ECA + SQL: a practical event correlation approach

With the recent rapid growth of the Internet and the enterprise computing networks, event correlation has become a must-have functionality in network management systems to help administrators diagnose potential problems quickly and pro-actively. Although many tools exist on the market today that help correlate events, most of them require considerable effort for deployment and extensive training of network/system administrators, not to mention high purchase and maintenance cost. This paper proposes a practical event correlation approach that is quick to implement and easy to use. It uses the event-condition-action (ECA) rule to support event-driven nature of event correlation. Standard SQL can be used to describe correlation conditions, making it easy to implement and requiring little training of network administrators. A prototype implementation of this approach is described, which includes a correlation rule specification language (PECL) and a correlation engine (PECS) implemented with Java. A case-study experience, where PECS was used to correlate events collected from a large operation network, is also discussed to show the practicality and economical benefits of the proposed approach