Parallel Event Processing for Content-Based Publish/Subscribe Systems Amer Farroukh Department of Electrical and Computer Engineering University of Toronto Joint work with Elias Ferzli, Naweed Tajuddin, and Hans-Arno Jacobsen DEBS 2009

Motivation Event processing is ubiquitous in enterprise-scale applications (Fraud detection, Data analysis) Network security monitoring and analysis tools require Gigabit per second speed (Application-layer firewalls) Selective dissemination of information for Internet- scale applications (RSS, XML, Xpath) These systems need to support thousands of users and process millions of events Achieving Scalability and high performance under excessive load is a challenging problem Matching engine is the most computation intensive function in event processing 2 DEBS 2009

Choose an existing, powerful matching algorithm Leverage chip multi-processors Increase throughput or reduce matching time Evaluate multi-threading vs. software transactional memory 3 DEBS 2009 How to support high data-processing rates?

Outline Related work Matching algorithm Parallelization techniques Implementation and results 4 DEBS 2009

Sequential Matching Algorithms Single phase: A_TREAT [E.H., 1992] – Predicates are complied into a test network – Subscriptions may appear in one or several leaves – Poor locality, space consuming, hard to maintain Two phase: SIFT [T.Y., 2000] – Predicates are evaluated in the first phase – Subscriptions are matched in the second phase – Predicates and subscription are indexed Algorithm used: Filtering Algorithms [F.F., 2001] 5 DEBS 2009

P1P2 Price Color Quantity Ap 1 Ap 2 Ap 3 Ap 4 Ap 5 C1C2C3 C1C2 C1C2C Matching Algorithm S9 S5 S1 E 6 DEBS 2009 Phase 1 Phase 2

P1P2P1P2 Price Color Quantity Ap 1 Ap 2 Ap 3 Ap 4 Ap 5 C1C2C3 C1C2 C1C2C Multiple Events Independent Processing S9 S2 S E1E2Thread 1Thread 2 S1 S8 S7 7 DEBS 2009

P2P1 Price Color Quantity Single Event Collaborative Processing EThread 1Thread Ap 1 Ap 2 Ap 3 Ap 4 Ap 5 C1C2C3 C1C2 C1C2C S S1 S DEBS 2009

Price Color Quantity Multiple Events Collaborative Processing Group Ap 1 Ap 2 Ap 3 Ap 4 Ap 5 C1C2C3 C1C2 C1C2C S T2 T1 Group 2 T3 T P1P2P1P2 E1E2 S3 S2 S4 S7S9 1 9 DEBS 2009

Implementation Setup 10 Synchronization – Static – Locks – Software transactional memory (STM) Machine – 2.33GHz quad-core Xeon processors – 32KB L1 cache and 4MB L2 cache Workload Number of Subscriptions1M – 6M Average Predicates per Subscription10 Predicate Range Number of Events5000 Average Attributes per Event50 DEBS 2009

Multiple Events Independent Processing Analysis 11 Linear Throughput and Constant Average Matching Time DEBS 2009

Single Event Collaborative Processing Analysis 12 Lock Implementation is best Bit vector size limits scalability Lock Implementation is best Bit vector size limits scalability DEBS 2009

Multiple Events Collaborative Processing Analysis 13 Threads can be allocated based on system requirements and load DEBS 2009

Conclusions Parallel matching engine is a promising solution Over 1600 events/s with 6M subs Matching time vs. throughput Lock-based implementation is more efficient HTM is a potential candidate for enhancing speed and potential ease of implementation 14 DEBS 2009

Predicate Tables (Phase 1) PRICE EQUAL LESS GREATER NOT EQUAL 16 S1: quantity = 2, price < 30 QUANTITY12345 EQUAL LESS GREATER NOT EQUAL S2: quantity > 4, price =

DEBS 2009 Ap 1 S1S2S3 P1 S4 P2 P3 Ap 2 S5 P4 Ap N Subscription Clusters (Phase 2) 17

Time Profiling 18 DEBS 2009

Block Size 19 DEBS 2009

Subscriptions Effect 20 DEBS 2009 ME-IP SE-CP