Abstract: In recent years,distributed computing systems become larger and more complex to control．System faults are growing exponentially,resulting in a very serious harm and loss,and problems on trouble shooting and positioning difficulty further enlarges．Traditional ways by tracking program to judge the running and correct method,using excessive consumption of the target program and invasive in distributed monitoring information interaction,has been difficult to meet the demand of software behavior analysis．Through the complex event processing in time to find and locate the fault,this need in events in a large,rapid,uninterrupted occurrence of distributed monitoring environment appears especially urgent．It can use the meaningful information state change events to analyze system behaviors,and then judge the system operating conditions,to detect fault and positioning system,ensure the healthy operation．The complex event description language is based on the SQL method to describe the complex events．This data stream query language is complex for ordinary users and difficult to master．By constructing a set based event flow model,we can use the set of events to conduct a formal definition．The user only needs to master a few simple assembly operations in order to define complex fault rule.

Key words: Distributed network,Real-time Monitoring system,Fault location