An architecture to support storage and retrieval of events - CiteSeerX

Apart from any fair dealing for the purposes of research or private study, or critism or review, as permitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced, stored, or transmitted, in any form or by any means, with the prior permission in writing of the publishers, or in the case of reprographic reproduction in accordance with the terms of licences issued by the copyright Licensing Agency. Enquiries concerning reproduction outside those terms should be sent to the publishers. Copyright Springer-Verlag London Limited 1998 Proceedings of MIDDLEWARE 1998, IFIP International Conference on Distributed Systems Platforms and Open Distributed Processing, Lancaster, UK. September 1998

An architecture to support storage and retrieval of events M.D. Spiteri and J. Bates University of Cambridge Computer Laboratory, New Museums Site, Pembroke Street, Cambridge, U. K. Telephone: +44-1223-334600 Fax: +44-1223-334678 Email: {Mark.Spiteri, John.Bates}@cl.cam.ac.uk Abstract This paper describes the architecture we designed and constructed to support the storage and retrieval of events. We define an event as an asynchronous occurrence containing parameterised details of an activity that has occurred within a distributed component. Our past experience has demonstrated how using events as the glue to build distributed active systems simplifies the construction of complex applications, and enables legacy stand-alone components to be rapidly integrated within a larger collaborative environment. Examples of such active systems are interactive multimedia applications, distributed debugging environments, co-operative working applications, agent architectures, and active database. Our motivation for storing events is that events represent indexing points into application sessions. Our event repository architecture can capture and store events, as well as inject them back into distributed application components to simulate replay of sequences of activity, or for re-building lost state. The architecture co-exists and inter-operates with other event-based active systems, as well as with middleware event services like traders and brokers. Using a generic objectoriented model for events, the repository architecture provides powerful search and retrieval facilities, enabling extraction of behaviour patterns, searching for simple and composite occurrences, and replay of stored sequences. We illustrate how the repository can be a viable alternative to past system-specific solutions in areas like capture of collaboration and memory prosthesis, and visualisation of user mobility. Keywords Distributed event programming, capture, storage, retrieval, replay

1

INTRODUCTION

This paper describes the architecture we designed and constructed to allow the storage and retrieval of events. This architecture, sometimes also referred to in this document as an event repository, co-exists with other middleware event services like traders and brokers, and can capture and store events, as well as inject them back into applications to simulate replay of sequences of activity, or for re-building lost state. Section 1.1 describes our motivations for carrying out this novel work. Section 1.2 describes some related work which has addressed aspects of these issues, while Section 1.3 outlines applications we have built as case studies of how the architectural services developed can be used. A brief discussion of our event paradigm and its use in building distributed applications using event-based components is found in Section 2. Section 3 details the architecture we designed to meet our requirements, and which we used successfully in support of the applications illustrated. In particular, Section 3.4 discusses our replay and retrieval interface. Section 4 concludes and presents a summary of our work. The underlying framework to our system is our distributed event-based programming paradigm developed in previous work of the OPERA group (Bacon, 1995 and Bates, 1996/1). This is designed to support the construction of large-scale active systems, that is those in which run-time notification of events can cause further actions to be initiated. Examples of such potentially active systems are interactive multimedia applications, co-operative working applications, agent architectures, active databases and mobility aware applications that can respond to changes in users’ physical locations. Events are asynchronous messages of different types with type-specific parameters, and can represent widely different activities like shared drawing strokes, logging on, launching an application, modification of a document, a application state change, taking books out of the library, a phone call, detecting a new location sighting (i.e. changing office), etc.

1.1 Motivation Previous research (Bacon, 1995 and Bates, 1996/1) has demonstrated that in an environment of ubiquitous computer deployment, constructing distributed applications from reusable active components leads to efficient and dynamically re-configurable systems. Using these results as the basis of this work, we have identified a new requirement to support emerging scenarios; that the events used to glue together these applications can be stored, used for querying and replay, and as a basis for higher-level services. For example, when used in conjunction with multimedia storage servers, captured event instances permit replay and support complex queries on historical records of multi-party computer-supported collaborative sessions. This enables the conference participants or other users to review and browse the conference recording, and replay all or segments of it. Another scenario in which storage of generic events is particularly useful is a memory recollection environment like a memory prosthesis (Lamming, 1994). This requires storage of various active information relating to user activities like document creation, media annotation, application usage, and location information, such as Active Badge sightings (Harter, 1994). Temporal index and querying facilities are then required to be able to locate and review the activities carried out during any time period. Other application areas we have identified as beneficiaries of our architecture are systems monitoring for distributed debugging, logging of phone and workstation usage for automatic diary generation, tracking of phone data for telecommunications fraud detection, and acquisition and analysis of marketing information for Internet

