Abstract: A system generates a recommendation that includes at least one action to address at least one root cause anomaly that causes other anomalies occurred within a distributed system. The at least one root cause anomaly is determined by at least using a graph that represents the distributed system and metrics that are associated with the distributed system.

Abstract: A system obtains a graph representing a set of resources of a distributed system. At least one node of the graph represents a resource-metric pair. The system further obtains time series data that indicates anomalies from the system. Then, the system determines a root cause anomaly that caused other anomalies based at least in part on the graph and the time series data.

Abstract: Techniques for anomaly and causality detection are described. An example includes receiving time series data; performing anomaly detection on the received time series data to detect at least one anomaly using an anomaly detection model; detecting a causal relationship between measures, wherein a set of measures are related when a first of the set of measures has a causal influence on a second of the set of measures, wherein a single time series is a metric and a measure is a numerical or categorical quantity a metric describes; and outputting a result of the anomaly and causality relationship detections.