Software system reliability is critical, but runtime anomalies are increasingly common due to system complexity. Rule-based and AI-based anomaly detection methods assist in analysing runtime monitoring data (logs, traces, metrics) to find anomalies but require high-quality datasets and domain knowledge to work reliably. There is no consensus on which runtime monitoring parameters describe the microservice, indicate anomalies, or if deviations signal anomalies. Understanding the dataset, essential parameters, and microservice dependencies is crucial to avoiding bias and false positives.

Thus, we investigate whether a structural equation model can describe the system’s or microservices’ behavior via runtime monitoring data and identify their causal relationships. To test our model, we used runtime monitoring data extracted from TrainTicket via EvoMaster. Our results show that the identified metric-based indicators effectively describe microservices’ behavior, but network metrics alone are insufficient for describing the whole system’s behavior. The model can also identify microservices that significantly influence the whole system.