Method, apparatus and computer program product are configured to perform computer monitoring activities; to collect information regarding computer system status during the computer monitoring activities; to detect a problem in dependence on the information collected during the computer monitoring activities; and to determine whether to launch a diagnostic probe when the problem is detected. The monitoring activities may be performed on a periodic or event-driven basis. The determination whether to launch a diagnostic probe is based on a rule included in a hierarchy of rules. The hierarchy of rules is based on problem tickets; system logs; and computer system configuration information.