Capacity Forecast

Example alert

Exact wording varies — the detector generates titles from the anomaly it finds. This is representative of what an alert looks like when it fires.

How it works

Fits a robust trend (Sen slope, Mann-Kendall significant) over a 6-hour window to bounded saturation gauges — disk, pool, and memory utilization — and projects it to the ceiling, reporting only breaches arriving within 24 hours. Grouped per mount rather than per host, so one filling volume isn't averaged away by the empty ones. Gauges with no known ceiling are skipped rather than given an invented threshold, and cumulative counters and startup ramps are filtered out because both trend upward by construction. Born capped at warning severity while it soaks — it never escalates to critical.

Availability

Runs on these tiers:

Related detectors

• Metric Anomaly

  Spikes and dips in any numeric metric — CPU, memory, queue depth, request rate — against that metric's own seasonal baseline.

• Resource Saturation

  A resource pinned near its limit — CPU, memory, disk, connection pool — long enough to matter, not a momentary touch.

• Slow Drift

  The boiling-frog leak: a metric trending steadily the wrong way over hours, too gradual for any spike alarm to catch.

• Metric Reporting Gap

  A metric series that simply stopped arriving — a dead exporter, a broken scrape, a crashed agent — where the absence is the alert.

• Infrastructure Metric Rules

  Named-metric guardrails: pods stuck Pending, consumer-group lag, replication lag, restart storms — metrics with a known-bad level.