A method of determining the root cause of an event in a computer network having a distributed network management architecture including detecting an event at at least one device component (DC) in the network, for each source DC at which an event is detected, finding a data path within the network from the source DC's underlying network element to that of its acquaintance DC where present, identifying as the root cause any of the source DC and the subject DCs in the data path that have detected an event and either do not have an acquaintance or do not have a valid operational state with respect to its acquaintance whereas all other DCs along the data path at lower network layers than the source or subject DC have valid operational states with respect to their acquaintances.