A system for clustering events includes an extraction engine configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. The managed infrastructure is associated with produced events that relate to it. Those events are converted into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical and virtual hardware and software. A sigalizer engine and a compare and merge engine are included.