Delta diskfill alert?

[jringoot]

Hello all,
(It's my first post here, of possibly many )

I would like to make a curve/graph and an alert for the speed of reduction of free disk-space.

Concrete: for /var I would like to see a curve of
"The free space percentage @ time (T minus 5 minutes) minus the free space percentage @ time (T)"
recorded with an interval of 5 minutes and giving an alert if the reduction of free space is more than 2% of the total disk-space in 30 minutes.
And optional warning at 1% and a disaster at 5% or 10% can be useful as well

The curve will go negative when the space is recuperated, I haven't seen a below zero curve in Zabbix yet but that should not be a problem no?

Why I need this?
The rapid reduction of free disk-space of /var can have many foreseeable and unforeseeable causes but is very often an indicator for an imminent serious issue with the server.
An early detection of rapid free space decrease can give the Sysadmin an early hint to investigate deeper.

At the pace of 2% fill/(half hour) it will take 2.5 hour to lose 10% free space.
With 60% free space, having an alert when free space is reduced to 50% may seem meaningless.
But not if it is at the speed of 4%/hour, then the disk will be 100% filled after 10 hour.
An alert the first hour is very useful then.

Does anyone have experience with this kind of curves/alerts?

I already tried some things with the expression wizards of Zabbix but no success yet.
I have searched superficially in the forum but could not find anything either.
I post this because to me it seems such a standard issue/request that I suspect a solution already exists.

Awaiting your experiences I will start RTFM.
When I find it I'll post the solution, because I estimate this is useful for many.

Joost

[mbrand5371]

Hi Joost.
I've configured an item/trigger that is near to your need an can be an hint for you.

Just the item:

Item Prototype Name: Filesystem $1 full evaluate (in h)
Item Prototype type: calculated
Item Prototype Key: vfs.fs.grow[{#FSNAME}]
Item Prototype Formula: avg("vfs.fs.size[{#FSNAME},free]")/(abschange("vfs.fs.size[{#FSNAME},free]")+1)
Type of information: Numeric (unsigned)
Data type: Decimal
Units: h
Update interval (in sec): 3600

And the trigger:

And the trigger:
Trigger Name: Filesystem {#FSNAME} will be filled in less than 48h
Trigger Expression:  {LSKN discovered Template OS Linux by ZABBIX Agent:vfs.fs.grow[{#FSNAME}].last(0)}<48 | {LSKN discovered Template OS Linux by ZABBIX Agent:vfs.fs.grow[{#FSNAME}].last(0)}=48

So i divide the vfs.fs.size of the last hour (Update interval) using the "abchange" value to get the time in hours when the filesystem is filled.
The trigger will send me an alert, when the filesystem is filled in less than 48h.

Regards, Marcus