Abstract: Diagnostic events can be collected on electronic devices at geographically distributed service centers and transmitted to a remote (e.g., network-based) diagnostic service. The diagnostic service can aggregate and analyze the diagnostic events to determine, for example, one or more possible causes of the diagnostic events, and can provide information or guidance to users and/or service personnel for characterizing, resolving or explaining the diagnostic events. In one aspect, log files of diagnostic events captured on devices are sent to the diagnostic service. For each log file, the diagnostic service can compute frequencies of recorded diagnostic events. The computed frequencies can be compared against accepted and/or expected values generated from reference data. The diagnostic service can respond to users and/or service personnel with information or guidance for resolving, characterizing or explaining the diagnostic event based on a result of the comparisons.