Control Considerations for Scaling Event Correlation

The growth in the scale of systems and networks has created many challenges for their management, especially for event correlation. Our premise is that scaling event correlation requires parallelism. To this end, we observe that event correlation can be divided into intra-event processing such as filtering and inter-event processing such as root cause analysis. Since intra-event processing is easily parallelized, we propose an architecture in which intra-event processing elements (IAPs) are replicated to scale to larger event input rates. We address two challenges in this architecture. First, the IAPs are subject to overloads that require effective flow control, a capability that was not present in the components we used to build IAPs. Second, we need to balance the loads on IAPs to avoid creating resource bottlenecks. These challenges are further complicated by the presence of disturbances such as CPU intensive administrative tasks that reduce event processing rates. We address these challenges using designs based on control theory, and demonstrate the effectiveness of our approaches with testbed experiments that include a disturbance in the form of a CPU intensive application.