A method for managing a computer system includes monitoring first violations of a service level objective (SLO) of a service running on the computer system so as to determine a first statistical behavior of the first violations. Second violations of a component performance threshold of a component of the computer system are monitored so as to determine a second statistical behavior of the second violations. A model that predicts the second statistical behavior based on the first statistical behavior is produced. The component performance threshold is automatically adjusted responsively to the model, so as to improve a prediction of the first violations by the second violations.