A method, system, and computer program product for predicting abnormal operation of at least one component of a machine is provided. Real time monitoring data from an operating machine is received and monitoring features that are informative of likely abnormal operation are extracted and/or calculated. The monitoring features are applied to a prediction matrix that outputs probabilities of abnormal operation within one or more prediction time horizons. If the output probabilities exceed a threshold probability, then an alert can be output. Maintenance can be automatically scheduled in response to the alert.