XES Software Communication Extension Leemans, M.; Liu, C. Published: 20/11/2017 Document Version Accepted manuscript including changes made at the peer-review stage Please check the document version of this publication: A submitted manuscript is the author's version of the article upon submission and before peer-review. There can be important differences between the submitted version and the official published version of record. People interested in the research are advised to contact the author for the final version of the publication, or visit the DOI to the publisher's website. The final author version and the galley proof are versions of the publication after peer review. The final published version features the final layout of the paper including the volume, issue and page numbers. Link to publication Citation for published version (APA): Leemans, M., & Liu, C. (2017). XES Software Communication Extension. s.l.: XES Working Group. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. Users may download and print one copy of any publication from the public portal for the purpose of private study or research. You may not further distribute the material or use it for any profit-making activity or commercial gain You may freely distribute the URL identifying the publication in the public portal? Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. Download date: 04. Jan. 2018
XES Software Communication Extension M. Leemans C. Liu June 22, 2017 Documents: XES Software Communication Extension Authors: M. Leemans, C. Liu Email: m.leemans@tue.nl Date: June 22, 2017 Version: 5.2 1 Introduction and Background During the execution of software, execution data can be recorded. With the development of process mining techniques on the one hand, and the growing availability of software execution data on the other hand, a new form of software analytics comes into reach. That is, applying process mining techniques to analyze software execution data. To enable process mining for software, event logs should be capable of capturing software-specific data. In the context of multi-process and distributed software, there are multiple software applications interacting and communicating with each other. The Software Communication extension supports recording IP-based communication for relating events across software applications. Extension definition Name: Prefix: URI: XML: Software Communication swcomm http://www.xes-standard.org/swcomm.xesext <extension name="software Communication" prefix="swcomm" uri="http://www.xes-standard.org/swcomm.xesext"/> The remainder of this extension is organized as follows. In Section 2 we explain some basic terminology. In Section 3 we detail how communication is recorded. Section 4 provides an example, and the XES Extension definition is given in Section 4.1. Finally, in Section 5 provides a reference glossary. 1
2 Terminology In this extension, we will use some software-specific terminology. We provided a reference glossary in Section 5. For this extension, we will assume the use of the IP protocol. In a multi-process or distributed software application, multiple programs are collaborating. Whenever a program A is collaborating with program B, for example, to request a service, they use a communication channel. Such a communication channel is identified by two endpoints: a local and a remote endpoint. Each endpoint is described by a combination of a host and a port. For example, suppose program A runs on host 127.0.0.1 at port 9000, and program B runs on host 127.0.0.1 at port 9021. Then, when A sends some data to B, we can record two events: 1) the sending of data with local endpoint 127.0.0.1:9000 and remote endpoint 127.0.0.1:9021, and 2) the receiving of data with local endpoint 127.0.0.1:9021 and remote endpoint 127.0.0.1:9000. Observe that events can be related across applications through matching endpoints. 3 Communication Information At runtime, whenever an application communicates with another program, it does so over a communication channel. Such a communication channel is identified by two endpoints: a local and a remote endpoint. Each endpoint is described by a combination of a host and a port. Typical candidate locations for evens with communication information are sockets and other network or communication layer software code. Level Key Type Description event localhost string The local host name for the local endpoint. event localport int The local port for the local endpoint. event remotehost string The remote host name for the remote endpoint. event remoteport int The remote port for the remote endpoint. 4 Example In Listing 1 an example XES trace is given for a simple client-server application. In Figure 1, a message sequence diagram is given as a visual aid. We assume a setup with three applications: ClientA at 127.0.0.1:9000, ClientB at 127.0.0.1:9001 and Server at 127.0.0.1:9021. In this example, first ClientA, and then ClientB, performs a requestservice. At the Server, first the request from ClientB arrives, and after that the request from ClientA. Using the communication information, we can track these requests and event correlations. This example log consists of 1 trace with 8 events. 2
