Anomaly scores for respective message types in computer log data and confidence intervals for respective anomaly scores are calculated based on a number of appearances of respective message types in a plurality of models generated from a historical set of computer log data. Respective models of the plurality of models can have at least a portion of the historical set of computer log data excluded from the respective models. Respective anomaly scores and respective confidence intervals can be applied to a new set of log data to identify and troubleshoot unusual log data events.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method comprising: receiving a plurality of periods of log data comprising various message types, wherein respective periods of log data comprise a plurality of subsets, wherein respective subsets comprise log data from a respective time interval of a respective period; generating a plurality of models using the plurality of periods of log data, wherein respective models comprise the plurality of periods of log data having at least one respective period of log data excluded; for respective models, calculating respective anomaly scores for at least a first message type indicating a rarity of the first message type in the respective models; determining a first average anomaly score for the first message type by dividing a sum of the respective anomaly scores by the number of models; calculating a confidence interval for the first average anomaly score of the first message type based on the first average anomaly score, a statistic based on respective anomaly scores of the first message type, the plurality of models, and a confidence parameter; and storing, for respective various message types, respective average anomaly scores and respective confidence intervals for respective average anomaly scores in a non-transitory computer readable storage medium. 2. The method of claim 1, further comprising: receiving a new subset of log data comprising a plurality of new messages; matching respective message types of the plurality of new messages to respective message types stored in the non-transitory computer readable storage medium; applying, for respective matched message types in the plurality of new messages, respective average anomaly scores and respective confidence intervals for the respective average anomaly scores to respective new messages of the new subset of log data; and presenting, for respective new messages in the new subset of log data, respective average anomaly scores and respective confidence intervals for respective average anomaly scores to a user interface. 3. The method of claim 1, further comprising: combining, for respective models of the plurality of models, respective anomaly scores of respective messages in a first subset associated with a first time interval to generate a plurality of respective first subset scores; calculating an average first subset reference score by dividing a sum of respective first subset scores by the number of first subset scores; calculating a first reference confidence interval for the average first subset reference score based on the average first subset reference score, a statistic based on respective first subset scores, the number of first subset scores, and a confidence parameter; and storing the average first subset reference score and the first reference confidence interval for the average first subset reference score in the non-transitory computer readable storage medium. 4. The method of claim 3, wherein the confidence parameter is based on a selected confidence level and a number of degrees of freedom. 5. The method of claim 3, further comprising: receiving a new subset of log data comprising a plurality of new messages from the first time interval; matching respective message types of the plurality of new messages to respective message types stored in the non-transitory computer readable storage medium; applying, for respective matched message types in the plurality of new messages, the respective average anomaly score and the respective confidence interval for the respective average anomaly score from the non-transitory computer readable storage medium; summing respective average anomaly scores for the respective matched message types of the plurality of new messages to generate a new subset score for the new subset of log data; presenting the new subset score, the first average subset reference score for the first time interval, and the first reference confidence interval associated with the first average subset reference score for the first time interval to a user interface. 6. The method of claim 1, wherein generating a plurality of models further comprises generating the plurality of models by excluding a respective period of log data in each respective model such that each respective model comprises a number of periods of log data equal to the plurality of periods of log data minus one, and further such that the plurality of models is equal to the plurality of periods of log data. 7. The method of claim 1, wherein generating a plurality of models further comprises generating the plurality of models by excluding two or more respective periods of log data in each respective model such that each respective model comprises a number of periods of log data equal to the plurality of periods of log data minus the two or more excluded periods of log data, and further such that the plurality of models is greater than the plurality of periods of log data. 8. A system having a plurality of compute nodes communicatively coupled to one another via a network, the system comprising: a user interface configured to present output to a user; a memory configured to store log data generated by the plurality of compute nodes, wherein log data comprises respective message types; a database configured to store respective message types, respective anomaly scores for respective message types, and respective confidence intervals for respective anomaly scores, wherein respective anomaly scores and respective confidence intervals are generated according to a plurality of models generated by a plurality of periods of historical log data retrieved from a population of historical log data; and a processor communicatively coupled to the user interface, the memory, and the database, wherein the processor is configured to: retrieve a first interval of log data from the memory comprising a plurality of new messages generated during a first time interval; match respective message types of the plurality of new messages to respective message types stored in the database; apply, to respective matched message types in the plurality of new messages, respective anomaly scores and respective confidence intervals for the respective anomaly scores from the database; and output respective anomaly scores and respective confidence intervals for respective anomaly scores for respective messages in the plurality of new messages. 