Event Management Overview › Event Management Architecture

Event Management Architecture

Event Management uses a distributed and manager-client model to help ensure scalability through filtering events as close to the data sources as possible. The query and retrieval of events is also done in a federated approach and the results are combined before being made available for searches.

The distributed, scalable architecture of Event Management simplifies event handling by providing the following functional capabilities:

• Event processing capabilities at two primary levels—simple and complex. Simple processing includes normalizing from an event source (raw) schema to the common (USM) schema. Complex processing includes filtering, consolidating, and refining message content according to the discovered patterns.
• Support for remote searches of event data to achieve the following objectives:
  • Enable a federated model that does not require large volume event data to move around the subsystem.
  • Support visualization requirements through integration with the Operations Console for event searches and policies.
• Ability to perform federated event searches on all events or on specific connector event sources to analyze events and detect event trends.
• Local cache and persistence within each node or tier.
• Ability to save event searches as policies that you can access at any time to view the most recent search results.
• Ability to create and deploy event policies that perform actions on events that match the search results.

More information:

How Events are Processed in Event Management

Event Management Components