1. A method of determining a cause of an occurrence in an information system made up of a plurality of monitored nodes, the method comprising: storing a plurality of rules, each said rule setting forth one or more conditions to be satisfied for indicating a particular cause of a particular occurrence; receiving a first event message regarding a first event related to one of said nodes; assigning a valid duration to the first event; determining which of said rules have conditions corresponding to the first event; calculating a matching ratio for any rules having conditions corresponding to the first event; storing a matching state of conditions; and specifying the cause of the occurrence based upon calculated matching ratios of said rules.