A provenance method, system, and non-transitory computer readable medium for a plurality of eidetic systems having logs, include a log-segment clustering circuit configured to crawl the logs of each of the eidetic systems to cluster segments across the logs of temporally correlated events into clustered segments, a probabilistic interleaving circuit configured to analyze the correlated segments to interleave an order of processes in the logs and assign a probability to the order of the processes occurring, and a probabilistic linearization circuit configured to create a probability tree which includes a total probability that a process in the clustered segments causes a next process in the clustered segments until an end of the temporal event of the clustered segments for each of the interleaved order of processes interleaved by the probabilistic interleaving circuit.