A method and system for ordering and aggregating log streams. Log streams for events from different sources are received. If different sources have different recording cycles, or time epochs, that lead to different temporal granularities, then all of the log streams are combined into a single time epoch that is equal to the longest time epoch. Log streams from sources having shorter time epochs continue to retain information about their original time epochs, in order to retain information about the order of the events in those log streams. The log streams are re-ordered, both before and after being integrated into the aggregate log, by acquiring additional data from the different sources, thus permitting the likely cause/effect relationship between events.