Comment by vardaro

Neat idea. Why logs, and not metrics too? You can characterize an accurate "baseline" system behavior through a combination of system level and userspace metrics. This profile would offer more depth than what you'd otherwise piece together with userspace logs.