1. A method of performing event analysis, the method comprising: receiving, from one or more logical component, one or more status messages describing a system state to form received status messages: transforming the received status messages into at least one transformed message such that the transformed message has at least one new substring which is not common with the received status messages; receiving one or more rules: applying the one or more rules to the one or more transformed status messages; and outputting at least one of a new rule and a new event.