ECS 3 Developer Tutorial

Abstract Syntax Notation 1 (ASN.1): An OSI standard related to the Presentation Layer where the abstract representation of the data is independent of its physical encoding. It is specified in ISO/IEC 8824, X.208.
agent: A device or process running on a remote device or computer system that responds to requests and sends event notifications. An agent provides access to managed objects and MIB variables.
annotate server: A process that receives a request event from an Annotate node within an ECS circuit, performs some action, and returns a response event to the Annotate node. The action performed by the annotate manager may involve information extracted from events in the circuit, and the information returned may be obtained from the environment external to the ECS Engine.
API: Application Programming Interface
arrival time: The time an event arrives at the ECS engine (in UTC).
ASCII: American Standard Code for Information Interchange
attribute: An object property that describes the current state of the object, and which has a unique identifier by which it is accessed. For example, the "eventTime" attribute of a CMIP event, or the "Rate" attribute of a Rate node.
attribute-value pair: See key-value pair.
Basic Encoding Rules (BER): Defines how ASN.1 data types are encoded for transport on the network.
BER: See Basic Encoding Rules.
breakpoint: The location in the circuit where normal execution is interrupted to allow for manual intervention.
canvas: The working area of the ECS Designer screen. This is where you place, connect, and configure nodes to create your correlation circuit.
CCITT: See International Telecommunications Union, Telecommunications (ITU-T).
circuit: See correlation circuit.
CMOT: CMIS over TCP/IP. Network management protocol and services running on top of TCP/IP with specifications similar to CMIP.
CMIP: See Common Management Information Protocol (CMIP).
CMIP notification: See event.
CMIS: See Common Management Information Services (CMIS).
Common Management Information Protocol (CMIP): A protocol for exchanging network management information in an OSI environment (ISO/ITU-T X.710).
Common Management Information Services (CMIS): The OSI network management service.
component event: An ECS event that is contained in a composite event.; See also composite event; primitive event; temporary event.
composite event: An event that exists within an ECS circuit only. The body of a composite event consists of one or more other component events. Component events may be primitive, temporary or composite.; See also event; primitive event; temporary event.
Compound node: In ECDL, a circuit fragment encapsulated as a node. Compare with primitive node.
condition parameter: In ECDL, an expression, usually involving attributes from an event, that returns a value used to modify the behavior of a node.
Containment Tree: Instances of managed objects exist within a containment hierarchy referred to as a containment tree. The containment tree describes how each object instance is related to other object instances.
correlation: The process of enriching a stream of events by filtering and detecting patterns and replacing groups of events with a single event that has (possibly) higher information content.
correlation circuit: A collection of primitive nodes and Compound nodes, configured to perform a filtering or correlation activity. The configuration includes the definition of event types and transit delay to be accepted from the external event stream. A circuit can be loaded into an ECS Engine.
correlation engine: ECS subsystem that implements the EventFlow technology.
creation time: The time an event was created (in UTC).
Data Store: A component of the ECS Engine that stores circuit parameters and external data such as durations, thresholds and other constants.
data type: Data types in ECDL define the range of values to which a name may be assigned. Every value in the language has a type, but the type need not be explicitly stated. There are many different types ranging from simple types such as integers to compound data types such as dictionaries and special types such as functions.
DCT: Distributed Containment Tree. See Containment Tree.
dictionary [data type]: A dictionary is an ECDL data type comprised of an unordered list of key-value pairs.
Discard Policy: A Discard stream policy causes events that are not explicitly output by at least one correlation circuit to be discarded. Contrast with Output Policy. See also Stream.
Distributed Management (DM): HP OpenView platform services for the management of distributed resources.
double-click: To click a button twice in rapid succession. Unless qualified, double-click refers to the left mouse button. If the second click is too long after the first then it is not a double-click.
DM: See Distributed Management (DM).
duration [data type]: A data type within ECS for representing relative or elapsed time values, and performing operations on those values, such as comparison and addition. Compare with time.
dynamically evaluated parameters: A node parameter where the expression is evluated each time an event enters the associated node/port. This means that the value returns by the parameter may change for each event processed.
ECDL: See Event Correlation Description Language.
ECS: See Event Correlation Services.
ECS circuit: See correlation circuit.
ECS Designer: The ECS Designer is where you design, create and test correlation circuits. The ECS designer works in two modes; Build mode where you design and create (build) circuits, and Simulate mode where you test (simulate) circuits.
ECS Engine: The ECS Engine is where the correlation and filtering is peformed. The ECS Engine takes an event stream and performs specific correlation actions on the stream (within the correlation engine). The ECS Engine then outputs a resulting correlated event stream.
ecsmgr: The HP OpenView Event Correlation Services engine manager. This manager can be used to alter the correlation engine's configuration when it is running.
