Steps

A step is defined as a collection of at least two events. It must contain a start event and any number of additional event lists, one of which can be termed the end event.

[step:{start event}{event list}…{event list}]

[start event:{event}]

[event list:{event}logical operator{event}… ]

Events must occur in order for the step to occur, but other events can intervene.

An event is any triggered event on the client machine/desktop that is used to define a step. Events are used to trigger commands, and are combined into steps and processes.

An example of a screen event can be opening a specific window, entering a particular value into a data entry field on the screen, or clicking a specific button on a specific web page.

The following event types can be defined in steps:

• Start Events: A start event is a single event that begins an evaluation of the step. Once a start event is encountered, the process is underway. If the step is underway and the exact same start event re-occurs, then the step is restarted. A start event can only re-occur within a step if it is also defined as the end event in the step.

  There is no limit to the number of steps that can be initiated by the same start event. There is also no limit to the number of steps that can be started and be ‘in process’.

• Passback Events: A passback event is a particular trigger where the user wants to use the data detected within the trigger. The trigger data adds contextual information to the step in which this event occurs. A passback event does not need to be placed within an event list to pass back this data.

  The passback event elicits information on the event user, computer, date, time, and passback value. The passback value is a formatted string based on the passback values that accompany the trigger condition. The duration of a passback event is always zero.

• Event List: An event list is a collection of events combined together within a logical expression. The events within an event list are not sequential, that is they can happen in any order within the list, and once all have occurred the event list is considered completed.

  Each event list is evaluated in a strict order. If an event has no match within the current event list, it is ignored. Only after all conditions within the event list have been met will the next event list be evaluated. This allows for a level of flexibility on the approach to matching real-time events to the appropriate data stream because events can be forced to be sequential if required. But there is still flexibility included to allow non-sequential events to occur when necessary.

• End Steps: Once an end event is detected, then all steps are set back to zero, and only this end step is noted as having occurred. At this point, the duration of the step is calculated. The duration is calculated from the start of the start event to the end of the end event. In addition to duration, further event data is logged including user, computer, date/time stamp, step name, and duration.

Steps work with a detection algorithm that looks initially for start events. When a start event occurs, it opens an instance of the step and begins looking for the subsequent events. At this point if the instance is open yet no subsequent events are detected, the algorithm recognizes that there is a potential for a step, and he step instance remains open until on of the following occurs:

• The step is completed. All required events are detected, and a step record is written to the log including duration.

• Another step completes. All open steps are closed, and the ‘start step events’ are orphaned.

• The step is disqualified. The steps that contain ‘not criteria’ can be disqualified if the not condition occurs. The ‘start step event’ is orphaned.

• The start event is repeated. A new instance of the same step is opened, and the previous start step event is orphaned.

• The user logs out. The previous start step event is orphaned.

The following table outlines more complex step examples:

Step	Step Definition	Result
1	Sa=E1,E2 Sb=E1,E3 Sc=E1,E4	E1,E1,E2,E3 Step A, B, & C are orphaned and reset by the second E1** Step A occurred Step B is orphaned by Step A ending with E2 Step C is orphaned by Step A ending with E2 E3 is ignored
2	Sa=E1,E2,E3 Sb=E4,E1,E3	E1,E2,E4,E1,E3 Step A is orphaned and reset by the second E1 Step B occurs, Step A is again orphaned by Step B ending with E3
3	Sa=E1,E2,E3,E4 Sb=E2,E5,E6	E1,E2,E1,E2,E1,E2,E3,E4 Step A and B reset three times by the first three instances of E1 and E2 Step A occurs Step B is orphaned by Step A ending with E4

** Orphaned steps are described here for the purpose of explaining the detection algorithm. They are not stored and generally have no business value.