1. A computer program product for identifying correlations between events recorded in a system log of a computer, the recorded events generated by a plurality of processes executing on the computer, the computer program product comprising one or more non-transitory computer readable storage medium and program instructions stored on at least one of the one or more non-transitory computer readable storage medium, the program instructions comprising: program instructions to partition, by the computer, a system log into a plurality of segments, each segment associated with a characteristic found in an event, each segment including one or more events having a same characteristic value; program instructions to select, by the computer, a plurality of attributes of the one or more events in a segment, wherein the plurality of attributes do not describe an action of the event; program instructions to generate, by the computer, one or more distinct n-grams, each distinct n-gram including the selected attributes from successive events within the segment, wherein a distinct n-gram is distinct from all other generated n-grams; program instructions to identify, by the computer, a correlation for each first selected attribute of each of the successive events of an n-gram with all other second selected attributes from each of the successive events of the n-gram; program instructions to generate, by the computer, a correlation metric as a function of the number of correlated first selected attributes and the total number of selected attributes of each of the successive events of the n-gram, wherein the program instructions to generate the correlation metric include: program instructions to increment, by the computer, a count of n-gram instances in which the first selected attribute of each of the successive events of the n-gram correlates with one of the second selected attributes of each of the successive events of the n-gram; and program instructions to divide, by the computer, the count by a total number of possible correlations between the first selected attributes and the second selected attributes; and program instructions to record, by the computer, the correlations for each first selected attribute.
1. A computer program product for identifying correlations between events recorded in a system log of a computer, the recorded events generated by a plurality of processes executing on the computer, the computer program product comprising one or more non-transitory computer readable storage medium and program instructions stored on at least one of the one or more non-transitory computer readable storage medium, the program instructions comprising: program instructions to partition, by the computer, a system log into a plurality of segments, each segment associated with a characteristic found in an event, each segment including one or more events having a same characteristic value; program instructions to select, by the computer, a plurality of attributes of the one or more events in a segment, wherein the plurality of attributes do not describe an action of the event; program instructions to generate, by the computer, one or more distinct n-grams, each distinct n-gram including the selected attributes from successive events within the segment, wherein a distinct n-gram is distinct from all other generated n-grams; program instructions to identify, by the computer, a correlation for each first selected attribute of each of the successive events of an n-gram with all other second selected attributes from each of the successive events of the n-gram; program instructions to generate, by the computer, a correlation metric as a function of the number of correlated first selected attributes and the total number of selected attributes of each of the successive events of the n-gram, wherein the program instructions to generate the correlation metric include: program instructions to increment, by the computer, a count of n-gram instances in which the first selected attribute of each of the successive events of the n-gram correlates with one of the second selected attributes of each of the successive events of the n-gram; and program instructions to divide, by the computer, the count by a total number of possible correlations between the first selected attributes and the second selected attributes; and program instructions to record, by the computer, the correlations for each first selected attribute. 4. The computer program product according to claim 1 , further comprising: program instructions to identify, by the computer, a correlation for each first selected attribute of each of the successive events of one of the one or more n-grams with all other third selected attributes of each event of a different non-overlapping n-gram.