In a monitoring method, a time sequence of information pertaining to a monitored device, network, or system is recorded, comprising observations of the monitored device, network, or system and known prior correct action recommendations for the monitored device, network, or system. A hidden Markov model (HMM) operating on the time sequence of information is maintained. The HMM comprises a hidden state of the monitored device, network, or system. A current state of the monitored device, network, or system is classified using a classification value comprising an emission of the HMM that depends on an estimate of the distribution of the hidden state and on a selected portion of the time sequence of information. An action recommendation is generated for the current state of the monitored device, network, or system based on the classification value.