1. A computer-implemented method of identifying frequently occurring episodes comprising: collecting records of events in a log file, the events representing actions taken by one or more users within a plurality of service portals; determining a window comprising a timespan; identifying, by a processor, a plurality of frequently occurring episodes represented in the log file, wherein each frequently occurring episode comprises a plurality of events occurring within the window.