A method, computer program product and apparatus for diagnosing a fault incident in a data center. A determination is made as to whether a fault incident happened in the data center. If a fault incident happened, then the business logic being executed in a node where the fault incident happened is determined. The log files associated with the execution process of the business logic is selected based on a management model corresponding to the data center, where the management model reflects the deployment and application dependency of the business logics. The fault incident is diagnosed based on the log files. The management model is utilized to select the log files associated with the execution process of the business logic, and to write information of the business logic and dependency relationships between the applications into the log file, so as to automatically, rapidly and accurately diagnose the fault incident.