1. A method of determining a root cause of a network problem, comprising: normalizing a set of events from data sources to form a normalized set; retrieving a symptom event instance from the normalized set based on a symptom event definition; generating a set of diagnostic events from the normalized set which potentially cause the symptom event instance, the diagnostic events being identified based on dependency rules, the dependency rules including a spatial model to identify diagnostic events which have locations related to the symptom event instance; and analyzing the set of diagnostic events to select a root cause event based on root cause rules.