1) sending from ClientA to Server 3) receiving from ClientB at Server ClientA ClientB Server 1) 127.0.0.1:9000 2) 3) 127.0.0.1:9001 6) 4) 5) 127.0.0.1:9021 8) 7) Figure 1: Message sequence diagram for the events in Listing 1. The numbers 1) to 8) refer to the actual events in Listing 1. Listing 1: Example XES log for a simple client-server application. 1 <log> 2 <extension name="concept" prefix="concept" 3 uri="http://www.xes-standard.org/concept.xesext"/> 4 <extension name="software Communication" prefix="swcomm" 5 uri="http://www.xes-standard.org/swcomm.xesext"/> 6 <trace> 7 <event> 1) sending data from ClientA to Server 8 <string key="concept:name" value="requestservice" /> 9 <string key="swcomm:localhost" value="127.0.0.1" /> 10 <int key="swcomm:localport" value="9000" /> 11 <string key="swcomm:remotehost" value="127.0.0.1" /> 12 <int key="swcomm:remoteport" value="9021" /> 13 </event> 14 <event> 2) sending data from ClientB to Server 15 <string key="concept:name" value="requestservice" /> 16 <string key="swcomm:localhost" value="127.0.0.1" /> 17 <int key="swcomm:localport" value="9001" /> 18 <string key="swcomm:remotehost" value="127.0.0.1" /> 19 <int key="swcomm:remoteport" value="9021" /> 20 </event> 21 <event> 3) receiving data from ClientB at Server 22 <string key="concept:name" value="receiverequest" /> 23 <string key="swcomm:localhost" value="127.0.0.1" /> 24 <int key="swcomm:localport" value="9021" /> 25 <string key="swcomm:remotehost" value="127.0.0.1" /> 26 <int key="swcomm:remoteport" value="9001" /> 27 </event> 28 <event> 4) receiving data from ClientA at Server 29 <string key="concept:name" value="receiverequest" /> 30 <string key="swcomm:localhost" value="127.0.0.1" /> 31 <int key="swcomm:localport" value="9021" /> 32 <string key="swcomm:remotehost" value="127.0.0.1" /> 33 <int key="swcomm:remoteport" value="9000" /> 34 </event> 35 <event> 5) sending data from Server to ClientB 36 <string key="concept:name" value="handlerequest" /> 37 <string key="swcomm:localhost" value="127.0.0.1" /> 38 <int key="swcomm:localport" value="9021" /> 39 <string key="swcomm:remotehost" value="127.0.0.1" /> 40 <int key="swcomm:remoteport" value="9001" /> 41 </event> 3
42 <event> 6) receiving data from Server at ClientB 43 <string key="concept:name" value="receiveresponse" /> 44 <string key="swcomm:localhost" value="127.0.0.1" /> 45 <int key="swcomm:localport" value="9001" /> 46 <string key="swcomm:remotehost" value="127.0.0.1" /> 47 <int key="swcomm:remoteport" value="9021" /> 48 </event> 49 <event> 7) sending data from Server to ClientA 50 <string key="concept:name" value="handlerequest" /> 51 <string key="swcomm:localhost" value="127.0.0.1" /> 52 <int key="swcomm:localport" value="9021" /> 53 <string key="swcomm:remotehost" value="127.0.0.1" /> 54 <int key="swcomm:remoteport" value="9000" /> 55 </event> 56 <event> 8) receiving data from Server at ClientA 57 <string key="concept:name" value="receiveresponse" /> 58 <string key="swcomm:localhost" value="127.0.0.1" /> 59 <int key="swcomm:localport" value="9000" /> 60 <string key="swcomm:remotehost" value="127.0.0.1" /> 61 <int key="swcomm:remoteport" value="9021" /> 62 </event> 63 </trace> 64 </log> 4.1 XES Extension Listing 2: XES Extension - Software Communication. 1 <extension name="software Communication" prefix="swcomm" 2 uri="http://www.xes-standard.org/swcomm.xesext"/> 3 <event> 4 <string key="localhost"> 5 <alias mapping="en" name="local endpoint - host name"/> 6 </string> 7 <int key="localport"> 8 <alias mapping="en" name="local endpoint - port"/> 9 </int> 10 <string key="remotehost"> 11 <alias mapping="en" name="remote endpoint - host name"/> 12 </string> 13 <int key="remoteport"> 14 <alias mapping="en" name="remote endpoint - port"/> 15 </int> 16 </event> 17 </extension> 5 Glossary local The local endpoint is the current application. remote The remote endpoint is the destination application to which is communicated. host The host address identifies a machine or node. port The port is a communication endpoint, identifying a service on a host machine. 4