After a week of travel to Europe for work, I am winding down at a restaurant in Stockholm Arlanda Airport for a flight in the morning. I decided to go and have one more nice meal (and some wine to help me sleep). Okay, the wine was for taste, but the sleeping part is an added bonus. During my dinner, I noticed some perfect english beside me (which is rare in Sweden).
After introducing myself, I found out it was a group of people who just finished a week from a Robotics conference discussing papers (one PhD and 2 undergrad). What a fantastic discussion! Especially since I’ve been interetested in robotics since the 2nd grade, and had dreams of going to MIT until high school. During the discussion, I learned their papers were about the “sharing” of information between dissimilar robotics systems with ROS being the only thing in common. One example they gave me was if the police department sends in a robot (for whatever reason), and the fire department arrives and sends in an ariel robot. They want the two different robots to talk to one another.
To clarify in my own terminology, I asked, “So, apart from getting the two talking with different protocols, you are talking about event correlation? To make different data meaningful from a higher perspective between two different systems”. Their eyes widen. I’m not sure if it’s because they were surprised a guy like me knows about “even correlation”, or if they just never thought about it before. Knowing my intelligence, it’s probably the former rather than the latter.
I’m not sure there is anyone who is NOT an IT Manager or Engineer who doesn’t know about event correlation. I mean, alarms and events are great. But, we want to know about the bigger picture. Just like the human brain, we want systems to talk to each other. For example, out of the box, you might get a network alarm that says “frame error count is high on interface 4/0/3″ and windows alarm that says “network I/O error detected”. Event correlation could kick in saying “Bad network interface on server 4″. Yes, it could be the network interface on the switch, but this is my example, and NOTHING is ever wrong with the network! :) Unless it’s a PowerConnect, then you are on your own.
It’s funny how IT processes and functions can expand to other systems that are not in the TCP/IP stack or “enterprise-grade” devices. Event correlation is a fantastic solution for the larger shops, who has teams of people in different areas, and need to know “near real-time” what the larger issue is. Without event correlation, you could have 2 (or more) teams wasting time troubleshooting the other’s problem.