1. A computer program product, tangibly embodied in an information carrier, the computer program product comprising instructions operable to cause data processing apparatus to perform operations comprising: receiving process data items, each process data item having been collected by an agent; for each process data item, identifying a process instance with which the process data item is associated; grouping the process data items that are associated with a first process instance into a first group; and generating a reconstruction of the first process instance based on the process data items in the first group.