1. A method comprising: capturing a fingerprint comprising a set of rules that describe the behavior of at least one metric of an information technology (IT) infrastructure; comparing the fingerprint to an incoming data stream; and preemptively predicting a potential problem in the IT infrastructure based on the fingerprint comparison; wherein each rule describes the probability of a symptom for a specific time cut, each time cut being a number to time units prior to the occurrence of a problem.