On the Semantics of Matching Trace Monitoring Patterns

Trace monitor specifications consist of a pattern that is matched against the trace of events of a subject system. We investigate the design choices in defining the semantics of matching patterns against traces. Some systems use an exact-match semantics (where every relevant event must be matched by the pattern), while others employ a skipping semantics (which allows any event to be skipped during matching). The semantics of exact-match is well established; here we give a semantics to skipping also by providing a translation to exact-match. It turns out the translation is not surjective: a pattern language with skipping semantics is strictly less expressive than one with exact-match semantics. That proof suggests the addition of a novel operator to a skipping language that makes it equivalent