A method for identifying a drive malfunction source includes receiving as input multiple drive event records each recorded by a different one of multiple storage drives in a mass storage system. Among other data, each one of the drive event records including internal tasks performed by the associated storage drive and communications transmitted between an external host and a controller of the associated storage drive. The method may further include comparing the drive event records using a processor to identify at least one discrepancy in recorded drive events indicative of the drive malfunction source.