comptel eventlink functional description

7/23/2019 Comptel EventLink Functional Description

http://slidepdf.com/reader/full/comptel-eventlink-functional-description 1/57

Release 6.0.3

Comptel EventLink®

Joint Confidential

Functional Description



Document Version 1.0 Copyright © 1996-2007 Comptel Corporation Modified 1 November 2007

All Rights Reserved

The Comptel EventLink® Release 6.0.3 Functional Description (Document Version 1.0) gives information on the functionality of ComptelEventLink.

Contact InformationIf the information you need is not in this document, you can contact our Customer Support Services:

Phone: +358 9 694 3256Fax: +358 9 700 11 206Email: [email protected]

This service is available only to customers who have made a maintenance agreement with Comptel Corporation.

TrademarksComptel, Comptel logo, Comptel Dynamic OSS, Comptel Fulfillment Solution, Comptel Offline Mediation Solution, Comptel OnlineMediation Solution, Comptel Provisioning and Activation Solution, Comptel Convergent Mediation Solution, Comptel ConvergentCharging Solutions, Comptel Voice and Data Charging Solution, Comptel IP Prepaid Solution, Comptel Online Cost Control Solution,Comptel Rating Solution, Comptel Service Catalog Solution, Comptel Inventory Solution, Comptel Interconnect Billing Solution, ComptelRoaming Management Solution, Comptel Data Retention Solution, Comptel Number and Identifier Management Solution, ComptelTETRA Solution, Comptel EventLink, Comptel InstantLink, Comptel OnlineLink, Comptel NIMS, Comptel Inventory, Comptel IPAM,Comptel NIMA, Comptel PacketLink, Comptel ServiceLink, Comptel SMSLink, Comptel Alarm Dispatcher, Comptel BalanceManagement, Comptel GTP Collector, Comptel Lookup Server, Comptel MDS, Comptel MDS/AMD, Comptel Partner Account, ComptelRater, Comptel Notifier, Comptel Reporter, Comptel Service Catalog, EventLink Business Logic Tool, EventLink Correlator, EventLink

Developer's License, EventLink Encapsulated ARM-FR, EventLink FTP Collector, EventLink FTP Distributor, EventLink Multi-formatEncoder, EventLink Remote File Agent, EventLink Reporter, Comptel EventLink SDK, EventLink UDP Collector, EventLink UDPDistributor, EventLink User Interface, EventLink Record Correction Tool, InstantLink Business Service Tool, InstantLink Developer'sLicense, InstantLink NE Interface SDK, InstantLink Provisioning Client, InstantLink Workflow Client, OnlineLink Business Service Tool,MDS Correlator, MDS Credit Guard, MDS Remote File Agent, MDS/AMD Developer's License, MDS/AMD-DB, MDS/ARC, MDS/ARM,MDS/ARP and MDS/FTM are trademarks or registered trademarks of Comptel Corporation.

All other trademarks and registered trademarks are the property of their respective holders.

Copyright © 1996-2007 Comptel Corporation ,Salmisaarenaukio 1, FI-00180 Helsinki, FinlandNo part of this document may be reproduced, translated, or transmitted in any form or by any means, electronic or mechanical, for anypurpose without the express written permission of Comptel Corporation, and then only on the condition that this notice is included in anysuch reproduction. No information as to the contents of this document may be communicated to any third party without the prior writtenconsent of Comptel Corporation.

Information in this document is subject to change without notice and does not represent a commitment on the part of ComptelCorporation. Comptel Corporation is not liable for errors contained in this document or for any incidental or consequential damages inconnection with furnishing or use of this material. This document is not part of a contract or license save insofar as may be expresslyagreed in writing.

Comptel’s software is protected by copyright laws. Comptel has also sought patent protection for its solutions. Comptel is continuouslykeeping up with the patenting activities within its field of business. Comptel respects the intellectual property rights of third parties andnever wilfully infringes patents owned by third parties.

Abst ract



Joint Confidential

Comptel EventLink® iiRelease 6.0.3Functional Description


All Rights Reserved

1 About This Document 1

1.1 Audience 1

1.2 Typographic conventions 1

1.3 Terms and concepts 1

1.3.1 Abbreviations 1

1.3.2 Terminology 2

1.4 Related documentation 6

2 Introduction to Comptel EventLink 7

3 Architecture 9

3.1 Node 9

3.1.1 Node package 12

3.2 Data transmission between nodes 13

3.3 Process stream 13

3.4 Node Manager 13

3.5 System database 14

3.6 System tools 14

3.7 Lookup Server 15

3.8 In-memory Storage 16

3.9 EventLink Business Logic Tool 18

3.10 EventLink Record Correction Tool 21

3.11 System distribution on multiple host environment 22

3.11.1 Scalability 23

3.12 User interface (UI) 25

3.12.1 Logging into EventLink User Interface Framework 28

4 Node Functionality 30

4.1 Data collection 30

4.2 Data decoding 30

4.3 Business logic 30

4.3.1 Validation 30

4.3.2 Filtering 30

4.3.3 Enrichment 31



Joint Confidential

Comptel EventLink® iiiRelease 6.0.3Functional Description


All Rights Reserved

4.3.4 Duplicate and sequence checking 31

4.3.5 Aggregation 31

4.3.6 Correlation 35

4.3.7 Supporting functions 35

4.4 Backing up data 36

4.5 Data encoding 36

4.6 Data distribution 36

5 Process Stream Functionality 38

5.1 Starting up a process stream 38

5.2 Data processing 38

5.3 Rejected data storage 38

5.4 Reconfiguring process stream 41

5.5 Stopping process stream 41

5.6 Fault tolerance and error recovery 41

5.7 Data safety and commit processing 42

5.8 System cleanup 43

6 Audit Information 446.1 Collected information 44

6.2 Monitoring operational statistics 45

6.3 Host statistics 46

6.4 Running standard reports 48

6.5 Customising audit trail functionality 49

6.6 System logs 50

Document Index 52



Joint Confidential


All Rights Reserved

Comptel EventLink® 1Release 6.0.3Functional Description

1 About This Document

This document describes the Comptel EventLink system core and its subsystems and

components.

1.1 Audience

This document is intended for anyone who wants to have an overview of the Comptel

EventLink system core, subsystems, components and functionality.

1.2 Typographic conventions

The following text styles identify special information used in the document:

1.3 Terms and concepts

The following abbreviations, terms and concepts are used in the document:

1.3.1 Abbreviations

Italics Italicised text is used to call attention to cross-references.

Bold Bold text is used for presenting:

• field names• menu item names

• page names

Note Notes are written between two lines to call attention to important

issues.

Cour i er Cour i er font is used for presenting:

• user input in, for example, commands, parameters and field values

• messages shown to the user

ASCII American Standard Code for Information Interchange

ER Event Record

GRC Global Resource Configuration

NE Network Element

OSS/BSS Operations and Business Support System



Joint Confidential


All Rights Reserved


1.3.2 Terminology

aggregation The function of grouping and joining together records which are

similar in format and come from one source (network element).

Aggregation criteria (joined per day, per call, per…) can vary. A

specific case of aggregation is the combining of long-durationcalls, which is based on flag and sequence number input by the

switches.

Audit Plug-in An implementation for the Audit Plug-in Framework that enables

interfacing of Comptel EventLink to an external data repository

that utilises audit data provided by Comptel EventLink.

Audit Plug-in Framework A framework for enabling development, implementation and use of

Audit Plug-ins for integration of Comptel EventLink with external

data repositories that utilise audit data provided by Comptel

EventLink.

audit trail A record of transactions in an information system that provides

verification of the activity of the system.

batch mode An operational mode for usage data processing.

Usage data is processed in batch files at specified intervals instead

of being processed as individual records like in real-time mode.

block of event records A group of event records that Comptel EventLink processes at a

time. The collector nodes define the size of the event record blocks.

In file based processing, the block typically equals the records in a

single collected file.

business logic Rules according to which a system processes requests, events or

event records and interfaces with external applications.

business logic node A node typically between decoder and encoder nodes that is

specialised in a mediation function, such as validation, enrichment,

correlation or conversion.

Business Logic Tool Node A Comptel EventLink node that consists of a business logic created

with EventLink Business Logic Tool and an EventLink Rule

Engine that executes it.

Business Logic Tool user

interface

The graphical user interface of EventLink Business Logic Tool for

business logic creation.

collector node A network element or application server interface for usage data

collection.

A collector node receives the usage data either as files (batch

mode) or event records (real-time mode).

