1. A method to detect anomalies in behavior of a computer system, the method comprising: when each event message of a log file is generated by the computer system, assigning the event message to one of a series of time intervals based on a time stamp of each event message; and when a time interval has elapsed, calculating a difference between a set of event messages with time stamps in the most recently elapsed time interval and a set of event messages with time stamps in a previous time interval, and when the difference is greater than a threshold, generating an alert on an administrative computer console that indicates the computer system exhibits anomalous behavior.