Apparatus and methods for remotely monitoring a plurality of distributed devices is provided. The apparatus and methods determine logging conditions which define a state of a device at which recording of the state of the device should begin prior to an event, in order to identify a sequences of actions which occur at the devices prior to the event.