Event-based Monitoring of Process Execution Violations M. Weidlich, H. Ziekow, J. Mendling, O. Günther, M. Weske, N. Desai Hasso Plattner Institute, University of Potsdam, Germany AGT Germany Humboldt-Universität zu Berlin, Germany IBM India Research Labs, India
What Do We Target? How to detect if activities deviate from the plan?? Click to edit Master text styles Second level Third level Fourth level Fifth level 2
Our Approach Set up on CEP to (1) automatically derive monitoring queries and (2) provide structured reports derived queries (behavioural profiles) events CEP Engine! Click to edit Master text st Second level Third level Fourth level Fifth leve aggregated reports 3
Monitoring Process Instances Case 12 Seattle Municipal Archive 4
Setting Assumptions Events signal activity execution Complex Event Processing (CEP) engine available Requirements Immediate detection of deviations Structured feedback on deviations o5com zeevveez 5
Agenda Monitoring process instances Background Complex event processing Causal behavioral profiles Approach Derivation of event queries Feedback on deviations Case study: SIMP 6
Complex Event Processing Event a happening of interest Complex Event Queries Correlation between events Logical query over event streams Many dedicated CEP languages exist We rely on an abstract language Atom queries that relate to activity execution and(a,b), seq(a,b), not(a), within(a,t) 7
Causal Behavioral Profile B A C D E G F Strict Order between C and D A Exclusiveness between E and G Interleaving Behavioural between B and C Abstraction! Co-occurrence from E to D, but not from D to E A B C D E F G A + A B C D E F G B + A >> >> >> >> C + D + B >> >> >> >> E + F + + C >> >> >> >> G + + + D >> >> >> >> E >> >> >> >> >> >> 8
Approach o5com 9
Event Query Derivation Exclusiveness violation: observe the joint execution of exclusive activities B Queries: A and(e,g), C and(f,g), D and(c,c) Abortion of queries Time-based E G F By termination activity Optimized queries: within(and(and(e,g),not(end))), t) 10
Event Query Derivation cont. Strict order violations: observe the execution of two activities in reversed order Co-occurrence violations: Detection upon completion of the process instance Warning already if a third activity signals that co-occurrence should have been observed B E A C D Query to detect: and(and(b,end),not(c)) Query to warn: and(and(b,d),not(c)) G F 11
Approach 12
Structured Feedback Problem Fine-granular analysis for pairs of activities Many violations may occur at once Solution Root cause of violations Consecutive violation zeevveez 13
Structured Feedback cont. Exclusiveness violations Violation with the earliest observed event: root cause Later violations for which one event is not conflicting with root cause events: consecutive violation B Observed events: A,C,B,D,E,F,G Violations: (E,G), (F,G) A C Root cause: exclusiveness violation (E,G) Consecutive violation: (F,G), E and F are not conflicting D E G F 14
Structure Feedback cont. Feedback for strict order as for exclusiveness Co-occurrence violations Characterized by two events One implies the missing event One signals that the missing event should have been observed Violation with the latest observed event: root cause Later violations that hint at the same set of missing events: consecutive violation 15
Structured Feedback cont. B A C Violations: (A,D), (B,D) Observed events: A,B,D D E G F Missing events: C Root cause: violation (B,D) Observed events: A,B,D,E Additional violations: (A,E), (B,E) Consecutive violations: (A,E), (B,E) 16
SIMP Issue management process as run by an IBM Service Delivery Center Process is not enforced, activities are logged 852 process instances have been logged 17
Results Homogenous distribution over violation types Heterogeneous distribution over cases Significant filtering of detected violations 18
To Take Home Automatic generation of monitoring queries from process models Monitor process execution in a CEP environment Allows for immediate and structured feedback Limitations & Future Work Only the abstracted control flow is monitored Extend approach towards further behavioral details 19