Managing a root cause analysis and outputting an identified root cause, for use in a system comprising a plurality of inter-related elements wherein at least some of the elements experience one or more anomalous states, comprising receiving initial indicators of system element states symptomatic of anomalous element operation, selecting an episode expiration time based on the received initial indicators, receiving additional such indicators, correlating the indicators received prior to the episode expiration time based on pre-defined relationships between the system elements, generating possible causes of the anomalous element states consistent with the received indicators and the pre-defined relationships, asserting possible causes as actual causes, identifying an actual cause as a root cause, and outputting the root cause.