1. A method comprising: performing on a processor, evaluating log data; determining at least one discrepancy between the log data and a system model; generating a candidate model based on the discrepancy and a model template; and updating the system model based on the candidate model.