Pardon the novice question, but I really don't know what I'm supposed to be searching for on this one.

I am monitoring a system for raw events. I can identify the "type" or "kind" of an event, but there is no "value" of an event other than it occurred. This could be summarized as a "count per hour", if necessary, but that's not part of the raw data. These events can occur as infrequently as once every 3 hours, or up to 5 times an hour.

What I need to be able to do is detect when these events are slowing down, as it indicates a problem with the upstream system. Any solutions I'd be comfortable using would need to be on-line, ie not batch processed once an hour. Is there a well-established way of doing this? Or do most people just figure out the count/hr vs. expected count/hr and call it good enough?