A two-module system is created for automated web activity monitoring. A model is generated and model outliers are identified by the first module of the system. Reports are generated that identify the events based on their significance to the outliers. The model may be automatically and periodically regenerated for different historical time periods of the web sessions. New groups of events may be periodically extracted from new web sessions and applied to the previously generated model by the second module of the system. Model outliers may be identified from the new groups of events. The new events may be analyzed and reported to a web session operator based on their contribution to any identified outliers. Even if no outliers are detected, the new events having a most significant impact on web session operating conditions may be identified and reported in real-time.