1. A method comprising: determining a time range for a first instance of an incident in a computer system; collecting conditions of a plurality of components of the computer system; and deriving a set of alert conditions for the incident from the collected conditions; wherein: existence of the incident inhibits functionality of at least one component of the plurality of components; the collected conditions were present during the time range; and at least the collecting and deriving steps are performed by computer software running on computer hardware.