A method of correlating a plurality of event logs surrounding abnormal program termination of a plurality of networked computers, includes continuously generating event records that includes operating system events, information technology (IT) infrastructure events and program application events, transmitting and storing the event records to a monitoring database, generating and transmitting an abnormal program termination event record when a computer experiences abnormal program termination to the monitoring database, and synchronizing the stored event records and the abnormal program termination event record of the computer based on receiving the abnormal program termination event record at the monitoring database, and with respect to the abnormal program termination event record. The method further includes creating and storing a specific synchronized event log based on the synchronizing of the event records and comparing it with previously stored synchronized event logs to determine if one of a match and a specific degree of similarity exists.