Florida.  Some 200 people (by my estimation) came together to meet others interested in these technologies, as well as see and hear presentations from a range of Gartner analysts, CEP vendors, educators and thought leaders, and most importantly users of CEP.  The conference was bookended by impressive presentations from Roy Schulte and Bill Gassman on Day One setting out the current state of the CEP and BAM market, and by Dr David Luckham who closed the conference with a thoughtful and insightful look at the future of CEP. 

 

We’ll blog entries about different aspects of the conference over the coming days and weeks.  But for now it is important to stress how vital the timing of this conference was and how its attendees have shown that the principles of CEP are beginning to take hold in a wide array of industries and solutions.  Between the 3 conference tracks organized by Gartner (Event Processing, Business Activity Monitoring and Event Processing in Banking and Capital Markets) and the vendor sponsored sessions, we heard descriptions of applications of CEP in a variety of scenarios ranging from algo trading to clickstream analysis to content distribution to manufacturing and many more.

 

Architectural presentations were also prevalent with many sound ideas being put forward on the relationship between the ever evolving alphabet soup of CEP, BAM, SOA, EDA, BPM, OLTP, ESB and I am sure, many others.  Bringing together an audience such as this to discuss both practical implementations and more theoretical research allows insight to flow around the CEP community and to understand the ramifications for when CEP is seen as more than just event feeds and event processing speeds. For true application infrastructures to be built on the principles and technologies of CEP, a wide understanding of how we can evolve the relationships between these disciplines will be key.  And that understanding will come from the continued holding of conferences such as this one (already looking forward to next year in
New York) and interplay between the many disciplines, vendors and consumers of these technologies.

 

Dr Luckham posited that CEP will become a ubiquitous infrastructure technology in some 30 years.  For that to be true - indeed for it to happen sooner - we all have a lot of work to put in … but you can be sure that it will be worth it.

 

Understanding Event Driven Architecture by Schulte / Chandy

Roy Schulte and Dr. Mani Chandy got together on this nice article on CEP and EDA, called Understanding Event Driven Architecture.  It succinctly describes complex event processing, event driven architecture, and business activity monitoring, three topics we're primarily concerned with in this blog.   

One of the sections of the article that I think is important and relatively new is their breakdown of "pull-based" versus "push-based" applications as one of the distinguishing characteristics of event processing applications versus more traditional applications.

The conclusion of this article provides a concise summary:

"EDA is under-utilized because architects, software engineers and business analysts   sometimes fall back on the familiar pull and scheduled models as a matter of   habit. This results in business processes that are slower and less responsive   than they should be. Businesses need to make more of their processes event-driven.   The push concept and the desirability of running some business processes straight-through   are not difficult to grasp and they are being used more frequently as business   pressures grow and as developers get more comfortable with using EDA. Some parts   of all new business systems should use EDA, while other parts should still use   pull and scheduled patterns. The key is to understand the advantages of each."

Read the entire article at the source here:  Understanding Event Driven Architecture

BAM Myth #4: Limit BAM to Monitoring Simply KPIs

Here’s another in our “BAM Myths” series, exploring some of the preconceptions behind BAM.

An uncontroversial definition of BAM’s role is “to provide real-time business visibility into important business data and processes”. Take the example of the monitoring of client behaviour on a Web site. Perhaps we wish to understand how end-users are interacting with the Web site and also aim for a certain service level to be delivered. A candidate KPI (key performance indicator) to measure is the average response time between a request being received and the response dispatched back to the client.

This is certainly pretty straightforward to measure and put on a dashboard. We could also have a graph that goes red when the average response time goes above 1s. All very useful, but we should be able to go much, much further to give more relevant visibility. What about, for example, if we could predict when our service level might be exceeded in the future based upon current trends and therefore give us time to provide more computing resource? And if we could also use past activity levels at the relevant time of day to determine when the response time goes beyond two standard deviations from the historical average? We could also start correlating response times and an increase in clickstreams which failed to go all the way through to order placement. Lots of sophistication is possible by having the capability to properly correlate and analyse multiple streams of information coming from our underlying systems. Very few BAM projects get anywhere near delivering this though.