Comptel Alarm Dispatcher A Comptel module that receives alarm events from Comptel

products (for example Comptel EventLink, Comptel InstantLink,Comptel OnlineLink, and Comptel Incatel NIMS), converts the

alarm events to alarm notifications and dispatches them to the

operator’s alarm system.



Joint Confidential


All Rights Reserved


Comptel EventLink A software product that manages batch and real-time data streams

and controls data collection, storing and processing routines in a

communication network.

Comptel EventLink is able to operate between any two systems

that need to communicate with each other but cannot be directly

integrated with one another. In most cases, Comptel EventLink

operates between the communications network producing usage

data and the destination OSS/BSS systems utilising this

information framework, such as billing systems, fraud management

systems and statistical analysis systems.

Comptel Lookup Server A module enabling enrichment in the mediation stream.

Lookup Server is used in Comptel EventLink business logic and

provides a mechanism, for example, for mapping field values or

adding data into an ER based on the keys in the ER.

Lookup Server reads lookup tables from an Oracle database or

from flat files and stores the data in a shared memory segment of a

host, from which various business logic nodes can access the data.Comptel Reporter A solution for storing data and organising it into summarised

reports.

Comptel Reporter is a reporting product used with the Comptel

EventLink and Comptel InstantLink systems. Comptel Reporter

provides a framework for a long-term centralised storage for a

large amount of detailed data, thus enabling historical analysis and

queries.

Comptel Reporter uses Comptel EventLink event records or

Comptel InstantLink requests, tasks and statistical information as

the reporting data.

correlation The function of joining together event records that can be different

in format and usually come from different sources or the

information of such event records.

decoder node A node specialised in decoding certain data formats that contain

ERs, such as XML, log files or ASN.1, into Comptel EventLink

internal data format for further processing.

distributor node A target system specific interface for event record delivery and

sometimes formatting. The target system of a distributor node is

typically an OSS/BSS system.

encoder node A node that encodes the event records from Comptel EventLink

internal format into a certain type of output data, such as ASN.1,

XML or ASCII.

enrichment A function of populating ER field values based on external data.

EventLink Backup Node A node used for backing up collected and distributed files in

Comptel EventLink.

EventLink Business Logic Tool A business logic configuration tool for Comptel EventLink.

EventLink Business Logic Tool has a graphical user interface for

developing and testing business logic, and deploying business logic

to Comptel EventLink.

EventLink Cleanup Node A node used for cleaning up the Comptel EventLink database.



Joint Confidential


All Rights Reserved


EventLink Duplicate Checker

Library

A library used to detect that a file or a record has already been

processed by Comptel EventLink and to prevent that the system

does not process duplicates.

EventLink Duplicate Checker Library is part of EventLink In-

memory Storage.

EventLink File Duplicate and

Sequence Checker Node

A node used to detect duplicate files and files that are missing from

a sequence or arrive out of sequence.

EventLink In-memory Storage A framework used for storing and retrieving event records and the

related data into an in-memory relational database.

In-memory Storage includes:

- SQL interface library

- EventLink Aggregation Library

- EventLink Correlation Library

- EventLink Duplicate Checker Library

- EventLink File Duplicate and Sequence Checker Node

- EventLink In-memory Storage Maintenance Node

- EventLink Sequence Checker Library

- EventLink Temporary Record Storage Library

EventLink Record Correction

Tool

A record correction tool for Comptel EventLink.

EventLink Record Correction Tool has a graphical user interface

for developing, testing and executing correction rules to repair

rejected records.

EventLink Rule Engine

Library

A generic rule processing component used, for example, in ASN.1

decoding and encoding and in executing logic made in EventLink

Business Logic Tool.

EventLink Sequence Checker

Library

A library used to check file and record sequences.

EventLink Sequence Checker Library is part of EventLink In-

memory Storage.

EventLink Temporary Record

Storage Library

A library used for storing and retrieving event records and the

related data into an in-memory relational database.

Temporary Record Storage Library can be used, for example, in

building business logics for customised aggregation and

correlation.

EventLink User Interface

(Framework)

A framework into which the user interface modules of Comptel

EventLink subsystems are plugged.

event record; ER A data record produced from a service usage event.

Event records can be used for various purposes such as accounting,fraud management or statistical analysis.

ERs can be produced, for example, by network elements or other

systems.

File Transfer Protocol; FTP A communications protocol governing the transfer of files from

one computer to another over a network.

GRC file A text file used by all Comptel products for storing permanent

configuration information.

interaction history A datastore that lists the transactions made by users. Interaction

history can be used to verify the activity of the system.



Joint Confidential


All Rights Reserved


lookup table A table with external reference data that is used for data

enrichment.

A typical lookup table contains search and return values.

Lookup tables are maintained by the end customer.

network element Network devices that control network operations, includingswitching and transport.

Example network elements include HLR, GPRS Charging

Gateway, MSC and SMSC.

node A generic name for an independent Comptel EventLink module

that implements one or multiple mediation functions, such as

collection, decoding, validation, filtering, encoding or distribution

of event records.

Comptel EventLink's nodes include, for example, modules

specialised in collection from Cisco NetFlow or FTP based

collection, decoding and encoding of XML and ASN.1 data and

implementation of business logic.

A node consists of an application and application-specific

configuration.

A node package always contains node configuration. It can also

contain one node application, depending on the node. It can even

contain node libraries, the number of which is not limited.

node application package Installation package for the application (non-customisable) part of

a node.

Node Base A shared library, which provides the basic standard functionality

for node applications.

Node Base handles the internal usage data transmission mechanism

between the nodes and encodes the internal usage data.

node configuration package Installation package for the configuration (customisable) part of a

node.

node library package Installation package containing reusable libraries for augmenting

node application and/or configuration functionality.

Node Manager A component responsible for managing nodes residing in a single

host.

Node Manager's functions include starting up, shutting down,

monitoring and configuring nodes and collecting audit information

from them.

node package A package that contains all the necessary components for a fully

functional node.

The package always contains node configuration. It can also

contain one node application, depending on the node. It can even

contain node libraries, the number of which is not limited.



Joint Confidential


All Rights Reserved


1.4 Related documentation

For more information on Comptel EventLink, see Comptel EventLink Release Notes.

Operations and Business

Support System; OSS/BSS

A program that helps an operator monitor, control, analyse or

manage usage of a communications network.

OSS/BSS systems include, for example, systems for customer care,

order management, billing, relationship management, decision

support, market analysis, fraud detection, traffic engineering and

network planning.

The individual properties of each OSS/BSS system determine what

kind of requirements the customer sets for the Mediation and

Provisioning Systems: how and in which format the Mediation

System should deliver usage data and what services the

Provisioning System should activate for subscribers.

process stream A chain of nodes that are linked together and are responsible for

collection, delivery and different data processing tasks.

Process streams are created and configured by Comptel

Corporation or the user.

proprietary data node A node located between a collector and a decoder node or between

an encoder and a distributor node, or both.

real-time Always-on collection, processing and delivery of usage data with

low latency time.

In a real-time mode, the data goes through Comptel EventLink as a

continuous data stream.

rejected data storage A node specific storage in which the rejected event records are sent

and which is maintained from EventLink User Interface.

Event records in the rejected data storage can be reprocessed,

corrected and reprocessed, or simply deleted.

stand-alone node A node, for example, an internal cleanup node, that monitors an

external process.

subsystem A self-contained hardware or software component that interactswith a larger system.

A system or product can contain several subsystems. For example,

Comptel EventLink system core, EventLink Business Logic Tool

and Comptel Lookup Server are subsystems of a product called

Comptel Eventlink.

system database A database containing configuration and audit trail information for

all the nodes and Node Managers in the system.

transport node A Comptel EventLink component which transfers data from one

host to another in a distributed environment.

There are two types of transport nodes: sender and receiver

transport nodes.



Joint Confidential


All Rights Reserved


2 Introduction to Comptel EventLink

Comptel EventLink is a mediation solution that is designed to work in scheduled, file-

based mode and in real-time mode. Usage data is collected as real-time as the network

elements can provide it. Collection can be done from any 2G, 2.5G, 3G, IP, fixed-line,satellite or service providers’ networks.

When processing data, Comptel EventLink collects event record (ER) files from

different data sources. The collection process can be configured either so that

Comptel EventLink constantly checks for new files to collect and process or so that it

schedules the collection to take place at certain days and times. One process stream

can work both in file-based and real-time mode.

