Methods and apparatus, including computer program products, for monitoring and discovering process executions in a distributed computer system. A central system receives process data items that have been collected by an agent, identifies a process instance with which each process data item is associated, groups the process data items that are associated with a first process instance into a first group, and generates a reconstruction of the first process instance based on the process data items in the first group. The central system can further use the reconstructed first process instance to model a process. Additionally, the central system can further use the reconstructed first process instance to monitor a process instance.