commerce. Within some scenarios it is desirable to be able to use information from all these different sources together, hence creating a better and more fine-grained virtual picture of the human and computer activities monitored. We propose that a generic service architecture that can store and retrieve ‘event instances’ is a novel and desirable approach to handling these and other situations with similar requirements. Our event store is general purpose and can be used for a wide range of applications previously only catered for by bespoke solutions.

1.2 Related work Storage of event instances or ‘messages’, ‘notifications’, ‘actions’ or ‘traces’ has been carried out in a number of application domains, but it has not been the focus of the research, and has been side-lined as secondary to issues like system optimisation and efficiency. Consequently no generic multiple-purpose event detection and storage architecture has been proposed. Of relevance to this investigation are projects undertaken in specific environments where some of the issues have been investigated, primarily: • Ford (1991) and other authors (Lee, 1991) have examined event detection and capture for storage purposes in the context of fault-tolerant computing and distributed debugging. Logs are maintained of event ‘traces’, where these traces represent low-level system activities like processor communication. This work has largely assumed integration with a debugging environment and is tailored for specific classes of events. Mansouri-Samani (1995) has attempted extending query support to be more generic. • Usability studies, as in Badre (1993). Such systems tend to focus on capturing local user interface events and do not consider distributed environments. • Temporal databases and their query languages. These tend to be more concerned with how the data changes over time. The focus of this research has been mainly on the semantics and optimisation of temporal query algebras. The theory behind these languages and algebras is quite advanced, but only a few experimental implementations have been carried out (Goralwalla, 1995). While some aspects of this research are relevant to the proposed investigation, such as expressing of temporal intervals for querying, the emphasis on database states and their variance in time is not as relevant. • Memory assisting tools like the memory prosthesis (Lamming, 1994). Video records of a user’s activities are maintained and accessed by indexing through a listing of activities the user undertook (like typing, using the phone, opening documents, changing office). The Coral suite of tools (Minneman, 1995) support real-time capture and subsequent access to informal collaborative activities. While inspiring our work, we differ in having taken the approach of using more generic support in the form of our event store. Tools like these can be built more easily by employing our architecture, and would benefit from our powerful retrieval mechanism. In summary, other projects have investigated aspects of this proposed research in differing and specific contexts. Our research distinguishes itself by focusing on providing a generic platform for event modelling, storing and retrieval. This avoids bespoke services, allowing any event classes in an open environment to be stored.

1.3 Case-study applications In this section we describe two applications employing the event repository’s functionality; monitoring and review of user activities, and tracking of user movements to be able to replay them in a virtual reality environment.

1.3.1 Distributed activity monitoring We have used the event store to capture, and then be able to browse and replay online collaboration and user activity. Using the event paradigm we have authored a collaborative platform which includes video/audio conferencing, text channels and shared drawing. Simultaneously, we monitor workstation activities like logging-on and file operations, web browsing, as well as tracking of the physical location of users through Active Badges, monitoring usage of phones, printers and borrowing of library books. These activities generate events, which are propagated through the network to various components. Our applications are built by gluing together existing components and specifying what actions to take in response to event notification. This is also the mechanism for tailoring existing applications. Our applications can dynamically use any activity as a trigger to perform some actions, for example, if two users are seen together in the same real-world location, then play them a video message on the nearest workstation briefing them on the progress of a project. Events from these external sources, together with events relating to synchronisation of the collaborative environment components, are automatically indexed by the event repository, thus allowing later replay and/or querying of a session. We have used this to generate high level minutes of meetings and for automatic generation of diaries. Media streams associated with a collaborative session are also stored (of at least the person who is speaking). These stored sessions can be replayed at normal, slower or faster speeds, and the replaying positions can be specified in temporal terms relative to the beginning of the session or with respect to any other event or sequence of events within the session. On the assumption that the human mind often forgets specific details but remembers relationships to other activities which occurred before or after, we can perform queries corresponding to expressions like ‘show me the URL of the slide that John showed after Giles joined the meeting’, and ‘show me the name of the book I took out of the library last month, just before I met Pawel in the corridor’. Our collaborative working environment takes into account users’ physical location by detecting their Active Badge. If a user moves to a new location, the application is notified, and his/her portion of the application follows them to the nearest, or a selected computer (Bates, 1996/2). This enables users to keep in touch with one another whilst on the move. When the user’s components complete a move to a new workstation, the components can once again communicate with the other users’ conference components and network services. At this point, to build their state to a level consistent with that of other users, the components require all the events missed from the period of disconnection. The situation is complicated by the fact that while one user was disconnected, other users may also have been disconnected and thus no user has a consistent view of the application. A solution to this problem is for each user to store events from the session so that each has a consistent view of at least the events generated locally. After reconnection, users can request that each user send them only the events generated by each user locally. We used this problem as another application of our event store.