By not taking this approach, valuable business context is lost. Instead, simple, technical, KPIs are monitored which are probably only interesting and suitable for IT. It is surely preferable that the people who are responsible for business performance should have a dashboard in front of them that gives them the information directly.

Such requirements are required throughout an organization. Therefore organisations should ensure they use technology which can cope with a wide variety of different situations and which is agile enough so the BAM rules which are being applied can evolve as the organisation evolves.

Managers need to take their decisions faster with trust, consistency and depth. There is often no time for analysis of historical data to find out what happened. The decisions must be taken now, with a clear assessment of their potential organisational or business impact. This is why solutions that goes beyond simple monitoring with real time analysis and action capacities are required. And this is also why solutions that are supposedly BAM oriented, but are in fact just capable of simple KPI analysis and alerting, fall short.

BAM Myth #3: BAM Works Bottom-Up

When most large enterprises engage software technology vendors, they send in the wrong troops:  they send in IT.  Although IT is an absolutely critical stakeholder in an technology decision, too often the entire decision-making process is delegated to technologists.   With BAM, this approach is a recipe for disaster.

Here's a typical approach.  When organizations consider looking at BAM, they start by an inventory of all their hardware and software and try to associate business processes to this inventory.   Out of the gate, this process is difficult to get right, and requires a lot of estimation and guessing, becuase most infrastructure, in some way, is shared.  And, with the introduction of service oriented architecture, it is the goal of IT today to share assets.  So allocation schemes and decisions based upon them, begin in a flawed way.

Next, the key performance indicators (KPIs) from an IT point of view usually don't map to the KPIs of the from a business point of view.  Technology-oriented KPIs yield technology-oriented BAM dashboards, and technology-oriented views of business information.  Too often, a business user wants to see how many orders have been processed, and is shown a tree that displays the technical components supporting the ordering application. To find the answer to a simple question requires 100 clicks to discover an aggregated view of orders.  This is not the objective of BAM.

IT-driven software development also tends to be driven by software development methodologies that are designed to build software products, not answer business questions.  Successful BAM products utilize a heavy dose of rapid propotyping, high-level description of business processes, and isolation layers between BAM dashboards and the low-level IT infrastructure.

The output of bottom-up BAM is complex requirements expressed in technology terms, wasted time, and mixed results.  The output of top-down BAM is an engaged business, an application that fits the need, and the ability to rapidly evolve and expand the system as requirements change. 

The first word in BAM is the word "Business" for a reason - projects should begin with, always include, and always be measured by, the business. 

BAM Myth #2: SAM = BAM

Some CIOs feel that they have tried and failed with BAM by aggregating business views their technical components or alerts. Unfortunately, software vendors aggravate this myth because they sell their old network system management (NSM) tools as “business activity monitoring.” The problem is, it’s not easy to put a system monitor on the IT infrastructure and gain business insight from technical activity. That’s not business activity monitoring; it’s system activity monitoring. It’s not BAM, it’s SAM.

Without tools that help apply business context to technical events, SAM tools are IT operations tools. SAM tools are important, but only show that computers are working, or anticipate hardware failures (unexpected volume of data, wrong data processed, concurrent events that together are causing a business loss).

But just because the hardware is working, how do you know that your business is running well? Without the language of business built on top of system monitoring, you’re not doing BAM. BAM development tools help business users express their business commitments in business terms, taking into account technical alerts, transactions and customer behavior. They help a business user express key performance indicators (KPIs) that express SLAs with customers, key business metrics to track, and quality indicators like availability, response time, and error rates.

Complex Event Processing (CEP) is the language of BAM. CEP helps the business users simply express questions such as: are we ready to take actions? Are my service levels met now and are they trending towards non compliance? What actions could I take now to change that trend? Will I meet my deadline?

