The EPTS Event Processing Glossary talks about an “Event Processing Network” or EPN – the event processing agents and their connecting channels, with event sources or producers leading through to event consumers in a connected graph (which can be a report or a model). Usually we talk here about TIBCO BusinessEvents – sets of agents doing event processing and storage in a distributed network that corresponds quite nicely to the idea of an EPN. However, there are many other types of event processing agents, and we will start to cover some of those on this blog, starting now with TIBCO Hawk.
Compared to TIBCO BusinessEvents, TIBCO Hawk is a very different type of event processor; that is it is:
- much closer to the event sources (typically system events)
- simpler in its operations (typically event detectors that create alert events) – no inferencing, continuous queries, joins across event types, etc
- much more distributed (smaller agents, 1 per system, with various microagents for collecting or interfacing to different event types) with associated controls and services (distributed rulebase updates on the fly, dashboard display, event capture server, and so on)
- targeting monitoring and management tasks, rather than the more business-oriented “track and trace”. For example, Hawk might be used to monitor SCADA systems, rather than distribute the SCADA data itself. Alternatively, if the SCADA system is itself being used for a monitoring task, then indeed it could work in conjunction with Hawk.
Nonetheless it also shares characteristics with BusinessEvents: it is rule-based, distributed, agent-based, event-driven, event processing. On the subject of whether Hawk is a “CEP solution” then at the academic level probably it is: it is deriving alerts from input events. But at the tool level, it is best to consider Hawk as a high performance filtering and trigger-rule operating system with the emphasis on rule execution simplicity and small agent size.
What is interesting is that Hawk collects information events from sources such as SNMP, JMX, databases, log files, operating systems etc, as well as the means to influence these through control events. Ergo it is very much complementary rather than overlapping with CEP technologies as provided in tools like TIBCO BusinessEvents.
Over the coming weeks we will dive into TIBCO Hawk in more detail to see what it does for some of the larger IT organisations on the planet.
