A computer-implemented method for monitoring performance in a distributed computing environment, comprising: a) receiving, by a causality estimator (108, 131), a triggering event, where the triggering event indicates an abnormal operating condition in the distributed computing environment; characterized in: b) retrieving, by the causality estimator (108, 131), a causality rule for the triggering event from a repository, where the causality rule includes applicability criteria that must be met by a given event in order to apply the causality rule, and acceptance criteria that must be met for there to be a causal relationship between the given event and another event; c) identifying a topology entity upon which the triggering event was observed, and retrieving a candidate topology entity from a topology model, where the acceptance criteria in the retrieved causality rule specifies a relationship between the identified topology entity and a candidate topology entity, and the retrieved candidate topology entity matches the relationship specified by the acceptance criteria in the retrieved causality rule, wherein the topology model includes topology entities which collectively describe the distributed computing environment and defines relationships between the topology entities; d) evaluating observation data for the candidate topology entity in relation to the acceptance criteria in the retrieved causality rule; and e) in response to the observation data for the candidate topology entity matching the acceptance criteria in the retrieved causality rule, indicating the occurrence of an additional event on the candidate topology entity that is causally related to the triggering event. a) receiving, by a causality estimator (108, 131), a triggering event, where the triggering event indicates an abnormal operating condition in the distributed computing environment; characterized in: b) retrieving, by the causality estimator (108, 131), a causality rule for the triggering event from a repository, where the causality rule includes applicability criteria that must be met by a given event in order to apply the causality rule, and acceptance criteria that must be met for there to be a causal relationship between the given event and another event; c) identifying a topology entity upon which the triggering event was observed, and retrieving a candidate topology entity from a topology model, where the acceptance criteria in the retrieved causality rule specifies a relationship between the identified topology entity and a candidate topology entity, and the retrieved candidate topology entity matches the relationship specified by the acceptance criteria in the retrieved causality rule, wherein the topology model includes topology entities which collectively describe the distributed computing environment and defines relationships between the topology entities; d) evaluating observation data for the candidate topology entity in relation to the acceptance criteria in the retrieved causality rule; and e) in response to the observation data for the candidate topology entity matching the acceptance criteria in the retrieved causality rule, indicating the occurrence of an additional event on the candidate topology entity that is causally related to the triggering event. b) retrieving, by the causality estimator (108, 131), a causality rule for the triggering event from a repository, where the causality rule includes applicability criteria that must be met by a given event in order to apply the causality rule, and acceptance criteria that must be met for there to be a causal relationship between the given event and another event; c) identifying a topology entity upon which the triggering event was observed, and retrieving a candidate topology entity from a topology model, where the acceptance criteria in the retrieved causality rule specifies a relationship between the identified topology entity and a candidate topology entity, and the retrieved candidate topology entity matches the relationship specified by the acceptance criteria in the retrieved causality rule, wherein the topology model includes topology entities which collectively describe the distributed computing environment and defines relationships between the topology entities; d) evaluating observation data for the candidate topology entity in relation to the acceptance criteria in the retrieved causality rule; and e) in response to the observation data for the candidate topology entity matching the acceptance criteria in the retrieved causality rule, indicating the occurrence of an additional event on the candidate topology entity that is causally related to the triggering event.