1. A process stored in one or more data-storage devices and executed using one or more processors of a computer system to detect anomalies in behavior of a computer system of a distributed computing system, the method comprising: assigning each event message generated by the computer system to a time interval of a series of time intervals, each event message having a time stamp in the time interval the event message is assigned to; and when a most recent time interval of the series of time intervals has elapsed, calculating a difference between a set of event messages with time stamps in the most recent time interval and a set of event messages with time stamps in a previous time interval of the series of time intervals that precede the most recent time interval, and when the difference is greater than a threshold, generating an alert on an administrative computer console that indicates the computer system exhibits anomalous behavior and migrating one or more virtual machines from the computer system to another computer system within the distributing computing system.