Real time log event analysis with WSO2 BAM(CEP features)

One of the major problems when it comes to managing/monitoring distributed systems is not being able to detect when your system is giving issues all of a sudden. Lets say you have like 100 servers and you need to detect when a fatal error appears in the system and you want to act right away. This is nearly impossible if you do not have proper monitoring tools.
WSO2 BAM with WSO2 CEP features has the perfect mechanism to monitor real time logs and alert it to relevant parties when an expectation/ suspicious error occurs.

In this sample I will be using WSO2 Appserver and WSO2 BAM in order to demonstrate the monitoring and alerting capabilities of WSO2 BAM 2.4.0.

• WSO2 Appserver will be used to send log events to BAM.
• WSO2 BAM will do all the monitoring and alerting when logs are captured.

Send Logs to BAM

To send logs all you need to is go to WSO2_AS_HOME/repository/conf/log4j.properties and add LOGEVENT to the root logger. And start Appserver. (please make sure your BAM server is up and running before starting the Appserver)

To test if the logs are successfully sent to BAM, you can log in to cassandra explorer and see if there is a new column family created under EVENT_KS keyspace

ie log.AS.0.2013.1.12

Configuring WSO2 BAM for REAL TIME analytics

In this demo, I will be sending an email if an ERROR log occurs in WSO2 Appserver.  Since we will be using mail transport in BAM to send email alerts to recipients, we have to enable mail transport in BAM. To do that go to repository->conf->axis2->axis2-client.xml and add email configurations.

<transportSender name="mailto" class="org.apache.axis2.transport.mail.MailTransportSender">

       <parameter name="mail.smtp.from">wso2esb.mail@gmail.com</parameter>

       <parameter name="mail.smtp.user">wso2esb.mail</parameter>

       <parameter name="mail.smtp.password">wso2mail</parameter>

       <parameter name="mail.smtp.host">smtp.gmail.com</parameter>

       <parameter name="mail.smtp.port">587</parameter>

       <parameter name="mail.smtp.starttls.enable">true</parameter>

       <parameter name="mail.smtp.auth">true</parameter>

   </transportSender>

Here you can give your own email configurations. 

Restart/Start the BAM server.

Assuming the logs are getting published to BAM, lets see how we can capture these log events for real time analytics.

Step 1 - Creating Event Adapters

In order to do real time analytics we need to create an execution plan. For that we need two input adapters.

1. Input adapter - to capture log events coming to BAM (in  this case it will be a wso2event).
2. Output adapter - to send emails

To create adapters you need to login to BAM management console. Under configurations, there will be "Event Processor Configs" and add input event adapters and output event adapters as shown below.

Input Event adapter

Output Event Adapter

Step 1 - Creating Stream Definitions

Now that we have created event adapters, we need to create a stream definition to capture the LogEvent in order to do complex event processing. In the appserver log event, these are the attributes we have.

• Meta Data
• clientType {String}
• Payload Data
• tenantID  {String}
• serverName {String}
• appName  {String}
• logTime  {Long}
• priority {String}
• message {String}
• logger {String}
• ip {String}
• instance {String}
• stacktrace {String}

To create the stream definition, go to main tab and under create stream definition you can create the log event stream as shown below.

Step 1 - Creating the Execution Plan

In the execution plan we will be specifying the input stream and writing a CEP Query (SQL Like Query)  for the event stream.

Go to Create Execution Plan, and give suitable name for the execution plan. Select the needed stream and give an alias. Click on import after selecting the stream. In our CEP Query we will analyze events and if an event has an error, we will send it to an output stream.

CEP QUERY

from LogEvents[priority == "ERROR"]

select message,stacktrace,serverName

insert into ExceptionStream

After creating the Query, we need to add the exported stream (which is the stream that we are sending Error logs) according to our CEP querry exported stream name should be ExceptionStream give the value of the exported stream name and select "Create Stream Definition" to create the ExceptionStream. This stream will be auto generated by looking at the CEP as shown below.

Once we create the Exception stream select the Exception stream as exported stream and create a new formatter. This formatter is used to specify the email body and email related information like the subject, to address ect.  Give the output mapping type as text so we can give the content of the email message body inline. 

Email Body

Error Occurred in {{serverName}} – {{message}}

{{stacktrace}} 

In this body we are taking message, stacktrace and server name from the OutputStream (ExceptionStream) and adding a readable message for the email message body.

Add the event formatter and save the execution plan. Now we have successfully created the event trigger to monitory error logs for wso2 appserver. You can test this by invoking a service with an error.

If you want more in depth information on real time log event analytics you can follow the following screen cast for more details

Sneak Peek at WSO2 BAM 2.0 & How to Install BAM Data Agents in WSO2 Products

In a fast growing company, enterprise data plays a major role when it comes for decision making and other top level business activities. When I say enterprise data, it can be anything which is an asset to your company, for example

1. It can be the data coming into your system (Employee Information, Product Information Sales data etc)
2. It can be mediation data (who is accessing your services/application, when and how)
3. Request,response and faulty count for your services.