EML: Element Management Layer (TMN).
environment variable: One of a set of defined shell variables (e.g. PATH, TERM, HOME) that define the conditions under which commands run.
evaluation: ECS circuits contain expressions that are either statically evaluated or dynamically evaluated. Statically evaluated expressions are reduced to a single value when the circuit is loaded. Dynamically evaluated expressions are reduced to a single value when that value is required.
event: An event is data such as an SNMP trap, CMIP notification, or TL1 event, generated by an agent process in a managed network, usually to indicate or cause a change in the state of a managed object. In ECS an event is encoded as a primitive, compound or temporary event. The ECS event data structure contains overhead data to assist the processing of events while they are in the ECS circuit that is stripped before the events are transmitted from the ECS circuit.; See also component event; composite event; primitive event; temporary event.
event attribute: Event properties that are either part of the internally created event header common to all event types, or part of the event body that is specific to the particular type of event.
Event Correlation Description Language (ECDL): The language used to specify correlation circuits (node relationships, predicate expressions, data and fact store values) for the ECS engine.
Event Correlation Services (ECS): The HP OpenView Event Correlation Services product, based on EventFlow.
event encoding type: The first and highest level in the three-tiered ECS event classification system. An event's encoding type determines the encode/decode module that will be used to translate the event to and from its native format. For example, CMIP notifications and SNMP trans both use the BER encoding type, ASCII events use the MDL encoding type, and OpC messages use the ITO encoding type. See also event syntax; event type.
event flow: An ECS circuit represented graphically as a circuit schematic consisting of nodes connected by lines. See also correlation circuit; node.
Event Forwarding Discriminator (EFD): This is defined in ISO 10164-5 (ITU-T X.734) and ISO 10165-2 (ITU-T X.721). It is concerned with the registration of interest in events that match a given filter, and causes the forwarding of such events when they occur.
event syntax: The second level in the three-tiered ECS event classification system. An event's syntax determines how the event's attributes are read and written. For example, SNMP traps have an event syntax of Trap-PDU and CMIP notifications have an event syntax that evaluates to an OID identifying the GDMO notification. ASCII events have a syntax determined by the MDL definition used to read and write them. See also event encoding type; event type.
event type: The third and lowest level in the three-tiered ECS event classification system. The event type is represented by the ECS header attribute "event_type". For SNMP traps the event type is the generic trap number (1-6). The CMIP event type is the OID of the notification. ASCII events have an event type determined by the MDL definition used to read and write them. See also event encoding type; event syntax.
EventFlow: Registered name of the Event processing technology from HP Laboratories (Bristol).
expression: In ECDL an expression is any collection of valid language statements.
Fact Store: Component of the ECS Engine for storing network data used by the loaded correlation circuit.
function: An ECDL function is one of the built-in functions or operators, or a user-defined function. Functions can be named or anonymous, but must return a value.
GDMO: See Guidelines for the Definition of Managed Objects.
GMT: (1) GDMO Modeling Toolset. (2) Greenwich Mean Time. See Universal Coordinated Time (UTC).
Greenwich Mean Time: See Universal Coordinated Time (UTC).
Guidelines for the Definition of Managed Objects (GDMO): (ISO/IEC 10165-4, X.722)
HP OpenView: The user environment for system and network managers. It is based on the features on New Wave and features an RPC facility, Agents to automate tasks, bridging programs to encapsulate systems on the network, etc.; The OpenView System comprises OpenView applications, OpenView development environments, network test and measurement instrumentation and network support services.
HP OpenView Windows: The HP OpenView graphical user interface (GUI) based on X11 and OSF/Motif. HP OpenView Windows displays a graphical map representing network and system management information and provides menu-based application integration. Applications access the services of HP Open View Windows through the HP OpenView Windows API.
identifier: Identifiers are names. In ECDL, identifiers must start with a letter followed by any number of letters, digits, underscores, and apostrophes. No other characters are allowed. Letters may be upper- or lower-case and identifiers are not case-sensitive.
IEC: International Electrotechnical Commission
IEEE: Institute of Electronic and Electrical Engineers.
International Telecommunications Union, Telecommunications (ITU-T): The ITU is a world-wide organization within which governments and industry coordinate the establishment and operation of telecommunication networks and services. It is responsible for the regulation, standardization, coordination and development of international telecommunications as well as the harmonization of national policies.; The ITU is an agency of the United Nations. In 1992 it took over the functions of CCITT.
ISO: International Standards Organization.
ITU-T: See International Telecommunications Union, Telecommunications.
key-value pair: A data storage item consisting of a search key paired with a value. In ECDL a key-value pair is written as "key => value".; See also dictionary.
library: A node library is a directory that contains ECS circuits defined as compound nodes. Nodes in the library can be referenced from a circuit, or copied from the library and modified.
list [data type]: A variable-length ordered set of values. All elements in a list must be of the same data type. If an element type is not specified then the type is set to the most restrictive type that will accommodate all the elements in the list.
Management Information Base (MIB): The collection of object definitions (management information) that can be accessed through a network management protocol.; An abstraction of network resources, properties and states for the purposes of management. (Refer TMN standard M.3100 Generic Network Information Model.)
