second step compute diff between incoming log and host logs