In an event monitor associated with an information processing system, data values corresponding to monitored events are processed using a set of parameters characterizing a reference distribution of the data values. From a given one of the data values a corresponding probability value is computed utilizing the set of parameters. A thresholding operation is then performed on the probability value, and alarm information is generated based on the result of the thresholding operation. The set of parameters are periodically updated to take into account one or more of the data values.