1. A computer-implemented method for troubleshooting configuration errors, comprising: obtaining a log of events which are generated as a program executes in a learning process; analyzing events of the learning process to identify recurring event sequences, each recurring event sequence includes a time sequence of multiple events; generating rules based on the recurring event sequences; obtaining a log of events which are generated as the program executes in a detection process; applying the rules to events of the detection process to determine if a sequence of events of the detection process violates at least one of the rules; and reporting an alarm based on whether the sequence of the events of the detection process violates at least one of the rules.