2

I'm making an application where data from a Virtual Machine that relate to CPU usage, memory usage, disk utilization, etc. are collected via an interval HTTP request every 5 seconds. The data gathered look like this:

timeStamp (long): 1533554434
memUsagePerc (double): 5.384678498028317
cpuUsagePerc (double): 24.8756219
diskSizePerc (double): 31.880938915483163
diskUtilPerc (double): 1.0505864

I created some rules on Drools Fusion trying to see the following: When the CPU usage reaches for example over 10% for the last 10 seconds, then print something on the screen, but my problem is that even though I put in the rule the command over window:time(Xs) the rule is still fired even though the X seconds have not been passed yet. Here is a rule for the CPU usage:

declare Netdata
    @role( event )
end
rule "CPU usage over 10%"
    salience -1
    when
        $cpu : Netdata(cpuUsagePerc > 10)
        over window:time (10s)
        from entry-point Netdata
    then
        System.out.println("CPU usage over 10%");
end

Netdata is the class that collects all the data from the HTTP response and creates an object every time. That object is then used by Drools Fusion. Note that a more "dummy" rule without the over window:time(Xs) part is fired, too. Also, the following error turns up on the screen, next to the over window:time(Xs): JAVA_IDENTIFIER expected, got 'window'

I'm using Drools version 5.1.1.

honk
  • 9,137
  • 11
  • 75
  • 83
csymvoul
  • 677
  • 3
  • 15
  • 30

2 Answers2

1

This is a common missconception about sliding windows. They are not fixed, they slide. This means that they will be triggered even for t < x.

As far as I know, there is no out of the box support for what you are trying to do. What I've done in the past, is to manually create a "bucket" fact to collect events and then to write rules using these buckets instead of the individual events.

Edit after OP's comment.

Some clarifications about Sliding Windows in Drools:

  • Time Sliding Windows in Drools will not wait whatever size they have been configured with before fire. For example a window like window:time (10s) should be interpreted as 0s <= t <= 10s. If you have events coming every 1s, the window will be executed at t=1, t=2, t=3, ..., t=n.
  • Sliding Windows in Drools are not discrete. They are not fixed buckets of time/size. As an example, let's suppose we have this timed window: window:time (3s). And let's assume we have events (e) coming every 1s. The window will be executed as follows: t(1):[e1], t(2):[e1,e2], t(3):[e1,e2,e3], t(4):[e2,e3,e4], t(5):[e3,e4,e5]. As you can see, the window will start "sliding" after t(3).

If what you want is to analyze discrete "buckets" of events, then you will need to create that mechanism by yourself. It also sounds weird to me for Drools to not support this kind of windows, but apparently they are not so common as the sliding ones.

Hope it helps,

Esteban Aliverti
  • 6,259
  • 2
  • 19
  • 31
  • I didn't quite understand your suggestion. My question may have not been clear enough, so I'll rephrase it. I collect data every 5 seconds and I want the rule to be triggered (the above rule) only and only if the CPU usage is over 10% for the last 10 seconds, so if the last two data collected show that the CPU is over 10%, not every time the CPU reaches over 10%. You suggest to do that outside of the rule (bucket) and then fire the rule? If Drools cannot do that, what's the point of using it in the first place? I mean that what I ask sounds pretty basic for a rules engine in my head :/ – csymvoul Aug 06 '18 at 12:25
  • Thank you very much for your response. Turns out you are right. I cannot do that with what Drools Fusion is offering, so I took your advice and created a bucket as a workaround and it works properly. – csymvoul Aug 07 '18 at 12:23
0

It should be something like:

when
    CpuThreshold( $max : max )
    Number( doubleValue > $max ) from accumulate(
    Netdata( $cpu : cpuTime ) over window:time( 5s ) )
then

More info here: https://docs.jboss.org/drools/release/6.2.0.CR3/drools-docs/html/DroolsComplexEventProcessingChapter.html#d0e10691

Radoslav Ivanov
  • 970
  • 8
  • 23