Grouping anomalous components of a distributed application

A system, comprising:

• a processor that executes the following computer-executable components stored in memory:
• a graph compiler that generates a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors, wherein the distributed application comprises the services;
• a token component that generates token vectors for the services using tokens flowing across the services that are observed in the log data;
• and
• a partitioning component that clusters the services into a plurality of groups using the hypernode graph, the token vectors, and an objective function.

A computer-implemented method, comprising:

• generating, by a system operatively coupled to a processor, a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors, wherein the distributed application comprises the services;
• generating, by the system, token vectors for the services using tokens flowing across the services that are observed in the log data;
• and
• clustering, by the system, the services into a plurality of groups using the hypernode graph, the token vectors, and an objective function.