A method for troubleshooting abnormal behavior of an application hosted on a networked computer system. The method may be implemented by a root cause analyzer. The method includes tracking a single application performance metric across all the clients of an application hosted on a networked computer system and analyzing an aggregated application based on the single application metric. The method involves determining outlier client attributes associated with an abnormal transaction of the application and ranking the outlier client attributes based on comparisons of historical and current abnormal transactions. The method associates one or more of the ranked outlier client attributes with the root cause of the current abnormal transaction. Association rule learning is used to associate one or more of the ranked outlier client attributes with the root cause.