Embodiments are disclosed for determining whether a computing node is in a normal or an abnormal condition based on its characteristics relative to those of other computing nodes. In embodiments, log files for the computing node are used to develop a state model of the computing node, and where the state model differs between two similar computing nodes, an abnormality is identified. In other embodiments, characteristics about computing nodes (e.g., CPU resources used) are used to cluster those computing nodes, and those computing nodes that lie outside of a cluster are identified as abnormal.