Predictive Analysis & Alerting
Forecast lists the monitored counters whose recent trend is heading toward a configured threshold, together with the date each one is expected to cross it. It turns NetCrunch's historical trend data into early warning, so you can deal with a disk that is filling up or memory that is leaking before it triggers a hard alert.
A counter appears in Forecast when it has a Predictive Threshold alert and its recent history shows a statistically sound trend that reaches the configured limit within the prediction period. Forecast is available on the global Alerts › Forecast page (scoped to the selected view) and on each node's Alerts › Forecast tab.
Setting it up
A counter is forecast when it carries a Predictive Threshold alert. Most of these come from monitoring packs — a pack can include predictive thresholds in its default alert set, so they are applied automatically to every node the pack monitors. You can also add or tune one on an individual counter in its threshold editor:
- Open the counter's threshold/alert configuration.
- Add a threshold of type Predictive Threshold.
- Set the limit and direction — raising (value climbing above it, e.g. memory used
>90%) or falling (value dropping below it, e.g. free disk space<10%). - Set the prediction period — how many days ahead the trend may reach the limit.
- Set the Prediction quality — the minimum trend quality before it fires (Low / Normal / High).
The predictive analyzer recalculates on a schedule (daily by default), so a threshold appears in Forecast after the next run, once there is enough history to fit a trend.
How it works
For each predictive threshold the analyzer reads the counter's history from the Trend Database and fits a least-squares linear regression, value ≈ α + β·t, where α (intercept) is the value at the start of the analyzed window and β (slope) is the average change per sample. The line is extended into the future, and the point where it reaches the threshold is the projected breach time shown as the breach date and ETA. A band of ±1 residual standard deviation around the line is used to discard "breaches" that fall within the noise of the data.
Each row's sparkline shows the observed trend (solid) continuing as the projection (colored) up to the red breach marker, against the dashed threshold line, with the current value at the cursor.
Good and poor candidates
Forecasting works on metrics that change slowly and roughly monotonically — where "more of the same" leads to a wall:
- Good: disk and volume space (used or free), database and table sizes, log and file growth, committed or available memory, inode usage, license or session counts.
- Poor: volatile or cyclic metrics — CPU utilization, network throughput, request/transaction rates, queue lengths. These swing with load and rarely trend toward a fixed limit.
The model is a single straight line, so it does not account for seasonality. A counter with daily or weekly cycles (business hours, nightly jobs, weekend dips) will not fit a line well — it yields a low-quality, often misleading projection and is filtered out. Predict on the slow underlying resource (e.g. disk space), not on the cyclic load that consumes it.
Confidence and quality
Two related but distinct settings use the word "quality":
- Prediction quality (set on the threshold) is the bar a trend must clear before the alert fires — Low, Normal, or High. It controls how selective NetCrunch is.
- Confidence (the Forecast column) reports how strong the detected trend actually is for a given prediction — High, Medium, or Low.
Both derive from a trend-quality index in the range 0–1 that measures how well a straight line really describes the data. It is a weighted blend of: R² (variation explained by the line); residual spread (how tightly points sit on the line); slope significance (a t-test that β is real, not chance); homoscedasticity (a Breusch–Pagan test that the scatter stays even and doesn't fan out); normality (a Shapiro–Wilk test that residuals look like random noise); and data sufficiency (enough samples and fill rate over the window). In Forecast, an index of about 0.75 and up reads as High, roughly 0.35–0.75 as Medium, and below that as Low. A clean, steadily changing series with little noise scores near 1; a noisy, curved, or cyclic series scores low and is treated as not predictable.
Default Alerts with predictive threshold
Monitoring Packs:
- Windows\Disk, Windows\Memory
- Linux\Disk, Linux\Memory
- Solaris\Disk, Solaris\Memory
- Mac Os X\Disk, Mac Os X\Memory
- BSD\Disk, BSD\Memory
- VMware\Disk, VMware\Memory
- Proxmox\Disk, Proxmox\Memory
There are two alerts in each Monitoring Pack:
- Volume Free Space will be low soon (%Free Space < 20) (Disk free space will be less than 20% within 1 to 30 days)
- Volume Free Space will be very low soon (%Free Space < 5) (Disk fee space will be less than 5% within 1 to 30 days)