//
// Some Common Performance Monitoring Scenarios
//
// The File System Group
//

// common prefixes
//
fsys	= "filesys";


//
// Either the /tmp or the /usr filesystem being
// more than 95% full
//

delta = 5 mins;		// often enough for file system fullness?

tmp_full =
    $fsys.free #'/dev/root' / $fsys.capacity #'/dev/root' < 0.05
    -> syslog "/dev/root filesystem (almost) full";

usr_full =
    $fsys.free #'/dev/usr' / $fsys.capacity #'/dev/usr' < 0.05
    -> syslog "/dev/usr filesystem (almost) full";

//
// Some read activity through the buffer cache and the cache read
// hit ratio is less than 80%
// (lots of file system reads causing physical I/O)
//

delta = 1 min;			// check every minute

blkio = "kernel.all.io";
poor_read_hits =
    (($blkio.lread - $blkio.bread) / $blkio.lread) < 0.8 && $blkio.lread > 100
	-> alarm 20 min "poor buffer cache read hit ratio (%v)";
	    // Note:	%v in alarm string is bound to the left most
	    //		expression in the predicate

//
// at least $threshold full and at the current rate of growth will fill
// the file system in less than $lead_time
// ie. used + $lead_time * growth-rate > capacity

delta = 1 min;		// check every minute
threshold = 40;		// must be at least this full now (percentage)
lead_time = "15min";	// lead time before the filesystem will be full

some_inst (
  100 * filesys.used / filesys.capacity > $threshold &&
  filesys.used + $lead_time * ( rate filesys.used ) >
	filesys.capacity 
) -> print "filesystem will be full within $lead_time:" " %i";