@theopolis +1 to checking against chef logs. We've started checking against chef github repos as well and maintaining a hash table with counts