Abstract

Monitoring LOG for abnormal events is daily business as well as tracking normal events - they give a good insight how a system performs. But what makes an event normal and when does it turn into something abnormal?