A method is provided to predict a disaster for a computer system based on logs. The method includes representing existing logs as first vectors by tokenizing the existing logs and partitioning the first vectors into clusters. The clusters represent disaster types. The method further includes selecting representative vectors for the clusters, representing a new log of the computer system as a second vector by tokenizing the new log, matching the second vector to a cluster by comparing the second vector and the representative vectors, and categorizing the new log as a disaster type represented by the cluster.