Forecasting when a disk will fill, and when not to bother

A full disk is one of the few outages that announces itself weeks ahead and still takes people by surprise. The data is right there; nobody is looking at it. So we fit a line to it and alert on the intercept.

Why linear regression is enough

There is a temptation to reach for something sophisticated. Resist it. The overwhelming majority of disk-fill curves are boringly linear: logs accumulate at a steady rate, a database grows with a steady customer base, backups land on a schedule. A least-squares fit over a couple of weeks of samples predicts the crossing date well enough to act on, and - crucially - it is explainable. When it says *this volume fills in 11 days*, you can see the line.

Sophisticated models fail differently: they are right more often and wrong in ways nobody can debug at 3am. For a signal whose entire job is to give you a fortnight of warning, that is a bad trade.

When the forecast is meaningless

Knowing when to say nothing is most of the work here. We suppress the forecast when:

• the slope is negative or flat - the volume is not filling, and a date is not information;
• the fit is poor, because the series is sawtoothed rather than trending: a volume that fills and is truncated by log rotation every week has no crossing date;
• the predicted date is further out than the window we fitted on, where the extrapolation says more about the fit than the disk;
• the volume is tiny, where a single package install moves the line by weeks.

The same shape works for memory

Memory forecasting uses the same fit, with one difference in interpretation: a steady upward slope in used memory that never resets is usually a leak rather than growth, and the useful alert is about the slope existing at all, not about the date it reaches the ceiling.

Both forecasts are computed on the panel from stored samples, so they cost the monitored host nothing.