Technologies are described herein for differentiating normal operation of an application program from error conditions to predict, diagnose, and recover from application failures. Access to resources by the application program is monitored, and resource access events are logged. Resource access patterns are established from the logged resource access events utilizing computer pattern recognition techniques. If subsequent access to resources by the application program deviates from the established patterns, then a user and/or administrator of the application program is notified of a potential error condition based on the detected deviation. In addition, sequences of resource access events that deviate from the established resources access patterns are correlated with an error condition based on a temporal proximity to the time of occurrence of the error to provide diagnostic information regarding the error.