Patent ID: 8583779

Claim:
A computer-implemented method, comprising: creating and storing a virtual network model that describes nodes and links of a data processing network at a plurality of time periods; receiving from the network a first event that indicates a problem in the network and a time value specifying a time at which the first event occurred; receiving a set of second events comprising candidates for a root cause of the first event; wherein each individual event of the set of second events and the first event is received from a network element in the network in response to state changes or attribute changes of one or more entities within the network element; determining a network topological indicator from the first event; wherein the network topological indicator is based on a topology related protocol specified in the first event; determining a network implication of the first event based on the topological indicator; wherein the network implication indicates connectivity issues potentially causing the first event based on the topology related protocol; based on the network implication and the time value of the first event, retrieving data from the virtual network model that indicates a path between nodes that were associated with the first event at the time at which the first event occurred; removing, from the set of second events, all events that are not on the path between the nodes that were associated with the first event at the time at which the first event occurred; wherein the method is performed by one or more computing devices.