A method for generating a directed graph for a transaction in an application, the directed graph for application performance monitoring by a data processing system for practicing the method, the application performance monitoring including monitoring of performance and availability of computer software applications, the data processing system being suitable for network message monitoring and analysis and transaction monitoring and analysis, the method comprising: collecting event information by monitoring data flows between endpoints of the computer software applications; receiving the event information for events included in the transaction at a processor of the data processing system, each event information having a link directed from a first endpoint to a second endpoint in the application, each event information including other data required for downstream processing or display, each event information including a position indication ("posn") indicating which of the first and second endpoints is to be correlated, each of the first and second endpoints being identified as either a consumer endpoint or a producer endpoint for the event, each event information including only information required for correlation and for matching endpoints; assigning an identification ID number to each event and including the ID number in the event information for each event; based on the endpoint indicated to be correlated, that is using the identified consumer endpoint or producer endpoint and respective event maps indicated by the position indication, correlating the event information using the other data required for downstream processing or display to produce dyadic event information representative of dyadic events, each dyadic event including a first event and a second event, the dyadic event information for each dyadic event including a first ID number and a second ID number for the first event and the second event, respectively; based on matching ID number, that is for each of the first ID number and the second ID number in the dyadic event information, combining the dyadic event information to produce correlation fragments associated with each ID number, the correlation fragments being directed graph fragments consisting of two or more events; combining the correlation fragments by joining or extending the correlation fragments into one at a common endpoint to produce the directed graph for the transaction; and outputting the directed graph to an application performance monitoring application to detect performance related issues and to quickly determine their causes. collecting event information by monitoring data flows between endpoints of the computer software applications; receiving the event information for events included in the transaction at a processor of the data processing system, each event information having a link directed from a first endpoint to a second endpoint in the application, each event information including other data required for downstream processing or display, each event information including a position indication ("posn") indicating which of the first and second endpoints is to be correlated, each of the first and second endpoints being identified as either a consumer endpoint or a producer endpoint for the event, each event information including only information required for correlation and for matching endpoints; assigning an identification ID number to each event and including the ID number in the event information for each event; based on the endpoint indicated to be correlated, that is using the identified consumer endpoint or producer endpoint and respective event maps indicated by the position indication, correlating the event information using the other data required for downstream processing or display to produce dyadic event information representative of dyadic events, each dyadic event including a first event and a second event, the dyadic event information for each dyadic event including a first ID number and a second ID number for the first event and the second event, respectively; based on matching ID number, that is for each of the first ID number and the second ID number in the dyadic event information, combining the dyadic event information to produce correlation fragments associated with each ID number, the correlation fragments being directed graph fragments consisting of two or more events; combining the correlation fragments by joining or extending the correlation fragments into one at a common endpoint to produce the directed graph for the transaction; and outputting the directed graph to an application performance monitoring application to detect performance related issues and to quickly determine their causes.