A distributed event correlation system including comprising: - a master node, and - a plurality of cluster nodes (121 a-n) in a cluster; wherein the master node comprises at least one processor configured to: - divide an event field in events into partitions including ordered contiguous blocks of values for the event field; - assign each partition to a pair of the cluster nodes (121 a-n); - determine a partition map from the partitions, wherein the partition map identifies for each partition the block of the event field values for the partition, a primary cluster node (121 a-n), and a failover cluster node (121 a-n) for the primary cluster node (121 a-n); wherein the master node further comprises a data storage to store the partition map, wherein the at least one processor of the master node is configured to store the partition map in the data storage; wherein each of the primary cluster nodes (121 a-n) comprises data storage to store events received for a partition for the cluster node (121 an), and at least one processor configured to - receive a rule for correlating events, wherein events are to be aggregated to determine whether a condition in the rule is satisfied; - receive an event for the partition; - determine whether the event is a partial match for the rule, wherein the partial match includes a partial satisfaction of the condition; - if the event is a partial match, determine whether the rule is a partition-independent rule or a partitioned rule; - if the rule is a partition-independent rule, send information for the partial match to a rule designated node to aggregate events to determine whether the condition is satisfied; - if the rule is a partitioned rule, store the event at the cluster node (121 a-n) as a partial match and aggregate events at the cluster node (121 a-n) to determine whether the condition is satisfied; - store and update an aggregation state, wherein the aggregation state includes information for the partial matches for the rule; and - send a checkpoint to a failover node for the cluster node (121 a-n), wherein the checkpoint includes the aggregation state and information for events recently received for the partition of the cluster node (121 a-n). - a master node, and - a plurality of cluster nodes (121 a-n) in a cluster; - divide an event field in events into partitions including ordered contiguous blocks of values for the event field; - assign each partition to a pair of the cluster nodes (121 a-n); - determine a partition map from the partitions, wherein the partition map identifies for each partition the block of the event field values for the partition, a primary cluster node (121 a-n), and a failover cluster node (121 a-n) for the primary cluster node (121 a-n); wherein the master node further comprises a data storage to store the partition map, wherein the at least one processor of the master node is configured to store the partition map in the data storage; wherein each of the primary cluster nodes (121 a-n) comprises data storage to store events received for a partition for the cluster node (121 an), and at least one processor configured to - receive a rule for correlating events, wherein events are to be aggregated to determine whether a condition in the rule is satisfied; - receive an event for the partition; - determine whether the event is a partial match for the rule, wherein the partial match includes a partial satisfaction of the condition; - if the event is a partial match, determine whether the rule is a partition-independent rule or a partitioned rule; - if the rule is a partition-independent rule, send information for the partial match to a rule designated node to aggregate events to determine whether the condition is satisfied; - if the rule is a partitioned rule, store the event at the cluster node (121 a-n) as a partial match and aggregate events at the cluster node (121 a-n) to determine whether the condition is satisfied; - store and update an aggregation state, wherein the aggregation state includes information for the partial matches for the rule; and - send a checkpoint to a failover node for the cluster node (121 a-n), wherein the checkpoint includes the aggregation state and information for events recently received for the partition of the cluster node (121 a-n).