Abstract: Detection of anomalous events in the operation of information technology (IT) components includes receiving messages, which describe events in the operation of the IT components in real time, and categorizing and condensing the messages received in a first time interval into message patterns by message pattern type. Based on a distribution of occurrences of the message patterns in the first time interval and in preceding time intervals, anomaly scores are assigned to the message patterns, and one or more of the message patterns are classified as being anomalous message patterns that correspond to potentially anomalous events in the operation of the IT infrastructure installation. A degree of correlation between occurrences of the anomalous message patterns and occurrences of application alarms is determined. Message patterns with high anomaly scores and having a high degree of correlation with application alarms are deemed significant and prioritized for display to users.

Abstract: Detection of anomalous events in the operation of information technology (IT) components includes receiving messages, which describe events in the operation of the IT components in real time, and categorizing and condensing the messages received in a first time interval into message patterns by message pattern type. Based on a distribution of occurrences of the message patterns in the first time interval and in preceding time intervals, anomaly scores are assigned to the message patterns, and one or more of the message patterns are classified as being anomalous message patterns that correspond to potentially anomalous events in the operation of the IT infrastructure installation. A degree of correlation between occurrences of the anomalous message patterns and occurrences of application alarms is determined. Message patterns with high anomaly scores and having a high degree of correlation with application alarms are deemed significant and prioritized for display to users.