Programming Event Monitors

In this paper we compare two programming oriented runtime verification methods and tools for event monitoring. We study a realistic and large event-log from Nokia, used in a previous published study using a different tool (MonPoly). We formulate the same reasonably complex properties using both methods, and compare the ease with which the properties can be formulated and the efficiency with which they can be checked against the large event log. The first tool, Daut - an internal Scala DSL, was developed specifically for runtime verification. The second tool, Cobra - an external DSL, was developed for static program analysis, but could relatively easily be adapted for runtime verification. Both tools performed surprisingly well.