A method is provided to diagnose one or more malfunctions in a virtual network having a network functionality implemented in a distributed manner by hypervisors, each performing part of the network functionality. The method includes receiving user input of observed facts about the virtual network, where the observed facts include identifiers of virtual components in the virtual network, and adding the observed facts to a knowledge base. The method further includes, in response to the identifiers of the virtual components, querying agents on the hypervisors for collected facts related to the virtual components, receiving and adding the collected facts to the knowledge base, and applying logic rules to the knowledge base to produce one or more diagnoses of the virtual network.