Methods, articles, and systems for determining a probable cause of a component's abnormal behavior are described. To determine the probable cause, a computing device computes, for one or more pairs of components having dependency relationships, a likelihood that behavior of one component of a pair is impacting behavior of the other component of the pair. This computing is based on joint historical behavior of the pair of components. The computing device then determines that one of a plurality of components is a probable cause of the abnormal behavior based on the computed likelihoods.