A computer implemented method and apparatus for determining the source of at least one observed event occurring among a plurality of types of components is disclosed. The method, operable on a computer system, utilizes a data structure produced for determining the source of a problem by mapping a plurality of observed events and a plurality of known causing events, wherein the mapping represents a correlation between the observed events and the causing events, determines a distance measure based on mapped correlation values and determines at least one causing event based on a distance measure within a known tolerance above a minimum distance measure.