Hi Luis,

Of course this is an event processing problem. You just did not word
it in a way to make it sound like one for the EP crowd, LOL:

Event A: "Company X stock actions priced above $70 during any moment
of the last 5 minutes"

Of course this is an event, and of course it is an event processing
problem, if you are processing detecting Event A as an event causal to
a complex event.

In detecting security issues the same is also true:

Event B: "Login from IP address X during any moment of the last 3
weeks before Login from IP address Y"

This might be a very serious event!

In trouble shooting networks here is a similar, but different scenario:

Event C: "Router X down 5 minutes before Application Y goes down and
Application Y down 10 minutes before Application Z alarm."

If vendor software can't detect these types of relatively simple
scenarios, then how can you build more complex ones?

That is why, for example, network and security management detection
and troubleshooting issues are quite complex, and also why most of the
early CEP work was in the area of network and security management ;-)
These are CEP classes of problems, without a doubt.

Yours faithfully,

Tim

www.thecepblog.com
www.unix.com


--- In CEP-Interest@yahoogroups.com, "pureza_l" <pureza_l@...> wrote:
>
> Hi,
>
> I have the good old StockTrades stream with two fields: symbol and
> price. I'm trying to answer the following question "Were Company X
> stock actions priced above $70 during any moment of the last 5
minutes?".
>
> Unfortunately, using a simple time-based sliding window won't work. To
> see why, imagine there were only two price updates: the first, at
> 10:54 am stated that stocks were at $71. The second, 2 minutes later,
> notified that the stocks went down to $69. Now imagine that the above
> question was posed at 11:00 am (of the same day). We, humans, know
> that the answer is "yes" because the price was $71 between 10:54 and
> 10:56. But the first event is outside the 5 minutes window and will
> thus be ignored by the system.
>
> How would you solve this?
>
> Thanks,
>
> Lu�s Pureza
>