Abstract: In one example implementation, a log analysis system can comprise an activity engine to monitor user activity of a computer system, a baseline engine to generate an expected baseline of a log, and an abnormality engine to compare the log to the expected baseline to identify an abnormality, compare the abnormality to a user activity volume based on a correlation between the user activity volume and the log activity, and classify the log.

Abstract: In one example implementation, a log analysis system can comprise an activity engine to monitor user activity of a computer system, a baseline engine to generate an expected baseline of a log, and an abnormality engine to compare the log to the expected baseline to identify an abnormality, compare the abnormality to a user activity volume based on a correlation between the user activity volume and the log activity, and classify the log.

Abstract: Systems, methods, and machine-readable and executable instructions are provided for incident assignment. Incident assignment can include selecting a number of incidents that have been resolved, wherein the number of incidents are similar to a pending incident. Incident assignment can also include identifying a first number of users that resolved the number of incidents and a number of skills associated with the first number of users. Incident assignment can include creating a target user profile based on the number of skills. Incident assignment can include computing a distance from each of a second number of users to the target user profile, wherein the distance computation does not penalize the second number of users for being over qualified. Incident assignment can also include assigning the pending incident to a selected user from the second number of users wherein the selected user is selected based on the computed distances.