A first service's exhibition of a first symptom while executing a set of transactions is detected. A graph is constructed representing data flow between a set of services including the first service. By traversing the graph, a set of candidate services is constructed, a candidate service in the set of candidate services comprising a service exhibiting the first symptom, the set of candidate services including the first service. A probability of a first cause is evaluated, for the candidate service. At a problem service in the set of candidate services, a problem cause is ameliorated, the problem service identified using the set of candidate services and the probability of the first cause, the problem cause causing the first symptom.