An approach is provided for detecting and analyzing an anomaly in application performance in a client-server connection via a network. A status code of a response sent by a server to a client, a round trip latency time (RTT) of the response, and a time out of a connection between client and server are determined. Using a k-means clustering algorithm, buckets of RTT values clustered into lower and higher values, and running counts and means for the RTT values in each bucket, an RTT value is determined to exceed a threshold value. Based on the status code, the RTT value exceeding the threshold, and the connection time out, the anomaly is detected. Based on temporal and textual analyses of log entries and an environment analysis, candidate root causes of a failure that resulted in the anomaly are determined.