The quest for agility has spurred the recent rise of Service Oriented Architecture (SOA) and the face of modern IT integration architecture is changing. Technology stovepipes of the past are now being connected by Enterprise Service Bus (ESB) technology, which provides the backbone for the networking, communication, mediation, and service container management needed to support an SOA. Every integration software vendor provides some form of ESB in its products and the ESB has risen to the status of a de facto standard for SOA integrating. But what's the next step in the evolution of the IT integration fabric?

The next step is a new class of software called event-stream processing, or ESP. ESP has been hailed as the "next big thing" by both software vendors and analysts because it helps an SOA integration fabric become intelligent and responsive. ESP empowers a business to think differently about its operations and IT infrastructure because it can understand the state of a business in the now, rather than just in the past.

But aren't ESBs already emitting events and aren't all SOA infrastructure elements capable of emitting and carrying events? The answer is "yes," ESBs are event-capable today. However, they don't prescribe what to do with the events that are emitted by their services. That's the critical value that ESP brings.

ESP enables an event-driven SOA to decipher causal (if A is followed by B followed by C), temporal (within four seconds), and spatial (within 10 feet) relationships among events - and can do so in real-time. This kind of "enterprise wiretap" lets a business continuously analyse key performance indicators in real-time, identify threat and opportunity in real-time, and act instantly. These capabilities require a new style of computing - stream computing - that can deliver the missing link between an event-driven SOA and real-time business insight.

This article describes the characteristics of stream computing, how an ESP works, and how ESP and the ESB combine to provide an agile, intelligent integration fabric, and an intelligent, real-time enterprise.

Event-Driven SOA Delivers Real-Time Insight
The goal of an event-driven SOA is not merely the capture of all - or some - of the events generated by the architecture. Its goal is to derive business insight from those events - and derive that insight quickly enough to act. An example of a system that delivers real-time intelligence is the "Delta Nervous System."

Figure 1

Delta Airlines, under pressure from competitors like Southwest Airlines, described a concept in 2003 designed to alter its operational infrastructure. The Delta Nervous System monitors operational events, analyses them in real-time, and makes operational decisions in real-time.

The Delta Nervous System monitors weather forecasts and flight positions, identifies patterns among those events - such as changes in the weather - that determine flights that need rerouting. If flights have to be rerouted, that action triggers further events that cause passengers to be rebooked in real-time. Dashboards alert Delta flight operations personnel of the status of flights, with messages sent to kiosks in terminals and gate agents that keep the whole operational organization synchronized.

This real-time operational infrastructure is an example of an event-driven SOA: with flight positions transported by ESB; passenger itineraries checked by database query; dashboards updated with the state of flights, crews, and passengers; and decisions enacted by emitting events. This is a system that needs event processing to provide real-time insight.

The Missing Piece of an Event-Driven SOA: Event-Stream Processing
Real-time intelligence lets a business think differently about its operations and IT infrastructure because it can understand the state of the business in the now rather than just the past. Stream computing is a new style of computing that enables instant event pattern recognition, and it's vastly different from traditional styles of computing.

Figure 2

Traditional computing is static computing, and static computing uses static data. Static data is like a photograph, which captures information about a moment in time. For example, static business data is a table of customer data, transactions at a retail store, or records of shipments that have occurred in a company's supply chain. Static computing can be used to answer questions like: "How many shoes did we sell in our New York stores last week?" Over $200 billion of software is sold worldwide each year, and almost all of it is designed for static data. Relational databases, for example, are designed to manage static data.

Real-time computing is stream computing, and stream computing uses events. Events arrive in streams that resemble a movie in which streams of images and sounds flow by your senses. Patterns in the stream of images and sounds can make you laugh, cry, or scream. Much like a movie, streaming events in an enterprise let the business feel the pulse of operations as events travel through its arteries - the ESB. With stream computing, a business can identify patterns and make instant decisions while they still matter: "When four transactions against the same credit card number from four different shops happen in one minute, deny the next request, flag the account, and send a message to the fraud detection dashboard." And like a movie's impact on its audience, these patterns might well make a CFO laugh or cry.

Figure 3

Static computing and stream computing have fundamentally different physical characteristics - stream computing enables instant, real-time, intelligent decisions based on the patterns of business operations. These patterns are determined by the temporal, causal, or spatial relationships among events in the stream.

The concept of stream computing isn't new, but the efficacy of the tools that implement it is. In 1985, database researchers began to explore the element of time by extending the relational database with time-series extensions. But this approach was fatally flawed, since databases are designed to answer questions about the past, and event processing must make decisions in the now. So, beginning in 1998, a new approach - ESP - attacked the event-processing problem afresh, introduced the first wave of commercial ESP products, and ushered in a new physics of computing.

A BAM Dashboard Isn't Enough

Figure 4

An event-driven SOA is a technical architecture that lets software systems interoperate dynamically. But an effective SOA doesn't satisfy the requirements for instant business insight alone since it lacks the ability to identify temporal and causal relationships among events in real-time. Some software vendors promote Business Activity Monitoring, or BAM, as a new means of business insight:

BAM is "a business solution that is supported by an advanced technical infrastructure that enables rapid insight into new business strategies, the reduction of operating cost by real-time identification of issues, and improved process performance."

Unfortunately vendors have used BAM as a quasi-technical banner with which to sell flashy dashboards. But serious real-time intelligence demands more than a flashy dashboard. ESP provides a computing foundation from which it can answer real-time questions about streaming data, such as:

• "How many plasma screens do we have in stock, how many have been ordered, what is our rate of consumption, and how are we doing against our forecasted rates - right now?"
• "Is bad weather forecast within 10 miles of this flight's path? If so, re-route the plane over New York, determine which passengers will be impacted by the delay, rebook the passengers, update kiosks and gate agents at all locations - and update our real-time P&L."
• "If transactions have occurred in the last five seconds against this credit card from different businesses in different physical locations deny the most recent request and alert fraud detection of the account in question."