GEM: a generalized event monitoring language for distributed systems

Event-based monitoring is critical for managing and debugging networks and distributed systems. This paper presents GEM - an interpreted generalized event monitoring language. It allows high-level, abstract events to be specified in terms of combinations of lower-level events from different nodes in a loosely coupled distributed system. Event monitoring components can thus be distributed within the system to perform filtering, correlation and notification of events close to where they occur and thus reduce network traffic. GEM is a declarative rule-based language in which the notion of real time has been closely integrated and various temporal constraints can be specified for event composition. The paper discusses the effect of communication delays on composite event detection and presents a tree-based solution for dealing with out-of-order event arrivals at event monitors.