MDL: See Message Description Language (MDL).
message definition: A description of the attributes and formatting of a text-based event (message), that allows the ECS MDL endecoder to read, write and create events consistent with that syntax. Message definitions are written in Message Description Language (MDL). Message definitions written in MDL are translated into metadata before being used in the ECS Engine. See metadata.
Message Description Language (MDL): A language used to describe a text event's attributes and formatting. Each text event syntax has its own message definition written in MDL. See also message definition, event syntax.
metadata: The compiled form of a message definition. See message definition.
MIB: See Management Information Base (MIB).
MOC: Managed Object Class.
MOI: Managed Object Instance.
MOT: Managed Object Toolkit.
NE: Network Element.
NEP: Network Equipment Provider.
Network & System Management Division (NSMD): The division within HP responsible for OpenView development. NSMDA is the Australian branch of NSMD.
Network Management Layer (NML): A layer within the TMN model.
NML: See Network Management Layer.
node: In ECDL, a processing element in an ECS circuit. See also Compound node; primitive node.
node attribute: A property of a node that can be read from another node. The Count, Rate and Table nodes have attributes. Attributes are addressed using dot notation: "node_name.attribute".
node parameter: In the ECS Designer, a parameter is a value used to configure a node. A parameter may be an expression.; See also expression.
notification: See CMIP notification; event.
NSMD: See Network & System Management Division.
NSMDA: See Network & System Management Division.
NTP: Network Time Protocol.
OID: Object Identifier; Oid.
Oid [data type]: An ECS data type.
OMNIPoint: Open Management Interoperability Point. NMF standards documents are named OMNIPoint 1, OMNIPoint 2 etc.
operator: See function.
OSI: Open Systems Interconnection.
Output Policy: An Output stream policy causes events that are not explicitly discarded by a correlation circuit to be output. Contrast with Discard Policy. See also Stream.
OV: See HP OpenView.
parameter: See node parameter.
pathname: A sequence of directory names separated by slashes that specifies the location of any file or directory.; See also universal pathname.
PDU: Protocol Data Unit.
pmd: The HP OpenView PostMaster Daemon.
port: Events flow into and out of the ports on a node. Each ECS circuit node has one or more ports that can be connected to one or more ports on other circuit nodes. A port is either an input port or an output port; not both.
primitive event: An ECS event with a body representing an event external to the ECS circuit.; See also event; temporary event; composite event.
primitive node: A fundamental processing unit in the ECS circuit paradigm. Circuits are comprised of nodes connected together. Compare with Compound node.
QA: (1) Quality Assurance. (2) Q-Adaptor (TMN).
reserved word: Words that have a special meaning in ECDL and cannot be used for any kind of identifier.
SD: See Software Distributor.
SI: Systems Integrators.
Simple Network Management Protocol (SNMP): A protocol for communicating network management information between a manager and an agent. Heavily used in the IT industry.; See also CMIP
simulate: The process of feeding events from an event log file through an ECS circuit to observe its behavior using debugging aids such as breakpoints, tracing, and stepping.
SMF: See System Management Function.
SML: Service Management Layer.
SNMP: See Simple Network Management Protocol.
SNMP trap: See event.
Software Distributor (SD): Multi-platform software installation tool (HP OpenView).
statically evaluated parameters: A statically evaluated parameter is one where the value is defined when the circuit is loaded. This value does not change when an event enters the associated node/port.
Stream: A stream of events is a logically separate event flow through the ECS Engine. A stream is has either an Output Policy or a Discard Policy. All streams share a common source of events. Applications can subscribe to a specific stream by naming the stream in the EIO_ReceiveFn() callback function parameter passed to EIO_registerReceiveFn().
Syntax: See event syntax
System Management Function (SMF): These are defined in the ISO 10164 series of standards (ITU-T X.73x, X.74x...).
Telco: Telecommunications Services Providers/Operators, for example, Telstra Australia. MCI.
Telecommunications Management Network (TMN): A homogenous approach to the management of heterogenous networks as defined in ISO ITU-TSS M3100.
temporary event: An event that exists within an ECS circuit only. Temporary events may or may not have a body. Temporary events cannot be transmitted outside an ECS circuit.; See also event; primitive event, composite event.
time [data type]: A data type within ECS for representing absolute time values and, in conjunction with the duration data type, performing operations on those values.
TMN: See Telecommunications Management Network.
TPF: Telecommunications Presentation Framework.
transit delay: The difference between current time and the event's creation time. Transit delays can be caused by external network delays or by deliberately introduced delays in an ECS circuit.
trap: See event.
tuple [data type]: A data structure consisting of a fixed collection of elements, where each element is a simple or compound data type.
Universal Coordinated Time (UTC): Formerly known as Greenwich Mean Time (GMT). See also time.
universal pathname: A set of environment variables that describe standard pathnames. Universal pathnames hide variations between pathnames on different versions of Unix.
UTC: See Universal Coordinated Time.
XMP: X/Open Management Protocol interface.
XOM: X/Open OSI-abstract-data Manipulation.