Created question in FIWARE Q/A platform on 02-09-2015 at 14:09
Please, ANSWER this question AT http://stackoverflow.com/questions/32353269/ceps-sequence-detection

Question:
CEP's sequence detection‏

Description:
In developing for Fiware's Proton CEP, I came across an issue with Sequence event detection. I'll take advantage of DoSAttack example project, that comes with the software, to explain the issue.

I make two main changes to an original copy of DoSAttack:

-One is to make ExpectedCrash event have 3 more variables. This way I can log to DoSAttackTRConsumer file the 3 values that triggered it.

-Then I also change the Cardinality Policy of the Agent from Single to Unrestricted. This way the event can be triggered several times in a row, as TrafficReports come in (this may be a source to the issue).

I test this result and I find it works ok. I can see in the log that the values that trigger detection are the sequence of 3 values that arrived just before the event, after the first three events have arrived.
This, taking into account that the test beeing made on those 3 values still remains the original example test: (TR3.volume>1.50* TR2.volume AND TR2.volume>1.50 * TR1.volume).

The issue arrises if I make the test be just (TR3.volume>1.50* TR2.volume), for example, then CEP doesn't hold TR1 correctly. Now TR1 is the same as TR2, so cep loses "memory" of this value.
Going a step further, I make the test, just the condition (3>2) which is always true and should trigger a detection on any event that arrives. In this case, as events arrive, all TR1, TR2 and TR3 are the same and CEP has no memory of past values, even though the agent is of Type: Sequence.

The desired application would be for the CEP to recieve 22 readings as a sequence of input events and analyse only the 1st, 8th, 15th and 22nd values of this sequence, at each value that enters. But I find I can't make CEP remember the values correctly unless I'm testing all of them explicitly in the Condition view-box.

What would be the correct way to analyse the 1st, 8th, 15th and 22nd values that arrived, evaluating each time a new one arrives?

Here is the specificatin of DoSAttack, after altering it:

{"epn":{"events":[{"name":"TrafficReport","attributes":[

{"name":"volume","type":"Integer","dimension":0}

]},{"name":"ExpectedCrash","attributes":[

{"name":"Cost","type":"Double","dimension":0}

,

{"name":"TR1","type":"Integer","dimension":"0"}

,

{"name":"TR2","type":"Integer","dimension":"0"}

,

{"name":"TR3","type":"Integer","dimension":"0"}

]}],"epas":[{"name":"IncreasingTraffic","epaType":"Sequence","context":"3MinAfterStartUp","inputEvents":[

{"name":"TrafficReport","alias":"TR1","consumptionPolicy":"Consume","instanceSelectionPolicy":"First"}

,

{"name":"TrafficReport","alias":"TR2","consumptionPolicy":"Consume","instanceSelectionPolicy":"First"}

,

{"name":"TrafficReport","alias":"TR3","consumptionPolicy":"Consume","instanceSelectionPolicy":"First"}

],"computedVariables":[],"assertion":"3>2","evaluationPolicy":"Immediate","cardinalityPolicy":"Unrestricted","internalSegmentation":[],"derivedEvents":[{"name":"ExpectedCrash","reportParticipants":false,"expressions":{"Cost":"10","TR1":"TR1.volume","TR2":"TR2.volume","TR3":"TR3.volume"}}],"derivedActions":[]}],"contexts":{"temporal":[{"name":"3MinAfterStartUp","type":"TemporalInterval","atStartup":true,"neverEnding":false,"initiators":[],"terminators":[

{"terminatorType":"RelativeTime","terminationType":"Terminate","relativeTime":"180000"}

]}],"segmentation":[],"composite":[]},"consumers":[{"name":"SysTemCrashConsumer","type":"File","properties":[

{"name":"filename","value":"/opt/tomcat10/sample/DoSAttack_PredictedCrash.txt"}

,

{"name":"formatter","value":"json"}

,

{"name":"delimiter","value":";"}

,

{"name":"tagDataSeparator","value":"="}

,

{"name":"SendingDelay","value":"1000"}

],"events":[

{"name":"ExpectedCrash"}

],"actions":[]},{"name":"DoSAttackTRConsumer","type":"File","properties":[

{"name":"filename","value":"/opt/tomcat10/sample/DoSAttack_TrafficReport.txt"}

,

{"name":"formatter","value":"json"}

,

{"name":"delimiter","value":";"}

,

{"name":"tagDataSeparator","value":"="}

,

{"name":"SendingDelay","value":"1000"}

],"events":[

{"name":"TrafficReport"}

],"actions":[]}],"producers":[{"name":"TrafficReportFileProducer","type":"File","properties":[

{"name":"filename","value":"/opt/tomcat10/sample/DoSAttackScenarioJSON.txt"}

,

{"name":"pollingInterval","value":"1000"}

,

{"name":"sendingDelay","value":"1500"}

,

{"name":"formatter","value":"json"}

,

{"name":"delimiter","value":";"}

,

{"name":"tagDataSeparator","value":"="}

],"events":[]}],"actions":[],"name":"DoSAttack"}}

The producer file, DoSAttackScenarioJSON.txt, is still the original one, unaltered:

{"Name":"TrafficReport", "volume":"1000"} {"Name":"TrafficReport", "volume":"1600"} {"Name":"TrafficReport", "volume":"2500"}

If you do include more values than 3 you can see that the issue propagates.

If you need more information let me know.

Thank you