A method is disclosed for network knowledge-based diagnosis comprising the machine-implemented steps of creating and storing one or more symptoms, wherein each symptom comprises a set of information elements that represent one or more network events that may be potentially received from a computer network; associating a weight value with each information element of the one or more symptoms; associating a confidence time interval value with each of the one or more symptoms; receiving one or more network events from elements in the computer network; and determining a set of one or more candidate diagnoses of a problem indicated by the received network events, by (a) selecting one or more symptoms that include at least one of the received network events and (b) using functions that map the selected symptoms to one or more candidate diagnoses, based on all weight values of events in the selected symptoms and the confidence time interval values of the selected symptoms.