Described herein are techniques for identifying a path in a workload that may be associated with a deviation. A workload may be associated with multiple measurements of a plurality of metrics generated during execution of the workload. The multiple measurements may be aggregated at multiple levels of execution. One or more measurements may be compared to one or more other measurements or estimates to determine whether there is a deviation from an expected correlation. If determined that there is a deviation, a path can be identified in the workload that may be associated with the deviation.