A similar problem can result if the network fails temporarily, resulting in the

Figure 1. Use of event repository in support of disconnected operation conference being partitioned into two or more segments. An enhancement, to show a user what happened whilst he/she was disconnected, is to create exact copies of all local objects and to use the replayed events to update the copies. The user can then decide whether or not to add these updates to his/her session. If the disconnection was due to network partitioning and not mobility, then this approach applies to all users since disconnected working in one or more partitions may have occurred. In this case, all users can discuss what happened within the conference partitions, and decide which of the event sequences they wish to be added to the session. Figure 1 illustrates this process.

1.3.2 Virtual reality (VR) - distributed virtual world system In our multi-user virtual world, a user steers a course through a 3D graphical environment, interacting with objects populating the world. Making each user’s VR world event-based means that multiple users’ instances of the same world can be interfaced, without the need for explicit interoperation. If a user moves location in the virtual world, events are notified, specifying the new location. This is analogous to tracking a mobile user in the real world. Events are also notified if a user interacts with an object in the virtual world, e.g. a virtual whiteboard. This is analogous to interacting with the user interface of a traditional application.

To test this out we used VRML97 (ISO/IEC, 1997) to build a representation of our Computer Laboratory’s main building. Dynamically generated avatars representing various members of the department, as well as objects to interact with, are also implemented. In response to injected actions, avatars and objects can be added to the world dynamically; the VRML97 to realise an object is spliced into a world instance at run-time by a controlling Java management applet. The Java component is also responsible for forwarding events from each user’s world to interested clients. Using our event storage and retrieval architecture we have also used these components, unmodified, to replay past activity like users’ movements. We have employed this to monitor emergency evacuations of a building, since one can move around the VR model and observe how people negotiated the exits and where potentially dangerous bottlenecks occurred. See Figure 2.

Figure 2. Reflecting the real-world, the authors and a colleague are portrayed in real-time in a virtual representation of office T11 by the VR mobility ‘visualiser’.

2

PRINCIPLES OF EVENT-BASED SYSTEMS

This section introduces distributed systems development using asynchronous events as background to storage and retrieval. By using events as a uniform activity metric, systems/applications can be built around a generic event-response paradigm. Single or ordered combinations of events can be used to trigger further actions within the system/application. Using events as the uniform interchange of activity between the possibly distributed components simplifies the construction of a complex system/application. We developed our event system initially using a locally developed distributed object system, and later re-designed it as a layer above CORBA, using the latter as a distributed programming platform but remaining conceptually separate from it. Our event paradigm goes beyond other event systems like the CORBA Event Service (OMG, 1997) in that it provides support for higher level services like trading, brokerage, composition of new events through specification of event sequences and provision for secure interworking services. Multiple interested clients on the same channels are also allowed.

2.1 Components and glue Event-based programming relies on two main concepts: • Existing event-based components are used as the building blocks of applications. These may be distributed around the local network or Internet. They can inform interested users of pertinent events, such as a change in the location of a mobile user. The power of event-based system building is that no component has to be designed to work specifically with any other component. • To compose many event-based components into an active system, a federator component must be written. This is the bespoke part of the system, composed of event-based rules that describe actions to take in response to the receipt of certain events from the components within the system. Rules act as distributed systems integration glue, using any class of event from any components to drive any other components by injecting any actions. In a multi-user application, for example a multimedia conference, each user owns a set of components, but the overall system is composed of the interacting set of all users’ components. In such a situation, it is likely that each user will have a separate federator component to take care of his/her own components.

