How do you get alerted before a disk fills up?

A percentage ignores rate. A 2 TB volume at 90 percent still has 200 GB; a 20 GB root volume at 70 percent with logs growing 5 GB a day fills tomorrow. Threshold alerts either page too late or nag for weeks about a disk that is fine. The number that matters is days until full at the current growth rate.

• •Logs that never rotate: nginx access logs, application logs, journald without a size cap
• •Docker: dangling images, stopped containers, build cache, and JSON log files for containers with no log-opts max-size
• •Backups and dumps written locally and never pruned
• •Package caches and old kernels on the root volume
• •Application uploads and cache directories on the same small root disk as the OS
• •Inodes rather than bytes: millions of tiny session or cache files on a disk that shows free space (check with df -i)

Record used bytes per mount over time and fit the trend; alert when the projected fill date is inside your response window, for example 7 days, and again at 48 hours. Opservo keeps the disk history from the heartbeats and, once it has enough samples to trust the trend, projects the fill date on every analysis: a warning when the disk fills within three weeks and a critical inside five days, each with the reclaim commands attached.

Opservo attaches the relevant one to the finding. The most common:

# find what grew
sudo du -xh --max-depth=2 /var | sort -h | tail -20
# rotate and cap logs
sudo journalctl --vacuum-size=500M
# reclaim Docker space
docker system prune -af --volumes
# cap container logs going forward (daemon.json)
{ "log-driver": "json-file", "log-opts": { "max-size": "50m", "max-file": "3" } }

A "clean filling disk" autonomous policy can run the safe subset (journal vacuum, Docker prune of unused images, rotated-log cleanup) automatically with a cooldown, on servers where remote actions are enabled.

A different alert. Opservo attributes kernel I/O errors, SCSI sense errors, ext4 or XFS complaints and ATA link resets to a device and raises one critical "disk is failing" alert with the smartctl and dmesg commands, and it reads raw SMART counters (reallocated, pending and uncorrectable sectors, CRC errors, NVMe media errors) rather than trusting the normalized "ok" value.