A computer-implemented method for determining a cause in a data processing system comprising a plurality of monitored nodes (102a, 102b, 102c), the method comprising: - storing a plurality of general rules, each said general rule setting forth one or more conditions and one conclusion; - generating expanded rules (301 - 305) from said general rules and a topology of a monitored portion of the data processing system, so that each condition of said expanded rules corresponds to an event which can occur in the monitored portion; - instantiating a plurality of conditions of a plurality of said expanded rules (301 - 305) as condition objects in a memory, wherein the condition object includes information about - a name of a respective monitored node in which the event corresponding to the condition objects occurred; - a type of the event, - a received time of the event, and - a weight of the event; - instantiating a plurality of conclusions of a plurality of said expanded rules as conclusion objects in said memory, wherein the conclusion object includes information about ' - a name of a respective monitored node in which the cause corresponding to the conclusion objects occurred; - a type of the cause; and - the matching ratio of the cause; - associating a plurality of said condition objects with a plurality of said conclusion objects through a plurality of operator objects in said memory based upon a structure of said expanded rules; and - executing a process which calculates a matching ratio of the conclusion objects wherein - the matching ratio is determined by dividing the number of true condition objects related to the conclusion objects, by the number of total condition objects related to the conclusion objects; by - activating or deactivating one or more of said condition objects when an event which affects satisfaction of the one or more condition objects occurs, wherein the calculated matching ratio indicates a probability that a conclusion of at least one of the expanded rules (301 - 305) identifies the cause of the occurrence; and by - recalculating the matching ratio, when new or updated event information are written into the memory. - storing a plurality of general rules, each said general rule setting forth one or more conditions and one conclusion; - generating expanded rules (301 - 305) from said general rules and a topology of a monitored portion of the data processing system, so that each condition of said expanded rules corresponds to an event which can occur in the monitored portion; - instantiating a plurality of conditions of a plurality of said expanded rules (301 - 305) as condition objects in a memory, wherein - a name of a respective monitored node in which the event corresponding to the condition objects occurred; - a type of the event, - a received time of the event, and - a weight of the event; - instantiating a plurality of conclusions of a plurality of said expanded rules as conclusion objects in said memory, wherein - a name of a respective monitored node in which the cause corresponding to the conclusion objects occurred; - a type of the cause; and - the matching ratio of the cause; - associating a plurality of said condition objects with a plurality of said conclusion objects through a plurality of operator objects in said memory based upon a structure of said expanded rules; and - executing a process which calculates a matching ratio of the conclusion objects wherein - the matching ratio is determined by dividing the number of true condition objects related to the conclusion objects, by the number of total condition objects related to the conclusion objects; by - activating or deactivating one or more of said condition objects when an event which affects satisfaction of the one or more condition objects occurs, wherein - recalculating the matching ratio, when new or updated event information are written into the memory.