2.2 Event classification and brokerage One event source can generate events of one or more event classes. An event class has typed attributes, instances of which uniquely identify a captured activity. For example, an event source that provides information about the locations of users can offer monitoring facilities for the following class of event: LocationEvent(Domain, Name, Type, Location) which identifies that an entity has changed location in a specific domain. Distributed event-based objects advertise the event classes they can monitor for by exporting them to an event broker. Clients can query the event broker, to search for appropriate event sources. Inheritance can be used to create sub-classes of events. For example, a new event class FineGrainedLocation can provide a 3D fix on a user, rather than just a named location. This can be built on top of a GPS system or a finegrained office-based system (Ward, 1997), thus providing latitude, longitude and altitude information. In our design, the event broker is the custodian of the class hierarchy for its local event domain. Querying the event broker for a particular class of event returns all event sources that can monitor for the class and all its sub-classes.

2.3 Registration for filtering To reduce network traffic and avoid clients of event sources having to perform filtering to decide whether a particular event is of interest, our event system allows interested parties to register interest in events with certain characteristics. Only events that match the registered patterns are dispatched to the interested parties, thus reducing network traffic and filtering requirements. To register interest with an event source, clients provide an event template. This is an event instance, with fields for exact match filled in and those for wildcard match expressed as variables. Examples for class LocationEvent are as follows: • LocationEvent(‘cl.cam.ac.uk’, ‘John.Bates’, ‘Person’, L) - Report wherever John is seen in the Computer Lab.

•

LocationEvent(‘cl.cam.ac.uk’, P, ‘Person’, ‘Meeting Room’)

- Report

when anyone is seen in the Computer Lab meeting room. When event instances are notified to clients, values for all class attributes are given, e.g. the instance LocationEvent(‘cl.cam.ac.uk’, ‘John.Bates’, ‘Person’, ‘Meeting Room’) means John has been seen in the meeting room.

2.4 Federation using rules Event-based components also have an interface for action injection. This allows a client of a component to invoke methods that inject actions into the component. The action injection interface methods for a component are often the same as the classes of event that the object can notify. Federating the operation of event-based components involves authoring a glue component, known as a federator. This component contains event-based rules. Each rule specifies one or a combination of events that, if detected, trigger a set of actions on components. As an illustration, consider how several drawing boards can be used to create a shared drawing application. Each board owner can author a federator; the federator registers interest in drawing events with all of the involved drawing boards (each of which may differ from the rest in implementation). When the federator is notified that a line has been drawn, it can inject an action into the local board to draw a corresponding line. The other users’ federators register with the non-local boards; each board notifies events whenever it is drawn on. This approach is more flexible than hardcoding a shared-drawing application; the stand-alone drawing boards can be used in many more contexts than if it was part of a hard-coded system.

3

STORAGE AND RETRIEVAL OF EVENTS

As illustrated in Section 1.1, there are various motivating reasons to provide real-time storage of events coupled with powerful and useful paradigms for retrieval and replay. Events in different environments differ considerably in parameters, frequency and security requirements, and we have striven to provide a generic platform to support different event classes, while at the same time providing the functionality differing scenarios are likely to require.

Classification of stored events As briefly mentioned in Section 2.2, events are represented as instances of event classes inheriting from the base class ‘event’. This base class encapsulates the basic properties of an event as an instance of an action, or phase of an activity, occurring at a point in time, having a unique timestamp, scope, originating source, version (if applicable) and ownership tag if desired. Since events can be categorised through inheritance relationships, it becomes possible to execute generic query operations on abstract classes, which then automatically include the sibling class instances. The class hierarchy can be appended-to dynamically, and it is possible to have multiple class hierarchies defined simultaneously by tagging their member classes with different interface versions.

