Abstract: In a method and system for aggregating event information, events are received at a first plurality of nodes in a distributed system. For the events received at each node aggregated attribute information is determined in accordance with two or more rules and stored in distinct first tables, each table storing aggregated attribute information for a respective rule of the two or more rules. At each node of the first plurality of nodes, the two or more distinct first tables are transmitted to a respective node of a second set of nodes in the distributed system. At each node of the second set of nodes, two or more distinct second tables are generated by merging the aggregated attribute information in the tables transmitted to the node. Each rule of the two or more rules is evaluating using the aggregated attribute information obtained from a corresponding table of the second tables.

Abstract: In a method and system for collecting event information, XML documents specifying event parsing logic for respective groups of related events are loaded. Representations for the parsing logic contained in the plurality of XML documents are stored in one or more parsing trees. Events are received, including events in a plurality of groups of events. The received events are processed in accordance with the event parsing logic in the one or more parsing trees. The received events are also processed in accordance with stored program instructions that are independent of the parsing logic for the plurality of groups of events. Event information for the received events is stored. The stored event information includes information determined in accordance with the event parsing logic in at least one or more parsing trees.