CEP provides a common language between IT and the business user, and allows business departments and technology business processes to interact – BAM and SAM – working together to provide more agility and faster problem resolution.

In Complex Event Processing, is “Un Oeuf Enough?”

(co-written by contributor Dr. Bart Schouw, Business Development Manager, EMEA)

Why do French recipes commonly prescribe to use only one egg in a recipe?  Because “un oeuf is enough.”  The same applies for event driven applications.  While many complex event processing (CEP) vendors harp on the ability to process 100’s of thousands of events per second (EPS),  the main value of CEP lies in an effective approach to event driven application architecture, not just the ability to handle large volumes.  It’s true that there are high-end CEP applications out there: in the financial services world of options pricing, the OPRA (Options Price Reporting Authority) penny-price feed will deliver 716,000 events per second (EPS) by January 8, 2008, and some of the CEP engines, like Apama, are built to handle these kinds of event rates.  But such EPS rates are the exception, rather than the rule, and the real value of CEP is much deeper than processing speed.

Outside of capital markets, the EPS demands for important event driven applications are often more modest.  For example, an Apama retail customer, in a relatively large automated warehouse management, has 75 pickers picking 500 items an hour, yielding about 40,000 order “events” an hour and 40,000 response “events” an hour (“done” or “unable to pick”).  That’s a total of 80,000 events an hour, or about 22 events a second.

22 events a second can realistically be handled by a traditional RDBMS solution, if the only technical challenge was about handling event volume. The leading CEP platform allow event-driven business logic to be expressed with a concise, powerful language that requires a fraction of the code required by traditional, static programming techniques. CEP languages are built on event-driven constructs (a “WHEN (event) >> THEN (logic)” metaphor), concisely identify event sequences (A followed by B, then C), and natively understand temporal constraints (with 2 hours).   So CEP concisely models the event-driven world – something static computing metaphors can’t easily do.

So back to our supply chain example, if real-time traffic and routing status and picker actions can be correlated, CEP rules can intelligently optimize picking to load a truck that’s at risk of on time and therefore must leave sooner because of traffic congestion and expected delivery times.  This customer wanted to express a complex correlation from its retail operation in Istanbul.  The logistics challenge was to replenish their outlets by automating a new centralized warehouse that replaced six small warehouses.  The new, massive warehouse they built was far from the center of Istanbul, which was far away from the most profitable shops were on the European side of Istanbul.  Out-of-stock situations at the European side would have a big impact on the profitability of the retailer. To make matters worse, the only way to get from the Asian side to the European side was via two bridges, which frequently had traffic jams.  To add to the complexity, in order to ease traffic burden, the government ordered that trucks were not allowed after 7:00 AM, making it crucial to get trucks over the bridge at the right time.  Previously, the picker’s plans were printed and handed to pickers, and couldn’t be changed. 

Correlating stock, picker schedules, traffic congestion, and truck availability helps automate the picking process with hand-held devices that dynamically displayed the next pick on the floor.  A central CEP application provides the manager visibility into the picking process to see if, for example, a delay was imminent due to traffic jams at the bridge, and gives him the real-time ability to optimize pick lists by picker on-line, re-directing resources. Extensions of this approach allow new CEP scenarios to rebalance operations intelligently and predictively, based on history and real-time inputs such as weather and traffic.

The value event-driven applications like these isn’t the ability to process hundreds of thousands of events a second, it is to express event-driven business logic quickly and easily (read on CEP and empowering business users), and to evolve event rules quickly as conditions change.  Some CEP tools allows business users to participate in this process as well, enabling domain experts that, in this example, understand supply chain. 

So CEP can quickly solve event-driven business problems, and provides value far beyond the ability to crunch numbers.   So one egg, the egg of performance, is often a key ingredient, but is not fully sufficient to create a full meal.  To provide complete business value, a comprehensive approach to event processing is required to rapidly compose, deploy, and evolve event driven logic.