Comptel EventLink can also receive data constantly from a source through, for

example, a network socket connection. Thus data is passed through different phases

of the mediation instantly and not in big files, for example. After the data has been passed through the mediation, it can be immediately distributed to the destination

system. Alternatively, it can be distributed later as files using a configured schedule.

Comptel EventLink modifies the data to a format understood by the system receiving

the data. This system may be any OSS/BSS system (billing system, cost control, fraud

detection, customer analysis, traffic analysis, revenue sharing, and so forth). Comptel

EventLink offers means for modifying the data. Modification of data consists of basic

mediation functionality such as correlation, aggregation, formatting, validation and

enrichment.

Comptel EventLink consists of the system core, which provides basic platform formediation, and different node applications that carry out the actual collection,

modification and distribution tasks. The system core is scalable for existing and new

node applications to be able to use it effectively. In addition, the system core allows

that node applications are distributed to different hosts but can still be configured and

monitored centrally. Also, there is no single point of failure, which means that node

applications as well as all the components of system core can run independently so

that having problems, such as a broken database connection or hardware failure in

one part of the system, does not prevent other components from operating normally.

For more information on the architecture, see Chapter 3 Architecture.



Joint Confidential


All Rights Reserved


The Comptel EventLink system is configured through EventLink User Interface,

which can also be used for monitoring the whole system, viewing audit information

on the data processing and creating reports about the events handled by Comptel

EventLink. EventLink User Interface Framework is a common attachment point for

the different user interface (UI) modules, offering various services for the modules.

Figure 1. Comptel EventLink in the telecommunications network



Joint Confidential


All Rights Reserved


3 Architecture

Comptel EventLink collects usage data from any type of network element, packet or

circuit switched, and distributes the usage data to any Operations and Business

Support System (OSS/BSS) in real-time. Figure 2 shows the high-level architectureof Comptel EventLink:

Figure 2. High-level architecture of Comptel EventLink

Comptel EventLink is modular in its architecture. It consists of several main

components, each specialising in a particular task in the system. This is to provide

flexible configuration with building blocks and to ensure that even if one component

was temporarily unavailable, all other components would be able to continue

normally. Naturally, a component that has failed unexpectedly is unable to feed data

to the next component but the next component itself is not harmed in any way.

For the detailed architecture of Comptel EventLink, see Figure 6 .

3.1 Node

Comptel EventLink consists of a number of nodes controlled by Node Manager,

which resides on the same physical host with the nodes. Nodes collect usage data

from network elements and process it. Nodes work independently as they are not

dependent on the status of Node Manager or other nodes after they have been

successfully started.

All nodes belong to a process stream. A process stream usually consists of severalnodes. The number of nodes in a process stream or the number of process streams in

the system is limited only by the capacity of the system hardware.

A typical configuration of a process stream consists of the following nodes:

• one collector node for each source network element

• optionally, an unlimited number of proprietary data nodes between the collector

node and the decoder node

• one decoder node for each network element type

http://-/?-

http://-/?-

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


• one or more business logic nodes containing validation, aggregation and

enrichment

• one encoder node for each destination data format

• optionally, an unlimited number of proprietary data nodes between the encodernode and the distributor node

• one distributor node for each destination system

Figure 3 shows a basic Comptel EventLink process stream containing seven nodes:

Figure 3. Seven nodes in a basic process stream configuration

The collector node processes usage data as soon as it is available or when scheduled.

Any number of collector nodes can be run to collect data for one process stream. Each

collector node can have its own schedule.

The proprietary data node between the collector node and the decoder node can be

used optionally to process raw and unparsed data. File duplicate checking is an

example task of a proprietary data node.

The decoder node, business logic node and encoder node process the data stored inER blocks as soon as the blocks are available.

If required, another proprietary data node can process the encoded data, for example,

by compressing it before it is sent to the distributor node.

Finally, the distributor node sends the processed data to the designated target system.

Each distributor node can have its own schedule.

A stand-alone node resides in its own process stream and performs scheduled

maintenance tasks, for example cleanup tasks. The ‘Clean Up Node’ and ‘In-memory

Storage Maintenance Node’ are stand-alone nodes.

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


Figure 4 shows an example of one process stream containing three different collector

nodes for three different network elements. The proprietary data nodes are scalable,

which means that the number of nodes that are executed can be defined from the UI.

Figure 4. Three collector nodes in a process stream configuration

Figure 5 shows an example of one process stream containing two different business

logic nodes, of which the lower one uses EventLink In-memory Storage (the database

icon) and has rejected data storages (the arrow icon). In addition, the left-hand side of

the business logic node’s icon is dark red, which means that more than 100% of the

user-defined node buffer threshold for the input has been used. The colour of the left-

hand side of the node icon varies according to the size of the node buffer threshold.

The encoder node has a green colour, which means that less than 50% of the user-

defined node buffer threshold for the input has been used. Other possible colours of

the left-hand side of the node icon are grey, yellow and red.

Figure 5. Business logic node uses EventLink In-memory Storage, has rejected

data and has used more than 100% of the user-defined node buffer threshold for

the input. The encoder node has data buffered in front of it but the amount of

data is less than 50% of the user-defined node buffer threshold for the input.

http://-/?-

http://-/?-

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


Each node in the process stream provides detailed information on itself to Node

Manager at regular intervals using the controlling and monitoring interface. For

example, information on the number of ERs processed and the way in which they

were processed is provided to Node Manager. In addition, if something unusual

happens, an info, warning or error message is sent to Node Manager. For moreinformation on the error message levels, see Comptel EventLink Reference Manual

and Comptel EventLink Online Help.

Figure 6. Detailed architecture of Comptel EventLink

3.1.1 Node package

A node package contains all the necessary components for a fully functional node:

• node configuration package, which is an installation package for the configuration

(customisable) part of a node

• depending on the node, one node application package, which is an installation

package for the application (non-customisable) part of a node

• possibly an unlimited number of node libraries, which are installation packages

containing reusable libraries for augmenting node application or configuration

functionality, or both



Joint Confidential


All Rights Reserved


3.2 Data transmission between nodes

All usage data transmitted between two nodes is buffered into the file system. This

ensures that no data is lost in case of failures. If the data is received from source

network elements faster than it can be processed, the buffers also automatically act as

load handlers as they are able to store the data to be processed later. In such cases, the processing always starts from the oldest data and the newest data is processed last.

3.3 Process stream

A process stream is a processing entity, which usually consists of more than one node.

The configuration of the process stream determines the order of the nodes in the

process stream. The user creates and maintains the process stream and its

configuration, which can be modified at all times. All the configurations are stored

inside Comptel EventLink using version management so that the user can re-employ

old configurations, if necessary. A new version of a process stream can be made

without interfering production.

3.4 Node Manager

Node Manager is responsible for managing nodes on one host. This includes starting

up, shutting down, monitoring and configuring nodes and collecting audit

information from them using the controlling and monitoring interface.

Other responsibilities of Node Manager are:

• getting information on the configuration from system database

• waiting for commands given from the UI or command line system tools and

acting upon them

• installing node applications and configurations from system database while

starting up

• informing nodes of their processing schedules while starting them up

• actively monitoring nodes that it manages

• automatically restarting nodes which have failed for some reason

• collecting audit data, messages sent by nodes and storing them in system database

• sending alarms, raised by any anomalies or error situations during the processing

phase, to the configured network management systems by using Comptel AlarmDispatcher

• automatically recovering from lost database connections

• executing and monitoring the correction rules



Joint Confidential


All Rights Reserved


3.5 System database

System database is the heart of Comptel EventLink as it contains all configuration

and operational information on the system, for example, the configuration, system

monitoring and audit trail of all the nodes and Node Managers. The status information

of all individual nodes is stored to the system database from where the information iscollected and shown in the UI. The status can also be seen using system tools from

the command line.

3.6 System tools

System tools is a command line interface (cli) used for configuring, managing and

monitoring the system. The system tools are:

• System Monitoring tool. The tool is used for:

º getting information on the states of process streams and nodes in them

º getting information on the progressing of the process streams

• System Management tool. The tool is used for:

º giving orders to process streams and nodes, for example, to start, to stop and

to switch to another version

• Order tool. The tool is used for:

º listing all process stream orders, their IDs, order type, status, process stream

name and node name

• Aborting Order tool. The tool is used for:

º aborting process stream or node orders that are currently in progress

• Configuration Installation tool. The tool is used for:

º installing new mediation functionality modules, for example, a new collection

protocol

º importing and exporting customer-specific configurations

• System Cleanup tool. The tool is used for:

º cleaning up and archiving old contents of the Comptel EventLink systemdatabase

System tools can be used either in interactive menu mode or directly from the

command line. The command line system tools enable files to be run in the

background. User authentication of the system tools is handled by the UNIX

operating system.