Storing events in sessions A session provides a context to associate related event instances, this being particularly

useful for limiting the scope of retrieval and replay. A session is set up by an application; the application sends events that it wants to be stored in the session to the event store. An example is a person’s diary containing all events pertinent to his activities, or a chronicle of every individual’s movements while exiting the building in an emergency drill. Any class of event can be stored in a session. An event instance can appear in multiple sessions.

3.1 Repository architecture We designed and built our own database sub-system tailored for capture of high volumes of multiple streams of relatively small data objects (events) which need not be modified as they are to constitute a historical record. Every instance of the event repository consists of various components working concurrently and co-operatively, primarily a number of repository clients, and a repository server. While we have striven to keep the server component of the architecture as generic as possible to be of use in different scenarios with diverging requirements, the repository clients can be tailored to be highly specific to the application. Our aim in designing this architecture was to provide a core set of generic services coupled with highly and easily tailored components, so that the whole can provide the required facilities without compromising on speed and efficiency. The architecture of the event repository is illustrated in Figure 3. A specialised repository client registers interest with one or more event sources for the particular event type to be stored. Security is managed by passing a certificate on registration, which is presented to the client on notification. It interfaces with the event sources and passes the events notified to the repository server, which timestamps the events and stores them. The client also acts as a command parser for instructions sent to the repository by a user, a user application or intelligent agent. While these commands are mostly to do with subsequent retrieval of the information stored, some operations are related to storage, like definitions of new event types, and creation and definition of sessions. The client also functions as the base for building value added services during output operations. Event Notification

Event Source

Event Client

Event Notification Register interest

Event Service

Repository Client

Event Translation Service

Event Translation Service Repository Server

Register interest Repository Client

Servicing Threads

Thread Management sub-system Query Interpreter Input Channel

Output Channel

Time-stamping Service

Event Replay System

Locking System Event Class Stores

Session Indexes

Figure 3. Event store architecture

Disk Store

The repository server receives the command queries and event streams through the repository clients, and can handle multiple input and output streams concurrently. Depending on the distributed application in support of which the repository is being used, there may be one centralised instance of the repository server capturing the activity information, or there may be multiple distributed instances; for example, one per domain or even one per user, as discussed in Section 3.2. While any previous timestamp the event instances would have been tagged with, from the source or some intermediate broker, is retained, the repository considers the time of storage as the main timestamp. Consequently it structures and orders data according to this. While there are considerations for and against this, we decided to make this distinction because in this case the repository is acting as a distinct view of the application, in much the same way as the user it is associated with in a collaborative session has a specific view of the collaboration. In loosely coupled distributed environments where large distances and consequently large latencies are involved, the user cannot receive messages like, for example, video or shared drawing board actions, in ‘correct’ order. While technically this view does not depict the way actions really happened, nevertheless it does reflect the way the user saw the interaction, and if the storage tool is to be of assistance in review and recollection of ideas, then it is important also to retain the ‘incorrect’ viewpoint, which then becomes correct from the user’s perspective. This scenario also implies separate instances of the event store for every user. If desired, it is still possible to override the default ordering by storage timestamp, and order the event instances according to the source timestamp, through buffering in the repository client. If an existing event type is suddenly to be indexed according to a new timestamp, then the repository tags this event type as a newer different version of the previous one, so as not to mix up the historical records and cause conflict upon retrieval. To optimise storage and retrieval, events of different types are stored in different files, on the same or on different file systems. This reduces the processing and streamlines the procedure for storage while making use of the resources available in the current computing domain by capitalising on the available disk parallelism. It is possible for multiple clients to start supplying events of the same types, in which case the separate handling threads co-operate so as to timestamp and store the instances correctly. Events are added to a particular class file by appending. This being historical data, it cannot be modified and is strictly ordered.

3.2 Repository Configurations Depending on the service one wishes to provide to higher-level applications, an event repository can be used in different configurations: • as a system wide resource, monitoring all event instances from one or more sources. An example is a centralised repository instance that captures all movement sightings from all Active Badges in a domain. Application components can then interface with it to request a replay or analysis of these movements. The event repository then injects these active components with the movement events as if they were happening in real time. In this configuration the repository is instantiated with system rights and allows users to request replay from it according to individual access lists on the event classes. One example case study using this configuration is visualisation of mobility in virtual reality for review of emergency procedures. In this scenario the event repository injects events into the mobility visualising component.

