1. A computer-implemented method for detecting anomalous behavior in a distributed system, comprising: receiving data from a plurality of subsystems in the distributed system which identifies metrics for the plurality of subsystems when the plurality of subsystems perform processing for a plurality of execution paths in the distributed system; automatically establishing baseline metrics for the subsystems, responsive to the received data; receiving data from particular subsystems of the plurality of subsystems which identifies metrics for the particular subsystems when the particular subsystems perform processing for a particular execution path in the distributed system; determining if the metrics for the particular subsystems are anomalous based on the baseline metrics; and reporting, responsive to the determining.