An apparatus for transferring a first event detector process of a first node of a distributed computing system (300; 700) to a second event detector process of a second node of the distributed computing system (300; 700), the second node being different from the first node, the apparatus comprising: means for copying a process content of the first event detector process to the second event detector process; means for coordinating input events of the first event detector process such that the input events of the first event detector process are processed in parallel at both the first and the second event detector processes; and means for verifying whether the input events of the first event detector process, which are processed in parallel at both the first and the second event detector process, lead to identical output events at both the first and the second event detector processes, wherein the means for verifying is operable to shut down the first event detector process in case the output events at both the first and the second event detector processes are identical, or, to shut down the second event detector process in case the output events at both the first and the second event detector processes are not identical characterized in that the means for copying is operable to copy the process content iteratively from the first event detector process to the second event detector process, such that content which will not change during a remainder of the copying procedure is copied first, wherein the means for copying is operable to freeze process content of the first event detector at a predefined time instant before copying a last content delta and to copy the frozen last content delta from the first event detector process to the second event detector process. means for copying a process content of the first event detector process to the second event detector process; means for coordinating input events of the first event detector process such that the input events of the first event detector process are processed in parallel at both the first and the second event detector processes; and means for verifying whether the input events of the first event detector process, which are processed in parallel at both the first and the second event detector process, lead to identical output events at both the first and the second event detector processes, wherein the means for verifying is operable to shut down the first event detector process in case the output events at both the first and the second event detector processes are identical, or, to shut down the second event detector process in case the output events at both the first and the second event detector processes are not identical the means for copying is operable to copy the process content iteratively from the first event detector process to the second event detector process, such that content which will not change during a remainder of the copying procedure is copied first, wherein the means for copying is operable to freeze process content of the first event detector at a predefined time instant before copying a last content delta and to copy the frozen last content delta from the first event detector process to the second event detector process.