Joint Confidential


All Rights Reserved


3.7 Lookup Server

Comptel Lookup Server is a subsystem of Comptel EventLink which provides a

mechanism for looking up data from the lookup tables stored in the Oracle database

tables or UNIX files and placing them in the memory of a host, where a client can

read them. The clients can be, for example different nodes, which all make lookups tothe same lookup table data. Comptel Lookup Server supports large amounts of data

and performs lookups quickly.

Comptel Lookup Server client is a dynamically loaded library module which can be

used to extend a node’s functionality.

Comptel Lookup Server is used for storing data into the shared memory. The node

does lookups to the stored data using the lookup client module. Figure 7 shows the

Comptel Lookup Server client as a dynamically loaded library module:

Figure 7. Comptel EventLink nodes using Comptel Lookup Server

There are two types of lookup tables: normal and compact, of which normal lookup

tables have more features than compact lookup tables but use much more memory

and are slower to load.• normal lookup table:

º A normal lookup table consists of fields, some of which can be defined as key

fields used for searching and other fields that are used for return values. The

search keys are either of type mat ch or l i mi t s. A mat ch key is a string that

is compared against the search value. A l i mi t s key is a pair of numeric

values in which the search value matches with the limits if its value is between

the upper and lower key values.

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


º An additional search mode can be defined for both key types. The search

mode can be exact , l ongest , any or l ongest +any. The exact mode

means that the search value must match with the key exactly. In the l ongest

mode, the key that has the longest matching substring is the match. The any

mode is used if a match is not found. In such a case, the default value can bereturned from the lookup table. In the l ongest +any mode, the l ongest and

any modes are combined in such a manner that the l ongest longest mode is

used first and if no match is found, the default value is returned if it is present.

• compact lookup table

º In a compact lookup table, fields are not separated to key and return fields.

Instead, the fields that are used in searches are simply marked as indexed. In

searches, fields are compared with search values with such operators as =, >

and <=. Both mat ch and l i mi t s type of functionality can be used by

combining the search criteria. The additional search modes that are available

for normal lookup tables cannot be used with compact lookup tables.

º Compact lookup tables are very suitable for holding customer reference data,

such as IMSI and MSISDN. The compact lookup tables are highly optimised

for fast lookups using as little host memory as possible.

Whenever lookup tables are updated, Comptel Lookup Server must be asked to reload

them. This can be done either using the Lookup Server UI module (for more

information, see Comptel Lookup Server User’s Guide) or by issuing the l s_ admi n

command from the command line (for more information, see Comptel EventLink

Operation and Maintenance Guide).

After the reload, the clients that were using the old lookup table keep using it, unless

they update the new one into use. All new clients use the new reloaded lookup table.

Comptel Lookup Server can alert client processes about shared memory updates in a

way defined in the GRC file. Typically, it is a script that issues a signal to the client,

which is attached to the memory, that a lookup table has been reloaded and a memory

segment needs to be updated.

The command line client, l s_cl c, is a tool which can be used to access the Comptel

Lookup Server lookup tables from the command line. It can be used, for example, to

test the Comptel Lookup Server installation or to retrieve data from the ComptelLookup Server lookup tables in shell scripts. For more information on the use of the

l s_cl c tool, see Comptel EventLink Operation and Maintenance Guide.

The Lookup Parameters module is used for defining and maintaining the contents of

the lookup tables. For more information on Comptel Lookup Server’s UI modules,

see Comptel Lookup Server User’s Guide.

3.8 In-memory Storage

EventLink In-memory Storage is a subsystem of Comptel EventLink used for storing

and retrieving ERs and the related data into an in-memory database.



Joint Confidential


All Rights Reserved


EventLink In-memory Storage includes:

• in-memory relational database (Oracle TimesTen)

• SQL interface library

• EventLink Temporary Record Storage Library

• EventLink Aggregation Library

• EventLink Correlation Library

• EventLink Duplicate Checker Library

• EventLink File Duplicate and Sequence Checker Node

• EventLink In-memory Storage Maintenance Node

• EventLink Sequence Checker Library

Figure 8. In-memory Storage

The in-memory database is used in applications through EventLink Temporary

Record Storage Library, which contains both the Direct SQL layer and Temporary

Record Storage layer. The functionality is available for both perl and C applications.

The SQL interface library is the basis for all the components using EventLink In-

memory Storage. EventLink Temporary Record Storage Library is built using the

SQL interface, EventLink Aggregation Library, EventLink Correlation Library,

EventLink Duplicate Checker Library and EventLink Sequence Checker Library in

turn use Temporary Record Storage interface. The libraries are bundled so that the

SQL interface is together with EventLink Temporary Record Storage Library in a

single library package, and other libraries are packed separately. EventLink In-

memory Storage Maintenance Node and EventLink File Duplicate and Sequence

Checker Node are also packed separately.



Joint Confidential


All Rights Reserved


The application can use both the Direct SQL interface and Temporary Record Storage

interface at the same time, even to manage the same database tables, since the

interfaces share the connection and the resources to access the data store.

Each node using EventLink Temporary Record Storage Library connects to a singlein-memory data store. The node inserts, updates and deletes data from the data store

based on the record data that it processes. The changes to the data store are commited

at the same time when Node Base commit occurs – in most cases when the input file

has been completely processed.

This ensures that the data being processed in the stream does not become out of sync

with the data inside the data store. EventLink Temporary Record Storage Library

automatically manages the audit data belonging to the records, ensuring that audit

reporting is consistent.

EventLink Temporary Record Storage Library is configured with either a

configuration file containing descriptions of each record type that is managed or the

rule set can at runtime describe the record types. The library then creates database

tables based on the configuration or verify that the given configuration matches the

tables already in the data store.

EventLink Duplicate Checker Library is used to detect duplicate records and files,

and EventLink Sequence Checker Library to check file and record sequences.

3.9 EventLink Business Logic Tool

Note The read-only mody of EventLink Business Logic Tool is delivered in thestandard Comptel EventLink installation. The edit mode, which contains the

right to modify the business logics, requires a separate license.



Joint Confidential


All Rights Reserved


Business Logic Tool is a graphical business logic configuration tool for Comptel

EventLink. Business logic consists of rules according to which ERs collected from

the network are processed (see Figure 9). With Business Logic Tool, operators can

save operational costs by developing and maintaining business logic configurations

by themselves.

Figure 9. EventLink Business Logic Tool

Business Logic Tool consists of the Business Logic Tool user interface and the

EventLink Rule Engine. The Business Logic Tool user interface is used for

developing business logic configurations that the EventLink Rule Engine executes,functioning as a node application within Comptel EventLink.

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


Figure 10 shows an example of EventLink Business Logic Tool user interface:

Figure 10. Business Logic configuration in EventLink Business Logic Tool user

interface

Figure 11 shows an example of a View Rule page in EventLink Business Logic Tool

user interface:

Figure 11. View Rule page in EventLink Business Logic Tool User Interface

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


Figure 12 shows an example of a View Test Results page in EventLink Business

Logic Tool user interface:

Figure 12. View Test Results page in EventLink Business Logic Tool User

Interface

All configurations made with Business Logic Tool, including the business logic, are

saved as node configurations in Comptel EventLink. Comptel EventLink database

stores all Business Logic Tool configurations. Like other Comptel EventLink nodes,Business Logic Tool Nodes are controlled by Node Manager through the node base.

In Comptel EventLink, a business logic configuration is closely linked with the

structure of the process stream to which it belongs. The input and output data formats

defined for the business logic restrict where it can be placed in the process stream.

Business logic configurations can be exported and imported from one Comptel

EventLink environment to another. They can be moved from one host to another (for

example, to a different Comptel EventLink installation).

Note Perl and C business logic nodes can be used along with Business Logic Tool Nodes in the same Comptel Eventlink process streams.

3.10 EventLink Record Correction Tool

Note EventLink Record Correction Tool requires a separate license.

EventLink Record Correction Tool is a graphical record correction tool for Comptel

EventLink. With EventLink Record Correction Tool, the operators can easily develop

rules to correct rejected recods.EventLink Record Correction Tool consists of the user

interface that is used for viewing and developing correction rules that ComptelEventLink executes (see Figure 13).



