1. Business Monitoring Framework for Process Discovery with Real-Life Logs Mari Abe maria@jp.ibm.com Michiharu Kudo kudo@jp.ibm.com IBM Research - Tokyo

2. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 2 Outline Motivation Proposed approach Evaluation

3. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 3 Outline Motivation Proposed approach Evaluation

4. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 4 Issue 1. Log semantics is implementation-dependent Business analysts must asses whether it is possible to discover processes from their log process model & workflow engines logs Application logs EventUserTimeURLParams Customers do NOT have process model & workflow engines Customers have only an implementation of application

5. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 5 Log of Premium Calculation Application of Insurance Real-life log includes complicated correlations with different keys in different event type for process discovery The log contains valuable information for business analysis Event typeUser IDTimestampRequest URLParameters requestuser12013-08-20T08:30:33calc_premium requestuser22013-08-20T08:30:33logon responseuser12013-08-20T08:30:34pageid=“calc_premium_page”... requestuser32013-08-20T08:30:35logon responseuser22013-08-20T08:30:35pageid=“logon_page”... requestuser12013-08-20T08:30:48submit_conditionsource=“calc_premium_page”, birthday=“1965/01/01”, gender=“male” responseuser12013-08-20T08:30:49pageid=“insurance_option_page”, msg=“input options next” responseuser32013-08-20T08:30:50pageid=“logon_page”... requestuser12013-08-20T08:31:50submit_productsource=“insurance_option_page, product=“life insurance”, premium=“$50”, period=“10 years” responseuser12013-08-20T08:31:51pageid=“simulation_result_page”, msg=“need physical check-up” requestuser12013_12-20T08:32:00savesource=“simulation_result_page” 1 line # 2 3 4 5 6 7 8 9 10 11 pageid=“calc_premium_page” source=“calc_premium_page” response request 2013-08-20T08:30:34 2013-08-20T08:30:48 14 sec for calc_premium_page user1 took 84 sec for premium calculation process with product “life insurance”, premium “$50”, period “10 years” user1 pageid=“insurance_option_page” source=“insurance_option_page” product = “life insurance, premium =“$50”, period=“10 years” 61 sec for insurance_option_page (product = “life insurance”) response request 2013-08-20T08:30:49 2013-08-20T08:31:50 request response 2013-08-20T08:31:51 2013-08-20T08:32:00 source = “simulation_result_page pageid=“simulation_result_page” 9 sec for simulation_result_page

6. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 6 Issue 2. Taking Long Time for Analysis is not Acceptable for Face-to-face Meeting The customers desire to see discovered processes from the different view points of the metrics Changing and executing of the analysis program takes long time to get the new result at the face-to-face meeting interactively weekdayweekend product A Time product B Frustrating analysis! application logs analysis program1 analysis program2 analysis program3 60 minutes for changing and executing of program 60 minutes for changing and executing of program 1 st iteration 2nd iteration 3rd iteration :

7. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 7 Challenge How to define implementation-dependent log semantics as a configuration How to accelerate analysis cycle so that they can see the result from different view at the face-to-face meeting interactively Analysis Time Prior ArtBusiness Monitoring Framework Datawarehousing for process discovery Configuration for log to discover process/ calculate metrics Configuration to define correlation keys and calculate metrics Input limits to process logs generated from workflow engines Output capability for agile analysis No capability for generating process model OLAP operations for agile process analysis Limited business metrics 1st 2nd3rd... iteration Analysis Time 1st 2nd3rd... iteration

8. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 8 Our Goal and Approach Goal  Design a process discovery framework to generate event base and their query expressions with metrics for agile analysis Approach:  Employ MonitoringContext to configure correlation keys and metrics calculations  Propose runtime supporting dynamic matching between instances of monitoring contexts  Generate event base with metric annotations and their queries Proposed Runtime event base with metric annotations (MXML) query expressions with metrics (XSLT) application log Configurations (Monitoring Contexts) select synthesize review customers business analysts

9. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 9 Outline Motivation Proposed approach Evaluation

10. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 10 Components of Runtime MonitoringContext MonitoringContextManager LogReader * GenerationTemplate * Class for reading log that checks log format converts lines of log to BusinessEvents sends BusinessEvents to MonitoringContextManager Class for dispatching events Class for generating results with internal states of monitoring contexts that knows output format of event base Class for processing events that knows correlation keys, inbound/outbound events, metrics calculations, terminal conditions knows abstraction level of monitoring

11. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 11 Task Template Event Processing Flow Log logon_page Complete 2013-08-20T08:30:33.408+0900 user1... (4）Finalize a MonitoringContext instance Event base fragment of a task with metrics annotation (e.g. MXML)... Process fragment with metric annotation (e.g. MXML with reference) Monitoring ContextManager Task Context LogReader (1) Generate an event (2) Dispatch the event (3)Generate an event of higher level (4) Dispatch the event to higher level of contexts Process Context Process Template <xsl:template match= “//ProcessInstance[comment()[contains(., ‘product=productA’)]]”>... Query Template Query for event base (e.g. XSLT)...

12. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 12 Dynamic Matching Between MonitoringContext Instances Parent-child relationship is built based on inclusion relationship of correlation keys between different abstraction level task context process context userID=“user1” PageID = “calc_premium_page” correlation key Event typeUser IDParameters requestuser1 requestuser2 responseuser1pageid=“calc_premium_page”... requestuser3 responseuser2pageid=“logon_page”... requestuser1source=“calc_premium_page”, birthday=“1965/01/01”, gender=“male” responseuser1pageid=“insurance_option_page”, msg=“input options next” responseuser3pageid=“logon_page”... requestuser1source=“insurance_option_page, product=“life insurance”, premium=“$50”, period=“10 years” responseuser1pageid=“simulation_result_page”, msg=“need physical check-up” requestuser1source=“simulation_result_page” 1 line # 2 3 4 5 6 7 8 9 10 11 pageid=“calc_premium_page”... user1 source=“calc_premium_page” pageid=“insurance_option_page” source=“insurance_option_page” product = “life insurance, premium =“$50”, period=“10 years” response request response request response source = “simulation_result_page pageid=“simulation_result_page” parent child

13. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 13 Outline Motivation Proposed approach Evaluation

14. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 14 Evaluation Period of logs# of lines of logs# of metrics for task # of metrics for process instance 20 days685,318415 Goal: Test feasibility of the framework with real applications Tested data  Logs generated from applications (30 text files, 206 MB in total)  Output format: MXML with metric annotation

15. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 15 Results # of instances of task context # of instances of process context 260,56825,781 From reading log to MXML generation Query by XSLT 18.4 [min]2.7[sec] Generated context instances Process model (all log included) Execution time

16. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 16 Process Models Queried by Metrics Metric: count of help-pages accessed The result became one of data sources for customers to verify whether or not the help pages were effectively used less than 3 times 3 and more times

17. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 17 Conclusion Challenge  How to define implementation-dependent log semantics as a configuration  How to accelerate analysis cycle so that they can see the result from the different view at the face-to-face meeting interactively Goal  Design a process discovery framework for agile analysis Approach  Employ monitoring contexts to configure log analysis with metrics calculations  Propose runtime supporting dynamic matching between instances of monitoring contexts  Generate event base with metric annotations and their queries Results  The result showed 18.4 min to generate MXML file, 2.7 sec to query with a metric for real-life log  It enabled to accelerate analysis cycle

18. 2014/09/09 Monitoring Framework for Process Discovery, Mari Abe and Michiharu Kudo 18 Q&A