9. The system of claim 8, wherein the memory is configured to store log data retrieves the log data from one or more operations logs of the plurality of compute nodes communicatively coupled to one another via the network. 10. The system of claim 8, wherein the database further comprises at least one reference interval score and at least one confidence interval for the at least one reference interval score, wherein respective reference interval scores are based on combined anomaly scores for respective intervals in the plurality of models; wherein the processor is further configured to: combine respective anomaly scores of the plurality of new messages to generate a first interval score; retrieve a reference interval score for the first time interval and a confidence interval associated with the reference interval score for the first time interval from the database; and present the first interval score, the reference interval score for the first time interval, and the confidence interval for the reference interval score for the first time interval to the user interface. 11. The system of claim 10, wherein a first reference interval score for a first time interval comprises an average interval score based on a plurality of respective interval scores generated according to the plurality of models of historical data for the first time interval; and wherein a first confidence interval for the first reference interval score is generated based on the first reference interval score, a statistic based on the plurality of respective interval scores generated according to the plurality of models for the first time interval, the plurality of models, and a confidence parameter. 12. The system of claim 8, wherein the plurality of models are generated such that respective models have at least one respective period of the plurality of periods removed. 13. The system of claim 8, wherein respective anomaly scores for respective message types stored in the database comprise respective average anomaly scores based on a respective plurality of anomaly scores for respective message types generated according to the plurality of models. 14. The system of claim 13, wherein a confidence interval for a first average anomaly score comprises a range of values centered on the first average anomaly score such that a theoretical anomaly score generated from the population of historical log data exists within the range of values according to a first probability. 15. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, wherein the program instructions are executable by a processor to cause the processor to perform a method comprising: calculating at least a first plurality of respective anomaly scores from a plurality of respective models in a training set for at least a first respective message type, wherein respective anomaly scores for respective message types are based on a number of appearances of respective message types in respective models; generating at least a first confidence interval for the first plurality of respective anomaly scores comprising a range of values centered on a first average anomaly score for the first plurality of respective anomaly scores, wherein the first confidence interval indicates a range of a true anomaly score for the first respective message type according to a first probability; in response to receiving a new interval of log data containing a first appearance of the first respective message type, applying the first average anomaly score and the first confidence interval to the first appearance of the first respective message type; and outputting the first respective message type, the first average anomaly score, and the first confidence interval. 16. The computer program product of claim 15, wherein the program instructions are further configured to cause the processor to perform a method further comprising: calculating at least a first plurality of interval scores from the plurality of respective models in the training set by combining anomaly scores in respective intervals of the respective models in the training set; generating at least a first reference confidence interval for the first plurality of interval scores comprising a range of values centered on a first average interval score for the first plurality of interval scores, wherein the first reference confidence interval indicates a range of a true first interval score according to a first probability; in response to receiving the new interval of log data, generating a new interval score by combining respective average anomaly scores applied to respective message types in the new interval of log data; and outputting the new interval score, the first average interval score, and the first reference confidence interval for the first average interval score to a user interface. 17. The computer program product of claim 16, wherein the first reference confidence interval is based on the first average interval score, a standard deviation of the first plurality of interval scores, the first plurality of interval scores, and a confidence parameter based on a selected confidence level and a number of degrees of freedom. 18. The computer program product of claim 15, wherein the training set comprises a plurality of periods of log data, and wherein respective models of the plurality of models comprise a respective portion of the plurality of periods of log data. 19. The computer program product of claim 18, wherein respective models of the plurality of models are generated by excluding a respective period of log data in each respective model such that each respective model comprises a number of periods of log data equal to the plurality of periods of log data minus one, and further such that the plurality of models is equal to the plurality of periods of log data. 20. The computer program product of claim 18, wherein respective models of the plurality of models are generated by excluding two or more respective periods of log data in each respective model such that each respective model comprises a number of periods of log data equal to the plurality of periods of log data minus the two or more excluded periods of log data, and further such that the plurality of models is greater than the plurality of periods of log data.