A deviance monitoring module is provided for examining various parameters of an operating system for deviance from a baseline behavior at specified intervals. A range of acceptable deviance values from a baseline behavior is set for parameters of an operating system. The parameters of the operating system are then monitored at specified intervals for deviance from the baseline behavior. In response to detecting that the deviance exceeds a predetermined threshold, the method triggers diagnostic data gathering on the parameters of the operating system according to an embodiment.