Detect Anomalous Infrastructure Log Events

Problem

Given a list of log lines, identify anomalous events by counting how many times each (service, action) pair appears per minute. Each log line has the format "timestamp service action status", where timestamp is YYYY-MM-DDTHH:MM:SS. Return all (minute, service, action) groups whose count is strictly greater than a given threshold, sorted by minute, then service, then action.

Constraints

• 1 <= len(logs) <= 10^5
• Each log line contains exactly 4 space-separated fields
• 0 <= threshold <= 10^5
• Invalid log lines should be ignored