In some implementations, a method includes conducting, by a network device, a query associated with a network function chain comprising a plurality of switches and middleboxes to verify whether a service performed by the network function chain complies with a Service Level Agreement (SLA); computing, by the network device, based on a result of the query, a difference in metric value between an actual performance metric of a packet passing through a path in the network function chain and an expected performance metric of the packet passing through the path; deriving, by the network device, a probability of SLA violation associated with the path based on the difference in metric value; and selectively monitoring, by the network device, a network of network function chains by monitoring the path for passive performance measurements based on the probability of SLA violation.