The present technology may determine an anomaly in a portion of a distributed business application. Data can automatically be captured and analyzed for the portion of the application associated with the anomaly. By automatically capturing data for just the portion associated with the anomaly, the present technology reduces the resource and time requirements associated with other code-based solutions for monitoring transactions. A method for sampling an application thread to monitor a request may begin with detecting a diagnostic event with respect to the processing of a request. A thread call stack associated with the request may be sampled in response to detecting the diagnostic event. A state of the call stack may be stored with timing information based on the sampling. The call stack state and timing information may be transmitted to a remote server.