A system and associated method for detecting a statistical variation of a process from a textual log of the process as performed by a process behavior analysis (PBA) system for monitoring the process operating in an Information Technology (IT) delivery system. The PBA system includes a PBA engine and a data storage storing exception rules used by the PBA engine. The PBA engine merges entities appearing in the textual log into one or more groups based on similarities of respective time series of the entities. Control charts are generated for merged entities and the PBA engine subsequently analyzes process behavior of the process by use of the control charts for exceptions defined in the stored exception rules. The PBA engine generates a PBA report for the process pursuant to the analysis result of the textual log with detailed information including to what type of exceptions had or had not occurred.