•

•

as a user-centred service. A user can instantiate an event repository service and configure it to monitor all event types of interest to him. The repository is given the same security rights as the user has, and thus it can request to be notified of all events the user (or any of his applications) is entitled to receive. It is up to the user (or his agents) to configure the repository to organise events into sessions of relevance useful for subsequent retrieval. Such a configuration can be used to monitor all activities the user or his agents engage in, an example being for automated diary generation. The repository could monitor all workstation activities in the background, receive notifications from system-wide services like the user’s movement sightings and use of library facilities, and monitor his engagement in online collaborative activity. as an application-specific service. An active application can instantiate an event repository and use it for its own requirements. A debugging application can thus use the repository to monitor system execution, allow analysis and review of the resulting trace and then destroy it once it terminates execution. In collaborative scenarios, it might be desired not to keep a permanent record of the interaction, but nevertheless use the event repository to support disconnected operation. One way of achieving this is to have the conference management objects instantiate their own event repositories, use them to provide replay for participants after network partitioning, but then destroy them and all their records once the collaboration terminates.

3.4 Event query and replay We provide a language to manipulate stored event classes and instances, as well as event sessions. Queries can be composed through a query interface provided by the repository client, either interactively, in advance, or dynamically by application components. Initially we used a subset of OQL (Cattell, 1996) as interface to the stored data, with additional keywords to support replay. However we found using OQL to express contextual-temporal relationships, as well as enable notions of temporal intervals in which one or more sequences of events might have occurred, as unwieldy. We thus added a number of new constructs, to facilitate expressing of temporal queries as well as make better use of the specialised storage for events. Note that we define an event as an atomic activity metric denoting an occurrence happening at a fixed singlevalued point in time. We then define an interval as being bounded at both ends by a specified time value or an event. A composite event, on the other-hand, can consist of a sequence of atomic events or other composite events, but is also tagged with a fixed point in time, this being the end of the sequence, or when the ‘composite event finally occurred’. The event repository supports various retrieval operations. An application can request: • Replay of events within a time interval. Straightforward replay of events of a specific type can be requested from the beginning of the ‘recording’ to the current time ‘now’, or for any interval in between. Once the interval to be replayed is evaluated, the repository server starts sending out the stored events as they occurred, with the same temporal separation. The client then translates them if and as required by the application, injecting events into its components as if they were occurring in real time. If the replay is from a session, different event types may be involved. Replay can also occur at multiples or fractions of the original recording speed. E.g. ‘Replay at twice the original speed from the video conference records from when John displayed an image of a motorcycle but before Mark relayed the

• • •

promotional video’. Replay of events within a time interval matching specific characteristics. A filter can be applied to replay operations as the above, but ‘replay only events with a parameter called ‘Name’ containing ‘Mark’’. Retrieval of events as per the above categories but returned right away. It can be useful to receive a log of the events that occurred within a certain period, maybe for visualisation or data mining purposes where a replay is not explicitly required. Retrieve information relating to the number and nature of specified patterns of occurrences or composite events. It is possible to define a composite event and then request information as to how many times and when did it occur. E.g. ‘Retrieve all instances of the sequence when Alarm A was followed by Alarm B and Alarm C did not go off in the meantime.’

All operators take a ‘set of possibilities’ and return a set of possible results based on using the cross-product of the operand sets or some other specific consumption model as specified through the query syntax. Base or abstract classes can be specified during queries, in which case the query will encompass all event classes that inherit from that class. The limited space available in this paper does not allow for a complete treatment of the event query syntax but we will provide the basic syntactic operators below and then give some examples. Our replay/retrieval syntax provides for a number of classes of operators, the main ones being:

Content comparison and equivalence

•

=, , !=,

These operators can be used to compare events of the same class, or compare specific event fields against specified values. • •

(a. x and a. y) returns a set of events (of type a) whose respective values x and y as specified.

and



both compare to the

(a. x or b. y) returns a set of events (or mixed type a and b)

whose either or (as applicable) compare to the respective parameters as specified. a and b do not have to denote the same event class, nor to have the same set of attribute fields.

