Specifying 'and not' logic to detect when events are missing
Using and not logic with a time-based listener is useful for detecting the absence of an event that is expected.
For example, consider an application that monitors the processing of customer orders. The application listens for OrderCreate events, which indicate that a customer has placed an order. After an OrderCreate event is found, the application listens for an OrderStepComplete event that has an instanceid value that matches the instanceid value in the OrderCreate event and that has a step field value of Order Shipped. If the application does not find a matching OrderStepComplete event within an hour (3600 seconds), the listener triggers and the application generates an alert to indicate that the order was not shipped.
Following is code that shows the listener definition.
on all OrderCreate() as oc {
on wait(3600.00) and not OrderStepComplete(
instanceid=oc.instanceid,step="Order Shipped") as os {
// Raise an alert.
}
}
This listener triggers when the event templates on both sides of the and operator evaluate to true. The event template before and evaluates to true after an hour has elapsed. The event template after and evaluates to true in the absence of a matching OrderStepComplete event. If the application finds a matching OrderStepComplete event within an hour then the second event template evaluates to false and the correlator terminates the listener because it can never trigger.
In the following example, when a FileReceived event is found, the application starts to listen for a FileProcessed event. If a FileProcessed event is not found within 30 seconds of receiving the FileReceived event, the application generates an alert.
monitor SimpleFileSearch {
action onload() {
on all FileReceived() as f {
on wait(30.0) and not FileProcessed(id=f.id) {
// Send alert that file was not processed.
}
on FileProcessed(id=f.id) within(30.0) {
// Send confirmation that the file was processed.
}
}
}
}