Abstract: Methods and systems are directed to automatically analyzing the behavior of event sources, detecting anomalies in the behavior of event sources, and generating recommendations to correct the detected anomalies. An event source can be an application program, an operating system, a virtual machine, a container, or any other source of event messages in a computer system. Method quantify the event messages generated over time to form property time series data, which is metadata regarding the event messages generated by the event source. Methods compute a threshold from the property time series data. Methods detect abnormal states of the event source when property data points of the property time series data violate the threshold. A systems administrator may be notified by a property digression alert displayed on a system console. Methods also generate a recommendation to correct the anomalous behavior and optimize performance of the event source.