“…As for requirement R2, the trace checking procedure has to: 1) scale with respect to the length of the trace, because traces may contain a huge number of events, depending on the time span captured by the log, the nature of the system to which the log refers to (e.g., several virtual machines), and the types of events monitored (e.g., high-level message passing events or low-level method calls) [10]; 2) complete within practical time limits, because trace checking can be used not only for postmortem analysis, but also to enable real-time log analysis (as a complementary strategy to run-time monitoring), to promptly detect critical requirements violations.…”