Temporal context •

• •

((|) before (|) [without ] [within ]) (a before b) returns the set of all a which are followed at some point by a b, where a and b can be either events or intervals. (a before b within ) returns the set of all a that are followed by a b within the specified time period denoted by . (a before b without c) returns the set of all a that are followed by a b and no c occurred in between. ((|) after (|) [without ] [within ])

like the previous construct but in this case the a that were preceded at some point by a b are considered. ( equal ) (a equal b) returns the set

of all a that occurred at the same time as a b.

Interval operators An interval is defined as having a start time and an end time, and can encapsulate any number of events occurring within those inclusive boundaries. When an interval is

defined within a query, a new object instance of the interval class type is constructed, and this provides the following methods that can be employed within the query itself. Some maintenance functions are provided like; start(), which returns the time value denoting the start of the interval, end(), the end boundary, events(), the number of events within it, and eventAt(x), the event at position x. An interval is specified as follows: • (: ( | ) (((until | to) ( | )) | for ) :) (: and :) denote that an interval is being specified. until and to differentiate between excluding or including the second time value itself. These operators default to a ‘start-point’ consumption model. A start time is matched with the closest end point and then not used again in any further matches. If for is used the second parameter must be a relative amount of time, which is then added to the starting boundary to compute the ending boundary of the interval. There are a number of relationships between intervals, all of which can be specified in terms of the start() and end() operators of the interval object class. before and after have already been discussed in the context of event operators. The other operators we have provided reflect the ways in which an ordered pair of intervals can be related. These are equal, meets, overlaps, during, starts, finishes, contains and their inverses. intersect and join are interval operators that create new intervals on which queries can be applied.

Composite/sequence pattern operators A composite event is denoted as an event defined in term of a sequence of other basic or composite events. It exists only within the context of the current query and is defined by specifying a path template, also equivalent in meaning to a sequence or pattern. Operations on paths are carried out by enclosing the template in [: :], as in [: A followedby (B or C) without E :]

A composite ‘path’ does not return single event instances, but rather constructs a set of new composite event objects (if successful) which each contain pointers to all the basic events they were made up from within the session timeline. Functions are provided which can extract relevant information from the resulting construct.

Syntax Examples We will illustrate the use of the syntax through the following simple examples; • ‘Replay from the group’s diary from when Mark entered room T12 and John was there.’ One way of expressing this is to find the period when John was in T12 and then see if Mark was seen within that period in the same room. If this is successful, then replay from that instance onwards.

•

replay fromsession OperaDiary fromwhere (badge.Name=‘Mark.Spiteri’ and badge.location=‘T12’) during (: (badge.Name=‘John.Bates’ and badge.Location=‘T12’) until (badge.Name=‘John.Bates’ and badge.Location!=‘T12’) :)

‘Retrieve when Jean walked from the tea-room to her office (T15) and started editing a document sometime last week.’ Instead of replaying this will return all event sequences which match the specification provided. A simple way of specifying this is: retrieve fromsession JeanDiary eventsOf( [:(badge.Name=‘Jean.Bacon’ and badge.Location=‘Tea-Room’) followedby (badge.Name=‘Jean.Bacon’ and badge.Location=‘T15’) followedby (workstation.documentedit.user=‘Jean.Bacon’):] during (: 10/02/1998 to 17/02/1998 :) )

To summarise, it is possible to find events relative to other events that have occurred

before or after them, as well as with respect to specified bounded intervals. Intervals can be operated on to determine overlapping periods, and if desired, output can be filtered so that only specific event types, or events with specific parameters, are returned.

4

SUMMARY

In previous publications we demonstrated that in an environment of ubiquitous computer deployment, constructing distributed applications from reusable active objects (i.e. capable of responding to externally generated events they have registered interest in) leads to efficient and dynamically re-configurable systems. Using these results as the basis of this work, we then identified a new requirement to emerging scenarios; that the events used to glue together these applications can be stored, used for querying and replay, and as a basis for higher-level services. In this paper we have illustrated our design for an architecture providing storage and retrieval of generic events representing human and computer-based activities. We have achieved this by modelling activities uniformly as events and providing a model for representing event classes and instances, an architecture for distributed event detection, a specialised database storage sub-system, and a model for querying and retrieving event-based information. Although we are still working on various aspects of the event storage architecture, early results with our prototype applications indicate we have mostly been successful in addressing our motivating factors. In particular we provide a solid alternative to various bespoke solutions, as well as offering functionality that those alternatives did not provide. One test application we have built and discussed is storing conference sessions in conjunction with real-world monitoring, for review or as a memory aid. The replay facilities support recreating all of, or sections of, a conference as it happened using events as temporal indices to other media. We have used replay from our event store as a useful tool for re-building application state following disconnection or mobility, as well as allowing instant review of missed interaction. In our second illustrated case study we have captured mobility events and then injected them into a 3D virtual representation of the building the events were taken from. Amongst other things, this has enabled us to visualise and review emergency evacuation procedures. Both casestudies emphasise the feasibility of the event store as a valid resource in distributed environments; in particular with regards to quick and painless interfacing with applications, efficient event capture and storage, and provision of powerful retrieve and replay facilities.

