1. A computer-implemented method for collecting event information, comprising: on one or more servers: receiving events, each having attributes; in accordance with a rule for detecting a system condition, aggregating event information for at least one attribute in a corresponding set of the received events, including: in each table of a plurality of distinct tables that correspond to the rule, each table having an associated distinct hash function, storing aggregated attribute information in rows determined by the hash function corresponding to the table; evaluating the rule separately with respect to each table, using the information in the table, to generate a plurality of intermediate results, including a respective intermediate result for each table; when the intermediate results for each table indicate a potential violation of the rule, determining if the intermediate result for each table corresponds to a same group of events and an actual violation of the rule; and producing a report in accordance with the determination.