A method for monitoring performance of an application system which is distributed across a plurality of network connected nodes, comprising: generating a hierarchical model for the application system, the hierarchical model having a plurality of levels, each level including components of a span specific to that level; mapping the application system onto the hierarchical model according to a network topology of the application system; monitoring network traffic between the plurality of network connected nodes of the application system to gather network traffic data; assembling the network traffic data into application messages; correlating the application messages into sets of one or more application messages that are causally associated in accordance with the hierarchical model, wherein the sets of causally associated application messages constitute transactions corresponding to a lowest level of the hierarchical model; and, generating records of individual transactions occurring within the application system for at least the transactions corresponding to the lowest level of the hierarchical model.