Saturday, September 29, 2007

The trap of ambiguity - case of "event correlation"

One of the terms that is missing from the event processing glossary is "event correlation", yet, I don't miss this term at all, in facts, I am trying to lose it for years. The main reason is the homonym effect which the same term is used in different meaning. Here is the collection of different meanings that I know of of this term:

1. A network and system management application: following the ComputerWorld article - "Event correlation simplifies and speeds the monitoring of network events by consolidating alerts and error logs into a short, easy-to-understand package" - in this case the idea is to reduce the number of symptoms and concentrate on problems.

2. Some call the pattern detection part of CEP in the name "event correlation"

3. Some call the matching between events and data (e.g. for enrichment) as "event correlation"

4. Some are using the "correlation identifier pattern" in the enterprise integration patterns - the act of matching two events based on shared attributes.

5. Last but not least, event correlation refers to statistical correlation among the occurrence of two events, used to mine patterns of causalities.

So - what is the problem in homonyms ? the problem is that since in general there is a confusion of terms in this area, homonyms tend to intensify the confusion, especially among decision makers who don't really have technical depth, but get decision based on perceived impressions -- this may have undesired results.

Thus, I prefer to use non-ambiguous terms as much as possible, and avoid confusing slang.

This is just one example of confusing terminology, in a recent incident I noticed people spending much energy trying to understand what is the meaning of BAM (which I may discuss in another time).... The consensus glossary is not just a "nice to have", it is a business tool to save a lot of time on miscommunication.... More, later.

1 comment:

harvey said...

Opher,

I agree, terminology has a lot to do with ease of adoption, and "event correlation" is problematic.

One avenue of exploration for a new term is to imagine what is the purpose of such a word? For example I could imagine that after examining many "events" one may want to take some action, yes? So then there is before us:
1. The act/process of trying to ascertain something (pattern recognition)
2. The act/process of declaring that in fact you specifically ascertained "such and such, at this location, time, &tc).
3, The act/process of doing something once you ascertained something specific.

The higher level you can keep the language, the more accessible it will be to decision makers in business, gov't, military. In other words, we shouldn't choose words that sound too techy. After all event processing is supposed to be going "up" the semantic scale, yes?

So maybe some words that could apply to the above would be:
1. environment monitoring
2. situation recognized
3. situation processed
I think you even have used the 'situation' word before in conference presentations.

It's the "situation processed" that provides a linkage to well defined BPEL-like possibly transactional processing. The event or situation stuff is more like ad-hoc glue in between. Bob Wilson promotes this distinction and I agree.