A system for identifying extreme behavior in elements of a network comprises a profiler and a collator. The profiler and the collator perform a method of identifying extreme behavior in the network elements. The profiler maintains one or more group profiles of network elements. Each group profile is associated with a plurality of network elements. The profiler accumulates values of a first function of the contents of an input data stream over a first period of time for each group profile. The input data stream includes at least one field containing a network element reference. The accumulated values of each group profile are compared with a corresponding collation threshold. The collator creates a collation instance for each group profile that reaches the collation threshold. Each collation instance creates a plurality of collation profiles. Each collation profile is associated with one or more network elements from the plurality of network elements corresponding to the group profile that caused the creation of the collation instance. The collator instance accumulates values of a second function of the contents of the input data stream for each collation profile over a second period of time. Extreme behavior of network elements is identified from the accumulated values of the collation profiles.