A backup recovery and testing method is disclosed. The recovery method restores backed-up systems according to a stored configuration, and collects logs as the restored systems start up. The collected logs are compared with stored baseline logs, by a process which includes parsing the logs into templates and parameters, and identifying anomalies automatically for example by principal component analysis. Anomalies identified may be used to modify the stored configuration.