Abstract: Methods, systems, and computer-readable media to generate a user interface (UI) to analyze a complex event processing (CEP) query are disclosed. A particular method includes receiving data representing an event flow associated with execution of a CEP query. The CEP query includes a plurality of operators. A UI including a graph is generated. The graph includes a plurality of nodes. Each node of the graph corresponds to an operator of the CEP query, and each edge of the graph corresponds to a stream between operators of the CEP query. The method includes receiving an input identifying a particular node of the graph, where the particular node corresponds to a particular operator of the CEP query. In response to the input, an operator-specific output associated with at least one event processed by the particular operator is displayed.

Abstract: Methods, systems, and computer-readable media to analyze a CEP query are disclosed. A particular analysis module is configured to receive data associated with an event flow generated by execution of a CEP query. The data is received from a first analysis module (e.g., in a stack of analysis modules) or from the event flow via a software communication interface. The analysis module is also configured to execute an analysis operation on the data to generate a result. The analysis module can output the result to a second analysis module (e.g., in the stack of analysis modules) or to a user interface via the software communication interface.

Abstract: Root cause analysis for complex event processing is described. In embodiments, root cause analysis at a complex event processor is automatically performed by selecting an output event from an operator and correlating the output event to an input event using event type and lifetime data for the input event and the output event stored in a data store. Embodiments describe how the lifetime data can comprise a start time and an end time for the event, and the correlation can be based on a comparison of the start and end times between the input and output events. Embodiments describe how the correlation algorithm used is selected in dependence on the event type. In embodiments, a complex event processing engine comprises a logging unit arranged to store in the data store an indicator of an event type and lifetime data for each output event from an operator.

Abstract: A dynamic infrastructure for monitoring service level agreements (SLAs) is described. In an embodiment, the infrastructure comprises three types of functional elements: probes, metrics and audits and a small number of primitive actions for manipulating these elements. The elements are connected by streams which store data for processing and transport data between functional elements. The primitive actions, which are duplicating and removing functional elements as well as splitting and joining metrics, are arranged such that the functional elements can be optimized dynamically in responses to changes in the service and/or the hardware without losing any data.

Abstract: Monitoring of service provider performance is improved by providing detailed instructions for evaluating metrics relating to categories in which the service provider's performance is to be measured. Such instructions describe the metrics in sufficient detail such that they can be evaluated by a monitoring component without having to obtain monitoring data from the service provider, thereby decreasing the level of trust that must be placed in the service provider to monitor itself. The ability to evaluate metrics independent of service provider monitoring data further reduces the size of code which must be generated for the service provider and the number of tasks which must be performed by the service provider, thereby decreasing operating expenses and freeing up resources for other aspects of the service provider's operations.

Abstract: A dynamic infrastructure for monitoring service level agreements (SLAs) is described. In an embodiment, the infrastructure comprises three types of functional elements: probes, metrics and audits and a small number of primitive actions for manipulating these elements. The elements are connected by streams which store data for processing and transport data between functional elements. The primitive actions, which are duplicating and removing functional elements as well as splitting and joining metrics, are arranged such that the functional elements can be optimized dynamically in responses to changes in the service and/or the hardware without losing any data.

Abstract: Monitoring of service provider performance is improved by providing detailed instructions for evaluating metrics relating to categories in which the service provider's performance is to be measured. Such instructions describe the metrics in sufficient detail such that they can be evaluated by a monitoring component without having to obtain monitoring data from the service provider, thereby decreasing the level of trust that must be placed in the service provider to monitor itself. The ability to evaluate metrics independent of service provider monitoring data further reduces the size of code which must be generated for the service provider and the number of tasks which must be performed by the service provider, thereby decreasing operating expenses and freeing up resources for other aspects of the service provider's operations.