A System is monitored by detecting activity signatures of network components. Some of the activity signatures are generated by sensing patterns of operations in data streams. Some of the activity signatures are precompiled in the system, or are standard in computer systems. The activity signatures are stored in a database. Select information about select baselined attributes generates monitoring profiles (MPs) for the baselined attributes. The MPs are defined so abnormal behavior of end points and/or system components can be detected. The system compiles baseline values for baselined attributes of MP's. By properly analyzing deviating end points or components one can determine what is causing a problem or who is effected by a problem based on which identifying attributes are common to the deviating end points or components.