A method for detecting and identifying an endpoint management event failure in an endpoint management system , the method comprising: generating event logs at the endpoint management system ; storing in a database log data comprising the generated event logs; identifying a first set of log data by searching the log data for a first log data type having a data structure that includes a generic identifier and a specific data, wherein the generic identifier comprises an identifier associated with a user or an event log chain identifier that uniquely identifies event logs related to a same action, and the specific data comprises user information or an action type , wherein the first log data type includes at least one of: the identifier associated with a user and the user information , or the event log chain identifier and the action type ; identifying pairs of the one of the identifier associated with a user and the user information , or the event log chain identifier and the action type , in the first set of log data ; for each of the identified pairs: identifying a second set of log data that include the one of the identifier associated with a user or the event log chain identifier but not the corresponding one of the user information or the action type , wherein identifying the second set of log data is performed by searching the log data for event logs that include the one of the identifier associated with a user or the event log chain identifier ; and updating log data stored in the database by adding, for each of the event logs of the identified second set of log data , the one of the user information or the action type . generating event logs at the endpoint management system ; storing in a database log data comprising the generated event logs; identifying a first set of log data by searching the log data for a first log data type having a data structure that includes a generic identifier and a specific data, wherein the generic identifier comprises an identifier associated with a user or an event log chain identifier that uniquely identifies event logs related to a same action, and the specific data comprises user information or an action type , wherein the first log data type includes at least one of: the identifier associated with a user and the user information , or the event log chain identifier and the action type ; the identifier associated with a user and the user information , or the event log chain identifier and the action type ; identifying pairs of the one of the identifier associated with a user and the user information , or the event log chain identifier and the action type , in the first set of log data ; for each of the identified pairs: identifying a second set of log data that include the one of the identifier associated with a user or the event log chain identifier but not the corresponding one of the user information or the action type , wherein identifying the second set of log data is performed by searching the log data for event logs that include the one of the identifier associated with a user or the event log chain identifier ; and updating log data stored in the database by adding, for each of the event logs of the identified second set of log data , the one of the user information or the action type . identifying a second set of log data that include the one of the identifier associated with a user or the event log chain identifier but not the corresponding one of the user information or the action type , wherein identifying the second set of log data is performed by searching the log data for event logs that include the one of the identifier associated with a user or the event log chain identifier ; and updating log data stored in the database by adding, for each of the event logs of the identified second set of log data , the one of the user information or the action type . <EOS>