A computer-implemented method for monitoring performance in a distributed computing environment, comprising: a) receiving, by a causality estimator (108, 131), a triggering event, where the triggering event indicates an abnormal operating condition in the distributed computing environment; b) creating, by the causality estimator (108, 131), a causality graph which includes the triggering event as a node in the causality graph; c) retrieving, by the causality estimator (108, 131), one or more causality rules for the triggering event from a repository, where each causality rule includes applicability criteria that must be met by a given event in order to apply the causality rule, and acceptance criteria that must be met for there to be a causal relationship between the given event and another event; d) for each causality rule in the one or more causality rules, identifying a topology entity upon which the triggering event was observed, and retrieving candidate topology entities from a topological model, where the candidate topology entities have a known relationship with the identified topology entity; e) for each candidate topology entity and each causality rule in the one or more causality rules, evaluating a given candidate topology entity in relation to acceptance criteria defined in a given causality rule and adding a causality event record to the causality graph in accordance with the given causality rule, where the causality event record has a causal relationship with the triggering event and is added to the causality graph in response to the given candidate topology entity satisfying the acceptance criteria defined in the given causality rule; and f) identifying, by a root cause calculator, a root cause for the triggering event using the causality graph. a) receiving, by a causality estimator (108, 131), a triggering event, where the triggering event indicates an abnormal operating condition in the distributed computing environment; b) creating, by the causality estimator (108, 131), a causality graph which includes the triggering event as a node in the causality graph; c) retrieving, by the causality estimator (108, 131), one or more causality rules for the triggering event from a repository, where each causality rule includes applicability criteria that must be met by a given event in order to apply the causality rule, and acceptance criteria that must be met for there to be a causal relationship between the given event and another event; d) for each causality rule in the one or more causality rules, identifying a topology entity upon which the triggering event was observed, and retrieving candidate topology entities from a topological model, where the candidate topology entities have a known relationship with the identified topology entity; e) for each candidate topology entity and each causality rule in the one or more causality rules, evaluating a given candidate topology entity in relation to acceptance criteria defined in a given causality rule and adding a causality event record to the causality graph in accordance with the given causality rule, where the causality event record has a causal relationship with the triggering event and is added to the causality graph in response to the given candidate topology entity satisfying the acceptance criteria defined in the given causality rule; and f) identifying, by a root cause calculator, a root cause for the triggering event using the causality graph.