A method for detecting and identifying an endpoint management event failure in an endpoint management system, the method comprising: generating event logs at the endpoint management system; storing in a database log data comprising the generated event logs; identifying a first set of log data by searching the log data for a first log data type having a data structure that includes a generic identifier and a specific data, wherein the generic identifier comprises an identifier associated with a user (408, 409) or an event log chain identifier that uniquely identifies event logs related to a same action, and the specific data comprises user information (412, 414) or an action type, wherein the first log data type includes at least one of: the identifier associated with a user (408, 409) and the user information (412, 414), or the event log chain identifier and the action type; identifying pairs of the one of the identifier associated with a user (408, 409) and the user information (412, 414), or the event log chain identifier and the action type, in the first set of log data; for each of the identified pairs: identifying a second set of log data (416, 420) that include the one of the identifier associated with a user (408, 409) or the event log chain identifier but not the corresponding one of the user information (412, 414) or the action type, wherein identifying the second set of log data (416, 420) is performed by searching the log data for event logs that include the one of the identifier associated with a user (408, 409) or the event log chain identifier; and updating log data stored in the database by adding, for each of the event logs of the identified second set of log data (416, 420), the one of the user information (412, 414) or the action type. generating event logs at the endpoint management system; storing in a database log data comprising the generated event logs; identifying a first set of log data by searching the log data for a first log data type having a data structure that includes a generic identifier and a specific data, wherein the generic identifier comprises an identifier associated with a user (408, 409) or an event log chain identifier that uniquely identifies event logs related to a same action, and the specific data comprises user information (412, 414) or an action type, wherein the first log data type includes at least one of: the identifier associated with a user (408, 409) and the user information (412, 414), or the event log chain identifier and the action type; the identifier associated with a user (408, 409) and the user information (412, 414), or the event log chain identifier and the action type; identifying pairs of the one of the identifier associated with a user (408, 409) and the user information (412, 414), or the event log chain identifier and the action type, in the first set of log data; for each of the identified pairs: identifying a second set of log data (416, 420) that include the one of the identifier associated with a user (408, 409) or the event log chain identifier but not the corresponding one of the user information (412, 414) or the action type, wherein identifying the second set of log data (416, 420) is performed by searching the log data for event logs that include the one of the identifier associated with a user (408, 409) or the event log chain identifier; and updating log data stored in the database by adding, for each of the event logs of the identified second set of log data (416, 420), the one of the user information (412, 414) or the action type. identifying a second set of log data (416, 420) that include the one of the identifier associated with a user (408, 409) or the event log chain identifier but not the corresponding one of the user information (412, 414) or the action type, wherein identifying the second set of log data (416, 420) is performed by searching the log data for event logs that include the one of the identifier associated with a user (408, 409) or the event log chain identifier; and updating log data stored in the database by adding, for each of the event logs of the identified second set of log data (416, 420), the one of the user information (412, 414) or the action type.