Cyber-physical production systems are composed of a multitude of subsystems from diverse vendors and integrators, connected in a distributed fashion. An undesirable phenomenon in one system might cause a misbehavior in another connected system. Searching for the root cause of this misbehavior quickly becomes very tedious as many possible search directions exist. This paper proposes an approach and algorithm to tie together information available in design-time and runtime models. This then allows, in conjunction with observed and desired status of a system, to recommend search options and concrete solution steps to guide workers along the fixing process without being overwhelmed by the complexity of the overall system of systems. We demonstrate the feasibility of our approach using a lab-scal production cell model.