2. The automated system of claim 1 , comprising receiving computer system behaviour information over one or more periods of time, and determining which message clusters coincide with particular kinds of system behaviour.
1. An automated method, comprising: receiving event messages associated with one or more computer system event logs, each event message including event text; determining a set of message clusters, each cluster in the set identifying a template text that represents one or more event messages across the one or more event logs; assigning each received event message to a message cluster of the set according to a measure of similarity between the respective event text of the event message and the template text of the message cluster; and periodically splitting message clusters on the basis of pre-determined splitting criteria, wherein the pre-determined splitting criteria includes greater than a minimum number of event messages being assigned to a message cluster.