1. A machine-implemented method comprising: automatically identifying a finite set of event records corresponding to a predetermined time duration and a corresponding one or more of system servers and/or other system resources; automatically identifying one or more groups of alike ones of the event records based on at least one of horizontal and vertical analysis of the data in the event records when organized as a matrix ; for each identified group, testing respective permutations of two or more features within the group for ability to distinguish between anomalies of a corresponding feature space having the two or more features as axes of that feature space; ranking the abilities of the tested permutations; and using at least one of the better ranked and tested permutations for detecting anomalies and generating corresponding alerts.