These row data can be crucial and also it is very important to analyze and convert these data into information in order provide business intelligence for decision makers.

WSO2 BAM is mostly used in SOA environments because when it comes to SOA environment monitoring your data means monitor your services. Most of your business functionalites are exposed as services, for example if you want to insert set of records to your data base you will expose set of data services to do it or if you want to mediate some services you need to create proxy service. You can monitor these kind of data using WSO2 Buisness activity monitor Server.

If you look at BAM highlevel architecture BAM can be modelled according to three major components

1. Aggregation – BAM Data Agents which publish data in to BAM Data storage
2. Analytics - Analyzers which analyzed Data in BAM storage
3. Presentation – Gadgets which displays key performance indicators of analyzed information
   
   
   
   
   

You can monitor any business modeling scenario according to these components and BAM architecture is modelled around these three components.

Aggregation – basically this means getting your data into BAM (capturing/collecting data into BAM). BAM data are sent using events, you can capture important set of data and make it as an event stream. I will give more details on events stream in my next posts :) but for the moment all you need to know is capture many data as possible when you are sending data to BAM more data means more business intelligence.

Analytics – After you capture your data you need to make your data meaningful (basically converting data into information) by analyzing your storage data. In order to do that you need to do some data operation (aggregation, merging, sorting ordering) and ultimately build some key performance indicators which will be needed for business intelligence. In BAM you will be able to write your own analyzers (custom analyzers) using hive/hadoop and also these queries can be saved and scheduled accordingly. We will dig deep into how to write hive queries using bam and how to analyze data and create KPIs using data in future.

Presentation – Once you analyze your data, you might need to visualize your KIPs (using bar charts tables) and build your own dashboards in order to visualize your information to decision makers. And not just visualizing you might need to send these analyzed data to needed parties using reporting alerts daily to the topper management etc. WSO2 BAM will provide rich set of tools to do those task without much coding effort. It provides a gadget editor tool which give you a drag and drop kind of way to create your gadgets from your analyzed data or you can connected to reporting o do some complex event processing and send emails etc just by using set of configurations.

Referance http://mackiemathew.files.wordpress.com/2012/01/bamarchitecture.png

Now that we discussed the main architecture behind BAM and also bit about the functionalities of BAM (you can go through BAM samples and install bam samples in order to get in depth knowledge on BAM)

Lets see how we can use BAM to monitor your services.

For this I am going to use WSO2 ESB and we will see how we can monitor service statistics using BAM.

First we need to install BAM data agents inside ESB.

How to install BAM data agents in ESB?

Download P2 Profile which will contain BAM Data agent features. Download WSO2 ESB Latest packs. Go to ESB_HOME/bin and start up the server.

Login to Management Console of WSO2 ESB using user credentials (default is admin, admin).  

Go to Configure -> Features and Click on Add Repository.

Click on add Repository, You need to give a meaningful name for the repository name, I am going to give it as My_REPO and give the path to your P2 Profile and click on add.

Once you add the repository you will be redirected to a page which contains available features. You need to install BAM data agent features therefore, type BAM on Filter by feature name and untick group feature by category and click on find.

Tick on following features BAM Mediation Data Agent Aggregate, BAM Mediator Aggregated,BAM Service Data Agent Aggregate and click install.

Read and accept  License Agreement and click next. Once the installation is finished restart the server.

Once you have installed the BAM data agents you will see newly installed features under Configure.
1. Service Data Publishing, 2. Mediation Data Publishing 3. BAM Server Profiling.

How to Configure Service Data Agent ?

You can click on Service Data Publishing to send your Service Data to WSO2 BAM. In order to do that you need to Download and Start up BAM (if you are running ESB on the same machine you need to change the offset{BAM_HOME->repository->conf->carbon.xml set offset to 1}.

Go to ${WSO2ESB_HOME}/repository/conf/etc and open bam.xml file. Please make sure that you enable the ServiceDataPublishing.
The bam.xml should have the following configuration:

   <BamConfig>
        <ServiceDataPublishing>enable</ServiceDataPublishing>
   </BamConfig>

NOTE: By default the this is disabled, and the BAM publishing won't occur even though you proceed the below steps and changed in the mentioned UI. Therefore please enable the ServiceDataPublishing to use with WSO2 BAM.
Then in the ESB side go to Service Data Publishing, Give the BAM Server URL which will be the thrift ports started in BAM server (tcp://localhost:7611), give BAM credentials (default is admin,admin)  and click on update.

Now if you invoke some services from ESB side the service data will get published to bam. Now to check to confirm whether your data is in BAM you can go to BAM Management Console Check it by connecting to Cassandra Explorer.

In this post I have only explained an intro to BAM 2.0 and how to send service data to bam From my next session I will explain how to send your enterprise data to BAM and how you can do analytics and presentation using WSO2 BAM tool kits.