Joint Confidential


All Rights Reserved


Figure 13. EventLink Record Correction Tool

The EventLink Record Correction Tool user interface is used for developing

correction rules and bringing them under Comptel EventLink version control.

Versioned correction rules are saved in the Comptel EventLink database.

3.11 System distribution on multiple host environment

A process stream can be distributed to multiple hosts if the collection of ERs is

feasible to take place near the respective network elements. Also higher performance

can be achieved when the task of a process stream is distributed to multiple hosts. In

addition, a spare host can be a created and taken into use should the original host

become dysfunctional.

When a process stream is distributed to multiple hosts, each host has its own Node

Manager that controls the nodes on that host. Usage data is transmitted from one host

to another by automatic transport nodes divided into sender and receiver processes.

The sender process resides on a host that sends information and the receiver process

resides on a host that receives information.

The data is transmitted between the sender and receiver processes with a proprietary

protocol over TCP/IP. Optionally, the transmitted data can be automatically

compressed during the transfer.



Joint Confidential


All Rights Reserved


Figure 14 illustrates the distribution of the system to three hosts:

Figure 14. Comptel EventLink distributed to three different hosts

3.11.1 Scalabi lit y

Usage data transmission and processing in Comptel EventLink is highly scalable. The

system can be configured to use several processors on a single host. If the processing

power of a single host is not adequate, the system can be distributed to several

physical hosts.

In a multiple host environment, each host has its own Node Manager that controls the

nodes on that host. The system automatically takes care of transmitting usage data

from one host to another.

A single process stream in Comptel EventLink scales up in three different ways:

1. Sequential nodes within a process stream work concurrently in a pipeline

manner: while a business logic node is processing a record block decoded

earlier, the decoder node is already decoding the next received record block,

etc.

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


2. A single node usually can utilise a single CPU within the host. If a node or

nodes within a process stream are unable to keep up with the ER flow, the user

can configure the mediation process to use more than one CPU by multiplying

the bottleneck nodes. Comptel EventLink takes care of automatic load

balancing between the parallel nodes by dividing a task of one node betweenseveral nodes (see Figure 15). In such a case the nodes can be seen as one

node in the UI but each of the them can be configured separately and data

streams from each network element can be directed to separate nodes.

Figure 15. Enhancing the capacity of process stream by dividing a task of a node

between several nodes

Note When multiplying mediation processes, the order of ERs is not

guaranteed.

3. If resources of a single host computer are not sufficient, the process stream

can be configured to span to multiple hosts. In such a case, Comptel

EventLink takes care of sending the data to the host where the data is to be

processed next. The number of hosts in Comptel EventLink is not restricted

and each node in a process stream can reside on a separate host.

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


These methods of scaling up can be freely combined with each other, as seen

in Figure 16 . The capacity of a process stream can be enhanced by dividing a

task of a node between several nodes (node 2) the task of another node (node

3) between several nodes, etc.

Figure 16. Enhancing the capacity of a process stream

3.12 User inter face (UI)

The UI of Comptel EventLink uses an Apache web server included in the installation

packages. The Apache web server is used as the normal HTML/HTTP server that all

clients (web browsers) connect to. Apache also executes the PHP scripts of the UI.

If SSL is used, Apache provides the SSL connection.

User names and access rights are maintained through EventLink User Interface

Framework. For more information, see EventLink User Interface Framework Online

Help.

The user can, for example, start up, shut down and configure the process streams

through the UI of Comptel EventLink. The UI also includes a set of predefined web

pages for audit data reporting.

All other installed subsystems have a menu item of their own in the UI.

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


Figure 17 shows the internal functionality of the user interface (UI) of Comptel

EventLink:

Figure 17. Detailed structure of the UI of Comptel EventLink

The numbered items in Figure 17 are:

1. User interface calls, the browser sends parameters.

2. Apache calls and relays parameters.

3. EventLink User Interface Framework parses the incoming HTTP request from

Apache and calls proper module functions if the HTTP request is for a plug-in

module. If the request does not match any of the modules, the main template

is filled up with default values. In both cases the resulting HTTP response is

sent to the Apache to be sent to the browser

4. All modules attached to the system can use database services offered by

EventLink User Interface Framework.

5. Each module has its own independent functionality. All modules use their

own templates to produce HTML, which is returned to EventLink User

Interface Framework.

6. EventLink User Interface Framework receives HTML from the selected

module, fills in the main template and sends the web page to the browser via

Apache.

7. Apache statically supports retrieval of link files, images, Javascript and

Cascading Style Sheets.

http://-/?-

http://-/?-

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


Figure 18 shows an example of the Comptel EventLink System Overview page in the

UI. For more information on the Comptel EventLink UI module, see Comptel

EventLink Online Help.

Figure 18. Comptel EventLink System Overview page in the UI

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


3.12.1 Logging into EventLink User Interface Framework

To access EventLink User Interface Framework, the users need to have the following:

• user account in EventLink User Interface Framework

• URL to connect to EventLink User Interface Framework

To access EventLink User Interface Framework

1. Type the following URL into the Address or Location input field of the

Internet browser: ht t ps: / / <your . host . com>: <por t >

Note If SSL has not been installed, the address above is ht t p: / /

<your . hos t . com>: <por t >

2. Substitute <your . host . com>with the name or IP address of the host intowhich the user interface was installed. The <por t >is the port number the

server is configured to use. The default port number is 55555.

Note If the users’ browsers show a security alert when they contact the

WWW server, see EventLink User Interface Framework Online Help

for more information on the required certificates.

3. After you have typed the right URL, the Login page opens:

4. Enter your user ID and password.

Note If the EventLink User Interface Framework administrator has changed

the password, you are forced to change the password when logging in

the next time.

5. Click Login. After you have logged in successfully, the EventLink User

Interface Framework main page opens.



Joint Confidential


All Rights Reserved


Note For more information on the use of EventLink User Interface

Framework, see EventLink User Interface Framework Online Help.



Joint Confidential


All Rights Reserved


4 Node Functionality

In Comptel EventLink independent modules implement one or multiple mediation

functions, such as collection, decoding, validation, filtering, encoding or distribution

of ERs.

4.1 Data collection

Comptel EventLink collector nodes can interface with any network, which can be 3G,

2.5G, 2G, IP, fixed-line or satellite, or with a content and services platform. They

collect ERs from the network as a continuous real-time data stream or as files. File-

based collection can be either continuous or schedule-based. Continuous collection

means that Comptel EventLink constantly checks for files to collect. Schedule-based

collection means that files are collected at certain times, for example, every Tuesday

at 2, 3 and 4 am. The schedules of process streams and nodes can temporarily be

suspended, for example, for maintenance purposes.

EventLink FTP Collector Node in a process stream collects files from a remote host

to a local host with FTP or Secure FTP (SFTP) protocol or collects files from the

local file system. With FTP Collector Node it is possible to write customised file

handling rules to transfer files.

4.2 Data decoding

The collected data is decoded into Comptel EventLink internal record representation

for further processing by one or several nodes. Several different binary and ASCII

formats, BER encoded ASN.1 and XML formats are supported, as is parsing of

human-readable log text files.

EventLink ASN.1 Decoder Node and EventLink MDS ARM-FR Decoder Node are

used for decoding collected input files into Comptel EventLink internal data format.

4.3 Business logic

Business logic in Comptel EventLink means the rules according to which requests,

events or ERs and interfaces are processed with external applications.

4.3.1 Validation

After the ERs have been collected, Comptel EventLink examines and analyses thecontents in them by operator-specific business rules. It checks that all values included

in the ER fields are applicable and in a correct format. If necessary, it joins fields and

inserts additional values into them.

4.3.2 Filtering

An ER that is omitted and not sent to further processing. The ER is not stored in any

file or storage, only an audit counter is incremented.



Joint Confidential


All Rights Reserved


4.3.3 Enrichment

During data processing, it is sometimes necessary to enrich ERs, which means that

data from external systems, such as subscriber information, is combined with ER

data. This is done by inserting or updating data in the ER according to a predefined

set of keys and their return values. These keys and return values are maintained in alookup table with columns and rows. Each column specifies a key or a return value

and each row is represented by a combination of values for the keys and return values.

Nodes are responsible for the actual searching of the data. Comptel Lookup Server

only gives the node a pointer to the shared memory block where the actual data and

indexes for the data are stored. All lookup tables can be used by all the nodes at the

same time.

The actual data used for enrichment is stored either in input files in certain specified

format or in database tables. Which is used depends on:

• the client system sending the data

• the performance requirements for reading the data

• whether the data is maintained through the user interface

The data can be either imported periodically from an external system or maintained

through the user interface.