5

REFERENCES

Bacon J., Bates J., Hayton R., and Moody K. (1995) Using Events to build distributed nd applications, in 2 International Workshop on Services for Distributed and Networked Environments, IEEE. Badre A. N., Hudson S. E., and Santos P. J. (1993) An Environment to Support User Interface Evaluation Using Synchronized Video and Event Trace Recording, Technical Report, Graphics, Visualization and Usability Center, Georgia Institute of Technology, USA. Bates J. (1996/1) A Framework to support Large-scale Active Applications, in SIGOPS European Workshop, ACM. Bates J., Halls D., and Bacon J. (1996/2) A Framework to support mobile users of multimedia applications, ACM Mobile Networks and Nomadic Applications, 1.

Cattell R. G. G., Barry D. K. (1996) The Object Database Standard: ODMG 2.0, San Francisco, CA: Morgan Kaufmann Publishers. Ford R. (1991) Non-Intrusive Real Time Event Capture, in Proceedings of the ACM/ONR Workshop on Parallel and Distributed Debugging, pages 225–227, Santa Cruz, CA, USA. Goralwalla I. A., Tansel A. U., and Tamer Ozsu M. (1995) Experimenting with Temporal Relational Databases, Technical Report, Department of Computer Science, University of Alberta. Harter A. and Hopper A. (1994) A distributed location system for the active office, IEEE Networking, 8(1). ISO/IEC, The VRML Consortium Incorporated (1997). VRML97 - The Virtual Reality Modelling Language Specification, International Standard ISO/IEC 14772-1:1997 Lamming M., Brown P., Carter K., Eldridge M., Flynn M., Louie G., Robinson P., and Sellen A. (1994) The Design of a Human Memory Prosthesis, The Computer Journal, pages 153–163. Lee I., Iyer R.K., and Tang D. (1991) Error/failure analysis using event logs from fault tolerant systems, in 21st Int. Symp. on Fault-Tolerant Computing (FTCS-21), pages 10–17, IEEE Computer Society Press, Montreal, Que., Canada. Mansouri-Samani M. and Sloman M. (1995) GEM: A Generalised Event Monitoring Language for Distributed Systems, Technical Report, Imperial College Department of Computing, United Kingdom. Minneman S., Harrison S., Janssen B., Kurtenback G., Moran T., Smith B., and van Melle B. (1995) A Confederation of Tools for Capturing and Accessing Collaborative Activity, in Proceedings of the 3rd ACM International Conference on Multimedia, pages 523–534, San Francisco, CA USA. Object Management Group (OMG) (1997) Event Service Specification, ftp://www.omg.org Ward A., Jones A., and Hopper A. (1997) A New Location Technique for the Active office, IEEE Personal Communications, 4.

6

BIOGRAPHIES

Mark D. Spiteri graduated in Computing and Physics from the University of Malta in 1994, and later that year joined the Department of Computer Science and A.I. as a research assistant. As a Commonwealth Scholar, he moved to the University of Cambridge in 1995 where he is currently a PhD candidate. He is carrying out research in distributed multimedia environments, collaborative systems, and paradigms for storage and retrieval of active information. John Bates holds the Heller Senior Research Fellowship in Object-Oriented Computing, at St. Catherine’s College Cambridge. John’s research is based at the University of Cambridge Computer Laboratory. The main thrust of his work is in applying object and event technologies, to support end-user requirements of distributed computer systems. Areas of application to date include multimedia, computersupported collaborative work, and support for mobility.