A network monitor may receive network log events and identify: a first set of network devices that have reported a target network log event, a second set of network devices that have not reported the target network log event, a first set of network log events reported by the first set of network devices, and a second set of network log events reported by the second set of network devices. The network monitor may determine which network log events are legitimate, and filter the legitimate network log events from the first set of network log events or the second set of network log events to produce a group of suspicious network log events that may be correlated with the target network log event. The network monitor may predict future suspicious network log events that may be correlated with the target network log event in order to predict equipment failures.