4.3.4 Dupl icate and sequence checking

If a duplicate checker has been added in Comptel EventLink and Comptel EventLink

receives ERs from the network, it can check them for duplicates and verify theirsequence. By doing this, it ensures that the numerous ERs come into the system in the

correct order and that none of them is missing or delayed or tries to enter the system

for the second time.

4.3.5 Aggregation

When aggregating, Comptel EventLink creates summary records from a number of

input records from the same network source. Aggregation thus allows the OSS/BSS

systems to receive only one billable ER from each service usage. An example of

aggregation is the combining of partial record from long duration calls. After the

records have been combined, over-aged ERs are flushed. Statistical data is collected

according to predefined variables.

EventLink Aggregation Library is responsible for creating summary records of

sessions or calls in the input data. This is done according to predefined aggregation

rules (aggregation schemes). EventLink Aggregation Library uses EventLink

Temporary Record Storage Library as its partial storage.



Joint Confidential


All Rights Reserved


General principles of aggregation

The input records of a call or connection (events) to be aggregated are grouped

together based on their event key and record type (optional). An event key is a set of

one or more record fields that identify an event. The type of the input record (recordtype), if used, is taken from the output type audit field of the input record.

An input record that belongs to a long event (partial) is first prepared by the

aggregation library before it is sent (checked in) to be aggregated. The aggregation

library collects the key fields and locates the event that matches to the event key.

If a matching event was found, the incoming partial is aggregated to the existing

partial event, if possible, and stored to the partial storage where it waits for the rest of

the event partials to arrive. If no matching event is found, the partial is inserted to the

partial storage and it is kept there for the rest of the event partials to arrive.

All event partials are kept in the partial storage. There are three ways in which the partials can be removed:

• event is completed

• event expires based on its age or its limit

• partial storage is flushed

The actual rules of the event completion vary between aggregation schemes, and the

only common rule of completion for all aggregations is the possibility to define a

limit that is inspected at check-in time (completing limit).

If the value of the completing limited field in currently checked-in partial or the

outcome of the aggregation is higher than or equal to the value defined for the limit,

the event partial is completed and handed back to the business logic node during the

check-in.

Another way to remove a partial from the partial storage is to have it expired based on

its age (flushing). The flushing is based either on the real start time of the partial or an

artificial time (reference time) that can be freely defined for each partial. If both the

reference time and the start time are available, the reference time is used during the

flushing.

Similarly, as there is a completing limit that is inspected during the check-in, it is also

possible to define a limit for one or more of the fields in the partial that is inspected

only during the flushing. With limit-based expiration, the partial is flushed when a

field value equals to or exceeds the limit value even if the partial would not expire

based on its age. The partial expiration requires that the partials have either the

reference time or the start time defined.



Joint Confidential


All Rights Reserved


When an expired or completed partial or a completed event is detected, it is removed

from the partial storage and made available for the node as an output record. Some

partial fields can be configured, for example, to be summed up or to contain the

minimum, maximum, chronologically first or chronologically last value. All such

operations have already been handled by the aggregation library during theaggregation process. The resulting values are stored in the output record.

The fields that have an additional operation configured or are required by the

aggregation operation are called active fields. The fields that do not have any

operations configured and are not necessary from the aggregation process point of

view are called passive fields. They are taken from the chronologically first partial

based on time stamps.

Aggregations schemes

Aggregation Library provides four aggregation schemes:

• basic aggregation scheme

• extended aggregation scheme

• time based aggregation (long call combining)

• sequence number based aggregation (long call combining)

In an aggregation scheme, a completing limit or flush time limit must be defined to

send the event to charging. Expired partials can sent for charging.

The basic aggregation library scheme supports the aggregation of one event within

a set of call event references. The event partials are aggregated in the order of theirarrival. The partial that arrives first is used as a basis for the fields of the complete

record.

In the extended aggregation library scheme, event partials are aggregated in

chronological order based on their time stamps.

Long call combining is a more specific case of the basic aggregation. It has clearly

defined rules when two partials may or may not be aggregated together and when the

event becomes complete during the check-in.

The leading partial of a long call is called the first partial and the very last partialthat the network element creates for a long call is called the last partial. All partials

between the first partial and the last partial are called intermediate partials. The

creation of new intermediate partials is started each time the configurable time limit

in the network element is exceeded.

Some network elements generate a running sequence number for the partials of a

connection that usually starts from 1 and ranges up to total number of partial in the

connection. Some network elements create repetitive first partials during a

connection. Therefore, a partial type called the potentially first partial has been

added to the aggregation library to handle the first partials that may exist within the

session.



Joint Confidential


All Rights Reserved


The logic how the different kinds of partials are recognised is defined in the

equipment vendor specifications. Because of that, the logic varies from case to case.

Long call aggregation schemes are able to detect and reject incoming partials that

overlap with partials that have already entered the aggregation library based onoverlapping time or sequence numbers of the partials. In addition, a long call

aggregation scheme is also able to detect and reject incoming partials that could be

aggregated with a partial in the partial storage but where conflict of partial types

prevents the aggregation of the partials.

Time stamp based aggregation aggregates the partials in chronological order based

on the timestamps in the partials. The time stamp based aggregation requires that the

reference time, if configured, start time and either duration or end time information

exists in the partial. The scheme configuration parameter is used to define whether the

existing end time of the partials is taken from the partial or whether it is calculated by

summing up the start time and duration. If the required duration or end time field ismissing, the check-in function returns an error indication to the node implementation.

Sometimes the time stamps of the long event partials do not run in a smooth

sequence. Therefore, a value called maximum difference can be defined for the time

stamps. The maximum difference tells to the aggregation library how many seconds

the two partials can slip apart or overlap each other for them to be still aggregated.

In addition to the reference time or the start time, the long call aggregation requires

that the partials have the partial type, possible partial sequence number and duration

and/or end time defined.

Sequence number based aggregation aggregates long event partials in the order of

the partial sequence numbers issued by the network equipment. Only the reference

time or, if no reference time has been configured, the start time, sequence number and

either duration or end time are required to be present in the partials. The sequence

number flow must also be configured for the events if this aggregation method is

used.

In the long call aggregation, an event may have more than one partial in the partial

storage waiting to be aggregated. The event partial in the partial storage is a partial

that presents a group of partials that the library has already been able to aggregate

together (aggregated partial).

If a matching event is found from the partial storage at the check-in, the partials of

that event are checked one by one to see if the incoming partial can be aggregated

with the current partial or partials in the partial storage. If no matching event is found

at the check-in, the event partial is inserted to the partial storage.

The currently incoming partial may have been a partial that is a missing link between

two intermediate partials or even a missing link between the first and last partials.

Because of that, the aggregation library does an iterative aggregation attempt after

each successful aggregation to find out whether the repetitive aggregation or even a

completion of an event would be possible.



Joint Confidential


All Rights Reserved


The following presents different possibilities for aggregation:

• aggregation of a first partial and an intermediate partial results in a first partial

• aggregation of an intermediate partial and an intermediate partial results in an

intermediate partial• aggregation of an intermediate partial and a last partial results in a last partial

• aggregation of a first partial and a last partial results in a complete event, which is

removed from the partial storage and handed back to the node implementation as

an output record

• ‘potentially first partials’ are handled as first partials unless they exist in the

middle of the long call due to sequence number wrap-around, in which case they

are handled as intermediate partials

NoteAggregation schemes detect the single partials and remove them immediatelyto the business logic.

4.3.6 Correlation

Also correlation involves the combining of ERs but the ERs to be correlated come

from different sources and are in different formats. The ERs may come at the same

time from both access network and content platforms, which is the case in a content

usage session.

The purpose of correlation is to gather all charging information into one or more

correlated ERs, which can be distributed to the Operations and Business Support

System (OSS/BSS). The information is typically divided into two logical elements:

• session information, referred to as session records

• service information, referred to as service records

Session records provide the identity of the user (for example, username or IMSI) as

well as session start time, end time and session identification. The session record may

also list the network traffic usage during the session.

Service records provide information on the usage of various services. For example,

MMS usage records from an MMSC network element. Correlation provides means to

combine different kinds of records based on certain key field values in the ERs.

EventLink Correlator Node is typically used in joining S-CDRs and G-CDRs from

GPRS network or IN and MSC records.

4.3.7 Supporting functions

EventLink Node Extensions provides supporting functions for date and time

validation and manipulation, as well as string manipulation. These functions can be

used in the business logic written in Perl.



