The embodiments of the present disclosure disclose a computer-implemented method, computer system and a computer program product for detecting and predicting an abnormal log event. In the method, a current event cluster from a plurality of event clusters for a log line in a log file is determined. The plurality of event clusters include at least one abnormal event cluster. Then, a time of event transition from the current event cluster to at least one abnormal event cluster is predicted.