1. A computer program product embodied in a computer readable storage device for filtering events in an information technology resource monitor, the computer program product comprising the programming instructions for: determining a present count of occurrences of an event for a present monitoring period; comparing the present count with numbers of occurrences of the event in a plurality of earlier monitoring periods; invoking a first action if the present count exceeds a predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods; and invoking a second action if the present count does not exceed the predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods.