A computing device includes a processor and a medium storing instructions executable to: detect a performance degradation of a first component of a computing system; in response to a detection of the performance degradation of the first component, filter a plurality of system events of the computing system using an impact matrix to generate a filtered set of system events, wherein each system event of the filtered set is associated with a first set of components of the computing system, wherein the impact matrix indicates one or more components of the first set that can have a performance impact on the first component; perform a linear regression on the filtered set of system events; and generate a ranked list of system events based on the linear regression, the system events in the ranked list being ordered according to likelihood of having caused the performance degradation.