What the charts show
CPU is a fraction of total capacity across every core, fully loaded reads as 100%, never a raw per-core number. Memory used is total minus what the kernel reports as available, not minus what it reports as free, which is the reading that actually predicts an out-of-memory kill. Disk is tracked per mounted filesystem, up to 32 per machine. Load average is the kernel's raw 1, 5, and 15 minute numbers, not normalized by core count, since a load of 4 means something different on a 2-core box than on a 32-core one and normalizing would hide that.
A sample lands about once a minute. The very first sample after the agent starts establishes a baseline for the CPU reading and is not charted, so the first real data point appears roughly a minute after the agent comes up.
Threshold alerts
Two conditions alert on their own, without a check or monitor configured for them: disk almost full and out of memory. Both use a sustained-reading rule rather than firing on a single sample, since one high reading is often routine, a backup job, a build, a garbage-collection pause, and the plan is to catch a real state, not a moment.
| Condition | Fires | Clears |
|---|---|---|
| Disk almost full | 2 sustained readings at or above 90% used | 5 sustained readings at or below 88% used |
| Out of memory | 5 sustained readings at or below 10% available | 5 sustained readings at or above 12% available |
The firing and clearing lines are deliberately different (control-theory hysteresis), so a filesystem or a memory reading sitting right on the edge does not open and close on ordinary measurement noise. A condition that keeps flapping open and closed gets suppressed after repeated cycles in a day, replaced by one notice that it is flapping, rather than repeating the same alert over and over.
Both alerts flow through the same email, Slack, webhook, and PagerDuty channels every other alert on the account uses. CPU and load are charted but do not alert on their own in this first pass: they are the flap-happiest of the four readings, so alerting on them starts once the pattern is well understood from real accounts running it.