Query for missing events/heart beat

Question

Hello Everyone,
I am trying to monitor network packets I send to a certain specific ip address and also check if I have sent packets for that particular ip at regular intervals(something like a heartbeat). I am forwarding the network output from wireshark to a csv file and reading it at OCEP using csv adapter.
In order to check for missing events/heart beat (this is used to check if a server responds to ping once every hour) I followed this link
Re: CEP Timer for Non-Event and
[http://docs.oracle.com/cd/E21764_01/doc.1111/e14476/examples.htm]
I have configured the OCEP. This is the query I am firing
SELECT Packets.ipdst AS ipdst,Packets.ipsrc AS ipsrc,Packets.framelen AS framelen,"Error-Missing Event" AS alertType
from FilterNetworkPackets
MATCH_RECOGNIZE (
PARTITION BY ipdst
MEASURES Ipdst_Packets.ipdst AS ipdst,
Ipdst_Packets.ipsrc AS ipsrc,
Ipdst_Packets.framelen AS framelen
ALL MATCHES
include timer events
PATTERN( Ipdst_Packets*)
DURATION 10 DEFINE Ipdst_Packets AS ipdst = "xx.xx.xx.xx")
AS Packets
I have configured heartbeat(10000) on the input channel as well.
I get output in which some packets are repeated. I dont know how to get notification for missing events after the duration has elapsed, please help me.
Thanks in advance
Shilpa

Answer 1

Thanks a lot for the reply Unmesh. Really appreciate it.
ipsrc ipdst framelen/seq
192.168.0.11     173.194.5.140     3
192.168.0.9     239.255.255.250 4
192.168.0.10     173.194.5.140     5
192.168.0.9     239.255.255.250 6
192.168.0.9     173.194.41.161     7
192.168.0.9     173.194.41.161     8
192.168.0.9     173.194.41.161     9
192.168.0.9     239.255.255.25 10
192.168.0.9     90.192.176.67     11
192.168.0.9     87.112.197.250     12
192.168.0.9     173.194.41.166     13
192.168.0.9     173.194.41.166     14
192.168.0.9     173.194.41.181     15
192.168.0.11     173.194.5.140     16
192.168.0.9     173.194.41.181     17
192.168.0.9     90.192.176.67     18
192.168.0.9     173.194.41.181     19
192.168.0.19     173.194.5.140     20
192.168.0.9     173.194.41.181     21
192.168.0.9     194.168.8.100     22
192.168.0.9     173.194.41.181     23
This is part of the test data which consists of ipsrc,ipdst,framelen. Currently I have set framelen to sequence number for checking. I run the loadgen.cmd on this csv file. I need to check if a packet with ipdst = "173.194.5.140" arrives once every 10 sec. Give some warning if it does not arrive.
My config file is:
<query id="FilterCriteria"><![CDATA[
SELECT Packets.ipdst AS ipdst, Packets.ipsrc AS ipsrc, Packets.framelen AS framelen, "Error-Missing Event" AS alertType
from FilterNetworkPackets
MATCH_RECOGNIZE ( PARTITION BY ipdst
MEASURES Ipdst_Packets.ipdst AS ipdst, Ipdst_Packets.ipsrc AS ipsrc, Ipdst_Packets.framelen AS framelen
include timer events
PATTERN( Ipdst_Packets) DURATION 10
DEFINE Ipdst_Packets AS ipdst = "173.194.5.140") AS Packets
]]></query>
</rules>
</processor>
<channel>
<name>FilterNetworkPackets</name>
<heartbeat>100000000</heartbeat>
</channel>
<http-pub-sub-adapter>
          <name>alertadapter</name>
          <server-context-path>/pubsub</server-context-path>
          <channel>/packetalert</channel>
     </http-pub-sub-adapter>
If I maintain the entry for channel, I get error from the server
Error encountered while initializing configuration object. The configuration name, FilterNetworkPackets, is used multiple times, but configuration names must be unique within the same configuration file or application.>
I set the heartbeat value via the visualiser. Is this wrong?
This is the output
{"ipsrc":"192.168.0.10","alertType":"Error-Missing Event","framelen":5,"ipdst":"173.194.5.140"}
{"ipsrc":"192.168.0.10","alertType":"Error-Missing Event","framelen":5,"ipdst":"173.194.5.140"}
{"ipsrc":"192.168.0.10","alertType":"Error-Missing Event","framelen":5,"ipdst":"173.194.5.140"}
{"ipsrc":"192.168.0.19","alertType":"Error-Missing Event","framelen":20,"ipdst":"173.194.5.140"}
{"ipsrc":"192.168.0.19","alertType":"Error-Missing Event","framelen":20,"ipdst":"173.194.5.140"}
{"ipsrc":"192.168.0.19","alertType":"Error-Missing Event","framelen":20,"ipdst":"173.194.5.140"}
{"ipsrc":"192.168.0.9","alertType":"Error-Missing Event","framelen":64,"ipdst":"173.194.5.140"}
{"ipsrc":"192.168.0.9","alertType":"Error-Missing Event","framelen":64,"ipdst":"173.194.5.140"}
{"ipsrc":"192.168.0.9","alertType":"Error-Missing Event","framelen":64,"ipdst":"173.194.5.140"}
Sometimes it repeats the packets and sometimes it does not.
It did not display packet 3,16 which also follows the criteria. Also for the next iterations of ten seconds when the criteria fails it does not do anything. Is it possible to perform some action or notification that there was no event within that time interval?
Thanks
Shilpa
Edited by: 919141 on 29-Mar-2012 07:28
Edited by: 919141 on 29-Mar-2012 08:07