Novell SENTINEL 6.1 SP2 - 02-2010 User Manual page 457


"Remoting Service" on page 457

"Data Access Service" on page 457

"Query Manager Service" on page 457

"Correlation Service" on page 457

"Workflow Service (iTRAC)" on page 458

"Event Visualization" on page 458
Remoting Service
Sentinel's Remoting Service provides the mechanism by which the server and client programs
communicate. This mechanism is typically referred to as distributed object application.
Remoting Service provides the following capabilities:
Locate remote objects: This is achieved through metadata that describes the object name or

registration token, although the actual location is not required, because the iSCALE message
bus allows for location transparency.
Communicate with remote objects: Details of communication between remote objects are

handled by the iSCALE message bus.
 Object streaming and chunking: When large amounts of data need to pass back and forth
from the client to the server, these objects are optimized to load the data on demand.
 Callbacks: Another pattern and layer of abstraction built into the Remoting Service that allows
for PTP remote object communication.
 Service monitoring and statistics: This provides performance and load statistics for usage of
these remote services.
Data Access Service
Data Access Service (DAS) is an object management service, which allows users to define objects
using metadata. DAS manages the object and access to objects and automates transmission and
persistence. DAS also serves as a facade for accessing data from any persistent data store such as
databases, directory services or files. The operations of DAS include uniform data access through
JDBC.
Query Manager Service
The Query Manager Service orchestrates drill-down and event history requests from the Sentinel
Control Center. This service is an integral component for implementing the paging algorithm used in
the Event History browsing capability. It converts user-defined filters into valid criteria and appends
security criteria to it before events are retrieved. This service also ensures that the criteria do not
change during a paged event history transaction.
Correlation Service
Sentinel's correlation algorithm computes correlated events by analyzing the data stream in real
time. It publishes the correlated events based on user-defined rules before the events reach the
database. Rules in the correlation engine can detect a pattern in a single event of a running window
of events. When a match is detected, the correlation engine generates a correlated event describing
the found pattern and can create an incident or trigger a remediation workflow through iTRAC. The

"Incident response through iTRAC" on page 460

"Reporting Service" on page 462

"Advisor" on page 463

"Health" on page 463

"Administration" on page 464
Sentinel Architecture 457