group events together which events can be filtered out and when a sufficient number of events have been accumulated to pass on to the next stage of processing in the form of an event collection 415 an event bundling policy 422 is a stored collection of rules or data that determines the behavior of event bundler 414 to adjust the behavior or performance of event bundler 414 network engineers may arbitrarily establish rules within event bundling policy 422 as a result for example event bundler 414 may use the ending of a session as a trigger to bundle together all events related to the session otherwise event bundler 414 may group events by resources used by event types or by the identity of network elements involved in the events as controlled by event bundling policy 422 event bundler 414 may also send forth groups of events representing partial or multiple sessions as shown in fig4 event collections 415 created by event bundler 414 are subsequently processed by a code let builder 416 to yield code lets 417 each code let 417 comprises recorded event data along with code that expresses processing steps useful for interpreting the event data code let builder 416 examines one or more received event collections 415 and adds executable code segments and additional data in particular code let builder 416 may conditionally add selected data and instructions executable code depending upon what event types are present in event collections 415 instructions to be added to the code let may be derived from a library 420 containing code segments or may be dynamically constructed by code let builder 416 code let builder 416 may combine data from multiple event collections 415 into a single code let 417 the behavior.