Ask HN: What are the data points for a Root Cause Analysis of a downtime?

In a complex Service Oriented Architecture, how do you find the culprit service that disrupted the system? What are the data points that you gather to come to a conclusion? And most importantly, how do you find causation? In my experience, if services fall like dominoes, it's really difficult to pinpoint the first one to go. Especially in scenarios such as: Service1, Service2 and DB got huge spikes (I/O or network or req per sec), now if S1, S2 and DB are all jumbled up as far as dependencies go, how do you pinpoint the culprit? What logs/data-points/tools do you use? Sorry if the question sounds a bit vague and general, I don't have any specific instance for which I'm seeking advice.

Co-incidentally, why are there no blogs for when things go wrong? There's a surprising lack of resources available for RCAs and Post mortems.