An event correlation system comprising: at least one processor; a feature identification module, executed by the at least one processor, to identify a feature set for each log file of a plurality of log files; a feature extraction module, executed by the at least one processor, to extract the feature set for each event of a plurality of events in each log file of the plurality of log files; a trace event pairs linkage strength determination module, executed by the at least one processor, to determine a plurality of trace event pairs linkage strength values for at least one event from a first log file of the plurality of log files and a plurality of events from a second log file of the plurality of log files, wherein the plurality of trace event pairs linkage strength values represent an overlap of the feature set for the at least one event from the first log file and the feature set for each of the plurality of events from the second log file, wherein the trace event pairs linkage strength values are based on an intersection of the feature set for the at least one event from the first log file of the plurality of log files and the feature set for each of the plurality of events from the second log file of the plurality of log files, and a union of the feature set for the at least one event from the first log file of the plurality of log files and the feature set for each of the plurality of events from the second log file of the plurality of log files; a timestamp determination module, executed by the at least one processor, to determine a timestamp for each event of the plurality of events in each log file of the plurality of log files; and a trace event pairs time lapse determination module, executed by the at least one processor, to use the timestamps associated with the at least one event from the first log file of the plurality of log files and the plurality of events from the second log file of the plurality of log files to determine a time difference between the at least one event from the first log file of the plurality of log files and each of the plurality of events from the second log file of the plurality of log files; a trace event pairs link score determination module, executed by the at least one processor, to determine trace event pairs link score values based on the trace event pairs linkage strength values and the trace event pairs link time strength values, wherein the trace event pairs link score values are based on a time difference between the at least one event from the first log file of the plurality of log files and each of the plurality of events from the second log file of the plurality of log files, and a maximum trace event pairs linkage strength value between the at least one event from the first log file of the plurality of log files and each of the plurality of events from the second log file of the plurality of log files, wherein the trace event pairs link score determination module is to further determine at least one link that represents an event correlation between the at least one event from the first log file of the plurality of log files and at least one of the plurality of events from the second log file of the plurality of log files based on the maximum trace event pairs link score value. at least one processor; a feature identification module, executed by the at least one processor, to identify a feature set for each log file of a plurality of log files; a feature extraction module, executed by the at least one processor, to extract the feature set for each event of a plurality of events in each log file of the plurality of log files; a timestamp determination module, executed by the at least one processor, to determine a timestamp for each event of the plurality of events in each log file of the plurality of log files; and a trace event pairs time lapse determination module, executed by the at least one processor, to use the timestamps associated with the at least one event from the first log file of the plurality of log files and the plurality of events from the second log file of the plurality of log files to determine a time difference between the at least one event from the first log file of the plurality of log files and each of the plurality of events from the second log file of the plurality of log files; a trace event pairs link score determination module, executed by the at least one processor, to determine trace event pairs link score values based on the trace event pairs linkage strength values and the trace event pairs link time strength values, wherein the trace event pairs link score values are based on a time difference between the at least one event from the first log file of the plurality of log files and each of the plurality of events from the second log file of the plurality of log files, and a maximum trace event pairs linkage strength value between the at least one event from the first log file of the plurality of log files and each of the plurality of events from the second log file of the plurality of log files, wherein the trace event pairs link score determination module is to further determine at least one link that represents an event correlation between the at least one event from the first log file of the plurality of log files and at least one of the plurality of events from the second log file of the plurality of log files based on the maximum trace event pairs link score value.