A system for automatically adjusting operation of a distributed application program includes analytics means having a monitoring component. The monitoring component receives one or more event streams of data corresponding to execution of one or more modules of the distributed application program. The monitoring component joins the received event streams with one or more declarative models to create operational data. A forensics component of the analytics means queries, such as by using data from a declarative model store, the operational data to identify trends or behavior information for the various modules or components of the distributed application program. A planner component then reviews data created by the forensics component to identify any needed changes to the declarative models. The planner component passes any modified declarative models back to the system, so that the distributed application program can operate more efficiently using the changes to the declarative models, as needed.