1. A method of detecting abnormal system states in computers, comprising: receiving snapshots from a plurality of software agents respectively residing on a plurality of computers within a population of computers, the snapshots including data indicating the state of respective ones of the plurality of computers; automatically generating an adaptive reference model comprising a rule set customized to characteristics of the population of computers, the rule set being developed by identifying patterns among the snapshots from the plurality of computers, the adaptive reference model being updated upon receipt of respective snapshots from the plurality of computers, and being modified to account for known trouble conditions within the population of computers; and comparing a snapshot from at least one of the computers to the adaptive reference model to determine whether an anomaly is present in the state of the at least one of the computers.