A method is disclosed for forecasting the behavior of an information technology system for executing a plurality of applications. In an embodiment, the method comprises the steps of monitoring (110) the execution of selected applications over a predefined time period, compiling (120) a trace of events indicating unintended behavior of the system during said period, determining (130) a correlation between an initial event and a subsequent event in said trace and forecasting (140) a recurrence of the subsequent event based on said correlation in response to a recurrence of the initial event. This facilitates a user to avoid or at least reduce the risk of future occurrence of events that may have a detrimental impact on the performance of the IT system.