Joint Confidential


All Rights Reserved


4.4 Backing up data

All files running in a process stream can be backed up to a local host or to a remote

host with FTP or Secure FTP (SFTP) protocol. The backing up process is

implemented as parallel backup, where a copy of the output files from the previous

node is configured from UI to be sent to EventLink Backup Node, which then backsup the data.

You can define the following:

• If the backed-up files are compressed or not

• If, in addition to the original backup file, a flag file marking a successful transfer

is created. The new file name gets a suffix and the file contains the backed-up file.

The new file is stored in the destination directory after a successful transfer.

• The backed-up files can be automatically deleted after a certain time or when the

number of files exceeds a certain limit.

When backed-up files need to be reprocessed, EventLink FTP Collector in local

collect mode is used. The user manually uncompresses the backed-up files and puts

them into the polled directory, where the system automatically processes them.

4.5 Data encoding

Before distributing the fully processed ERs to the OSS/BSS systems, Comptel

EventLink converts them into formats compatible with these systems. Comptel

EventLink is able to convert the ERs either to a standard format or to operators’

proprietary formats. Several different binary and ASCII formats, BER encoded

ASN.1 and XML formats are supported. Due to formatting, an OSS/BSS systemreceives all usage information from the network in a uniform, predefined form.

EventLink ASN.1 Encoder Node is used for encoding Comptel EventLink internal

data format records into deliverable output files.

EventLink Multi-format Encoder Node is used for encoding ERs in Comptel

EventLink internal format into ASCII or binary format for target systems, for

example, billing or fraud.

4.6 Data distribution

Comptel EventLink is able to simultaneously interface with multiple different OSS/

BSS systems. Even though it performs all its collection and other processes in real-

time, it is able to distribute the processed ERs to the OSS/BSS systems either through

a configured real-time protocol or a file-based batch interface.

File-based distribution can be configured to occur immediately when the data has

been processed or it can be scheduled to happen at certain points of date and time, as

with collection.



Joint Confidential


All Rights Reserved


EventLink FTP Distributor Node is used for ER delivery in Comptel EventLink. FTP

Distributor Node is used to distribute files generated by EventLink to specified target

systems with FTP or Secure FTP (SFTP) protocol. Also, FTP Distributor Node

distributes files to the local file system.



Joint Confidential


All Rights Reserved


5 Process Stream Functionality

In Comptel EventLink each component has a specific role and works independently

once started. Comptel EventLink consists of a process stream that usually includes

more than one node. The nodes are managed by Node Manager, which interacts withsystem database. UI is used for configuring and controlling the system core.

5.1 Starting up a process stream

When the user starts up a process stream, all associated Node Managers read the

process stream configuration from the system database and start up the process

stream, which consist of nodes.

5.2 Data processing

The process stream keeps processing data until the user shuts it down. The usage data

flows between the nodes in ER blocks. Each node checks its input data sourcesconstantly for new blocks to be processed. When a new block is detected, it is

immediately processed and distributed to the output destination.

5.3 Rejected data storage

Nodes in Comptel EventLink process streams handle invalid data in two different

ways:

• Nodes that process data in Comptel EventLink internal format reject event

records (ERs) to rejected data storages. Each node can have any number of

rejected data storages and they are identified with the name of the storage.

• Nodes that process data in some other format discard data to the node's discardeddata directory. The whole input file can be discarded or the node discards only

parts of the file, for example, invalid fixed size blocks in a decoder.

Figure 19 shows the storages for discarded files and rejected data in a process stream.



Joint Confidential


All Rights Reserved


Figure 19. Discarded and rejected data in Comptel EventLink

The rejected data storages are divided into one-hour time slots. A time slot is defined

by the collection time of the input file. This means that different parts of an input file

are always rejected to the same time slot even if the rejection occurs in different

nodes.

Each input file has its own rejected file in each storage if the node has rejected some

data from the file to the storage. However, no rejected data file is created if no records

are rejected.

Figure 20 shows the division of rejected data storages in one-hour time slots.

Figure 20. Rejected sotrages divided in one-hour time slots



Joint Confidential


All Rights Reserved


Each rejected data storage can be configured to be automatically reprocessed at

certain intervals for a number of times. The user can also manually start reprocessing

a selection of the rejected data, take the rejected data offline for further analysis or

repair the rejected records with EventLink Record Correction Tool.

The user can define the following settings for the rejected data storages:

• alarm limit for the ERs

• maximum number of automatic reprocessing retries for each rejected ER before it

gets the status Retry limit reached. The minimum value is 1 and the maximum

value 9999.

• interval in hours after which the reprocessing is performed. The minimum value is

1 and the maximum value 48. Automatic reprocessing occurs on the hour.

• priority that the reprocessing gets in relation to normal data processing. Possible

values are :• Prior to new data

º Normal priority

º When idle

When a node reprocesses the data from rejected data storages, it gathers all data that

needs to be reprocessed at that time and moves it to the Reprocess In data buffer.

After this the data gets reprocessed according to the priority.

The correction procedure selects the files that need to be corrected and runs the

correction process on them. The original rejected data files are copied to a backupstorage to store a full audit trail of the correction procedure.

When the correction procedure is committed, the corrected files are copied over the

old rejected data files. The files can be reprocessed after that. If the correction

procedure corrected the files successfully, the data gets processed by the node.

Command line tools are available for converting the rejected usage data into format

that is easy to read and, if necessary, to modify for reprocessing purposes.



Joint Confidential


All Rights Reserved


Figure 21 shows the correction process in detail.

Figure 21. Correction process of rejected data

5.4 Reconfiguring process stream

Implementing configuration changes (for example, business logic changes, adding or

removing network element collectors, upgrading components) to a process stream can

be done without disturbing the production environment via the UI. This is done in a

separate workspace within the same environment.

The user can choose when to reconfigure the process stream into a new version from

the UI. The system then stops and starts only those nodes in the process stream that

are affected by the changes. The user can also change back to any previous version

that has not been already cleaned up.

5.5 Stopping process stream

The process stream stops processing data when the user gives a stop stream command

through the UI or with a system tool. If the whole system needs to be shut down, it is

done from the command line.

The processes can be stopped either immediately or after all usage data in a process

stream has been processed.

5.6 Fault tolerance and error recovery

The Comptel EventLink components are designed to stay operational independent of

each other. If the system components cannot communicate because of, for example,

network problems or hardware failure, the information they need to exchange is

buffered to the file system. Once the communication is re-established, the buffers are

processed and the system resumes normal operation.



Joint Confidential


All Rights Reserved


The usage data in a process stream is transmitted from one node to another in data

blocks. A node processes data blocks received from the previous node one-by-one.

Once the whole block has been processed, the resulting output block is forwarded to

the next node and the processed input block is removed. At this point the node

commits all changes and synchronises files to the file system. If the processing isinterrupted because of an error situation, the input block stays in the file system. After

the error situation has been corrected, the node starts to process the input block again.

This ensures that no data is lost or duplicated in error situations. The nodes also

operate independently. This means that a problem in one node does not affect the

other nodes.

5.7 Data safety and commit processing

Data in Comptel Eventlink flows through the process stream inside internal data files.

Correct, atomic commit processing ensures that no file is handled twice and that no

files are lost if an unexpected system error occurs. Because audit information and

other messages from business logic are important for Comptel EventLink as well,

they must not be lost or duplicated either.

Comptel EventLink bases the data processing on input files. A node can have one

input file processed at a time, and when an input file is opened, it is locked until the

processing is complete. The file is locked to prevent other nodes from accessing it

while it is being processed, ensuring that is not processed twice. After the input file

has been successfully processed and related output records and audit data has been

written, it is deleted as a part of the atomic commit process. When preparing for the

commit, Comptel EventLink flushes all relevant data (data records, audit data and

messages) to disk, and marks them as complete but not collectable. A list is made ofall the files on disk that are to be collected after a successful commit and after the list

has been written to disk, the commit is complete and recoverable even if an

unexpected system error occurs.

There are two separate cases when the recoverability of the commit is considered:

• An unexpected system error occurs before the commit point. When Comptel

EventLink is started for the first time after the unexpected system error, there may

be files left from the previous run that are complete but not collectable. These

files are deleted and the input file is processed again.

• An unexpected system error occurs directly after the commit point. Duringrecovery, Comptel EventLink reads the list of files and completes the rest of the

commit by making the files collectable and deletes the input file.

In either case, no records or audit data is forwarded from the node until a commit has

successfully completed.

