Embodiments include method, systems and computer program products for identifying unusual intervals in an information technology (IT) system. Aspects include training a log analysis system based on historical data for the IT system, the historical data including a plurality of intervals each having an interval anomaly score and receiving status messages from a plurality of pieces of IT equipment in the IT system. Aspects also include grouping the status messages into an interval and calculating an interval anomaly score for the interval and comparing the interval anomaly score with one or more priority level cutoffs created by the training and responsively generating an alert based on the comparison, wherein the alert indicates that the interval is unusual.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method for identifying unusual intervals in an information technology (IT) system, the method comprising: training, by a processor, a log analysis system based on historical data for the IT system, the historical data including a plurality of intervals each having an interval anomaly score; receiving, by the log analysis system, status messages from a plurality of pieces of IT equipment in the IT system; grouping the status messages into an interval and calculating an interval anomaly score for the interval; and comparing the interval anomaly score with one or more priority level cutoffs created by the training and responsively generating an alert based on the comparison, wherein the alert indicates that the interval is unusual. 2. The method of claim 1, wherein the training comprises: ordering the plurality of intervals in ascending order based on the interval anomaly scores; dividing the ordered intervals evenly into a fixed number of groups; and calculating a cumulative anomaly score for each of the groups. 3. The method of claim 2, wherein the training further comprises calculating the one or more priority level cutoffs based on a statistical analysis of the cumulative anomaly scores. 4. The method of claim 2, wherein the one or more priority level cutoffs are further based on a user input. 5. The method of claim 3, wherein the statistical analysis of the cumulative anomaly scores includes plotting a graph of the cumulative anomaly scores and calculating the first derivative of the cumulative anomaly scores. 6. The method of claim 3, wherein the statistical analysis of the cumulative anomaly scores includes plotting a graph of the cumulative message anomaly scores and calculating a second derivative of a sum of the cumulative message anomaly score for interval n. 7. The method of claim 3, wherein the statistical analysis of the cumulative anomaly scores includes calculating a linear regression of the cumulative message anomaly scores to predict a sum of the cumulative message anomaly score for an interval.