A network management apparatus and method for identifying an event which is indicative of the underlying cause of more than one of a plurality of events detected by a network management station on a network is described in which the management station has knowledge of the topology of the network. Using the topology of the network, the apparatus and method considers the location of the network device causing each event in the plurality of events, and determines as the causal event, the event which has occurred at a location closest to the network management station. The method is preferably implemented in the form of a computer program.