Abstract: A method, system and medium for recording events in a system management environment is described. As system events are detected in an enterprise computing environment they are stored in a manner allowing them to be “replayed” either forward or reverse to assist a system administrator or other user to determine the chain of events that affected the enterprise. The system engineer and business process owner are therefore presented with pertinent information for monitoring, administrating and diagnosing system activities and their correlation to business services.