Embodiments of the present invention provide concepts for tracing a request in a distributed system architecture comprising one or more distributed services. A request is received at a network traffic component on one of a plurality of sockets, which are monitored by a span correlation component. Span data is obtained from the received request and a process identification component is adapted to identify a process associated with the request based on the span data. The span correlation component is adapted to identify a socket connection made by the identified process and correlate the socket connection with the span data, thereby generating span correlation data.