If Comptel EventLink uses an external data storage (for example, a database) that

involves transactions based on the input data, the node application functionality can

be extended to move the commit point information to the external data storage,

ensuring that both the external storage and Comptel Eventlink data are atomically

committed at the same time with a two-phase commit mechanism. The two-phase



Joint Confidential


All Rights Reserved


commit mechanism moves the control of the atomic commit to the external data

storage, because usually the external system's commit cannot be controlled. Before

the external system is committed, Node Base executes procedures for the first phase

of the commit, including flushing all file buffers, creating a list of files to be removed

after successful commit, and so forth. Information on the state of Node Base is storedinto the external storage before it commits. This information is used in Node Base

recovery if the node fails unexpectedly. If the external storage's commit is successful,

Node Base executes the second phase of the commit and finalises all output files. If

the commit is unsuccessful, Node Base rolls back any changes and returns to the state

before the commit process was started. If at any time during the commit processing

the node crashes or connection to the external system is lost, the state of Node Base

can be automatically and completely recovered with the information stored to the

external system and with the status information Node Base stored to disk during the

first phase of the commit.

5.8 System cleanup

System cleanup is an integral part of Comptel EventLink. EventLink Cleanup Node

can be scheduled to do maintenance cleanup in the Comptel EventLink internal data

stores at certain intervals. The removed data can be backed up in a directory

configured by the user. The configurable parameters are the same as the System

Tools’ Cleanup functionality.

Cleanup Node must be configured to:

• Clean up the orders issued through the user interface or with Comptel EventLink

System Tools.

• Clean up the offline data. The offline cleanup moves rejected records older than

the given number of days from the rejected data storages to the offline directory,

which has been specified during the installation of Comptel EventLink.

• Clean up all info, warning and error messages.

• Clean up audit information. The audit trail data is removed but a backup file of

the deleted data is created in the current directory where Cleanup Node is run, if

required.

• System Statistics information. The data is automatically cleaned up by Node

Manager.



Joint Confidential


All Rights Reserved


6 Audit Information

Comptel EventLink enforces strict audit trail by collecting detailed information on

the usage data processing. Each node provides a standard set of audit counters per

processed data block. Statistics about the collected ERs can be read and standardreports can be run through the UI.

6.1 Collected information

The following standard information, depending on the node's business logic

functionality, is collected:

• the collected file names

• the distributed file names

• the collected file sizes

• the distributed file sizes

• the time of collected information

• the time of distributed information

• the discarded bytes from a collected file

• the number of ERs read

• the number of ERs read for reprocessing

• the number of ERs filtered

• the number of ERs rejected

• the number of ERs reduced in operations where records are consumed (for

example, because of aggregation or correlation)

• the number of ERs duplicated

• the number of new ERs created

• the number of ERs stored into the internal storage

• the number of ERs retrieved from the internal storage

• the number of ERs written out



Joint Confidential


All Rights Reserved


6.2 Monitor ing operational stat istics

The System Overview page in the UI shows in near real-time how the usage data

flows through the Comptel EventLink system. The counter statistics can be monitored

on process stream or node level. Figure 22 shows an example of the Comptel

EventLink Operational Statistics for Process Stream page in the UI.

Figure 22. Comptel EventLink Operational Statistics Stream page in the UI

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


6.3 Host statistics

Comptel EventLink provides statistics about host CPU load and disk space.

The Host CPU Load Statistics page shows the host CPU load statistics during the past

1-48 hours (user can select suitable time) and lists the load averages for 1, 5 and 15minutes.

Figure 23 shows an example of the Host CPU load statistics page in the UI:

Figure 23. Host CPU load statistics page in the UI

The purpose of disk space statistics is for the administrator/user to be able to see the

trend of disk space usage. If the Control Interface, Data Buffering or Internal Storage

gets full, the production stops. The Host Disk Space Statistics page shows the disk

space statistics for all the directories during the past 1-48 hours (user can select

suitable time).

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


Figure 24 shows an example of the host disk space statistics page in the UI:

Figure 24. Host disk space statistics page in the UI

For more information on host CPU load and disk space statistics, see Comptel

EventLink Online Help.

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


6.4 Running standard reports

Audit information helps with building a clear picture about the usage data flow within

the system.

The system provides reports about the whole system, a process stream or a singlenode, depending on the time period defined by the user.

This information is stored to the system database for generating various reports in the

UI. The information is also available for external applications. A monthly report is a

summary of a longer period of time and a daily report of one day.

File based reports show how data from individual input files has been written to

output files.

Figure 25 shows an example of a Comptel EventLink standard report. For more

information on standard reports, see Comptel EventLink Reference Manual andComptel EventLink Online Help.

Note A separate product, Comptel Reporter, can be integrated into Comptel

EventLink to get detailed reports from the system.

http://-/?-

http://-/?-



Joint Confidential


All Rights Reserved


Figure 25. Processing Overview Report page in the UI

6.5 Customising audit trail functionality

It is possible to customise the level of details, collected information and audit trail

data storage and distribution of Comptel EventLink.

By default, the audit system in Comptel EventLink automatically collects audit

information, for example, on the following details:

• input file

• output file

• rejected store

• original record type

• output record type

• a rough time period when the record was processed



Joint Confidential


All Rights Reserved


In the business logic configuration, it is possible to add additional detail levels. These

additional detail levels are freely definable, and can be ER content-specific.

Examples of additional detail levels:

• service ID

• content type

• outgoing route

• price class

The default audit functionality collects information only on a number of ERs that

have passed through each node. It is possible for each business logic node to collect

additional, content-based, data for auditing purposes on the defined level of detail.

For example:

• the earliest and latest call end time

• minimum and maximum duration

• sum of prices

Because of the detailed audit trail recording level, the amount of audit data easily

grows very large. The solution for this is to write custom audit plug-ins in order to be

able to store all audit trail data as efficiently as possible. The audit plug-ins are

connected to Node Manager. The plug-ins can be freely defined on how to aggregate

and store the audit trail data, for example:

• aggregating data by reducing some system-generated keys

• storing the data into one or more customer-specific database tables

• writing the audit data into files for loading into Comptel Reporter

6.6 System logs

In addition to monitoring Comptel EventLink actions in the user interface, it is also

possible to see a detailed system execution trace log on, for example, Node Manager

and Node Base operations, together with node parameters and all abnormal events.



Joint Confidential


All Rights Reserved


In addition, it is possible to view the log files of both Node Manager (Node Manager

Log) and all the individual nodes (Node Diagnostic Files). Each Node Manager in the

system provides the contents of these files to the UI.

Figure 26. Log browsing in the user interface



Joint Confidential



All Rights Reserved

Document Index

A

aggregation 31

aggregations schemes 33architecture 9audit information 44audit trail 2

B

backing up data 36 basic aggregation library scheme 33 block of event records 2 business logic 30 business logic node 2Business Logic Tool user interface 19

C

collection 30collector node 2Comptel EventLink

importing and exporting business logic 21correlation 35

D

data

aggregation and correlation 31 backing up 36collection 30correlation 35decoding 30distributing 36duplicate and sequence checking 31encoding 36enrichment 31filtering 30validation 30

data decoding 30data format 21data processing 38

data safety and commit processing 42data transmission between nodes 13database 21

tables 18decoder node 3distribution 36distributor node 3duplicate and sequence checking 31

E

encoder node 3enrichment 31

error recovery 41

event record 4EventLink Aggregation Library

overview 31EventLink Business Logic Tool 18EventLink Record Correction Tool 21EventLink Rule Engine 4, 19extended aggregation library scheme 33

F

fault tolerance 41filtering 30functionality 30, 38

G

general principles of aggregation 32

H

host statistics 46

I

In-memory Storage 16

L

logging into user interface 28long call combining 33

Lookup Server 15

M

monitoring 45multiple hosts 22, 23

N

NE - definition 1node 5, 9

actions 18 Node Base

commit 18 Node Manager 5, 13node package 12

O

operational statistics 45Oracle TimesTen 17

P

process stream 6, 13reconfiguring 41startup 38

stopping 41



Joint Confidential


processing data 38

R

real-time 6reconfiguring

process stream 41recovering from errors 41rejected data storage 38reports 48rule set

EventLink Temporary Record Storage Library 18

S

scalability 23sequence number based aggregation 34standard reports 48

starting up process stream 38

stopping

process stream 41system cleanup 43system database 6, 14system distribution 22

system tools 14

T

Time stamp based aggregation 34transport node 6

U

user interface 25

V

validation 30

comptel eventlink functional description

Documents