Semi-supervised and unsupervised anomaly detection by mining numerical workflow relations from system logs