The problem of quick detection of crash in the normal operation of large IT infrastructures (ITS) is discussed. Conclusions on the presence of a crash are made as a result of indirect indicators analysis. It’s necessary to identify a malfunction that has occurred in the current ITS (i.e. to identify the so-called functional security crash when sensors for in-system monitoring of the observed ITS don’t yet signal problems that have arisen, but some ITS services have already become unavailable). The fact of a crash can be fixed based on the actual data contained in users’ text messages. These indirect indicators, integrated with historical data about previously fixed crashes and their “nature” can be used to “train” reliable decision-making in the current emergency situation. Analyzing users’ response - text messages related to a particular crash - it’s necessary to take into account the contexts in which certain terms - frequently used words or phrases - occur. The current level of capabilities of the described industrial systems - the so-called down detectors (DD) - is discussed. Basing on practical examples of the DDs use, the achievements and current problems of DD application in monitoring services provided on the basis of the Russian national IT infrastructure are discussed. A model of text data mining that allows to identify contexts that characterize a specific incident in the process of “learning” by information about previously fixed crashes is presented. The proposed approach enables to identify non-binary (context-defined) causal relationships hidden in the recorded text data.