Saturation Alerts vs Utilisation Alerts

Utilisation is what you have used; saturation is what you have left. Why saturation alerts fire earlier and better.

Utilisation

Saturation and utilization measure different things. Utilization is how much of a resource has been used; saturation is the degree to which the resource is overloaded. The two are sometimes correlated but not always; alerting only on utilization misses saturation that arrives before utilization peaks.

What utilization measures:

• CPU at 80%; disk at 70%.: The number is the percentage of the resource that has been consumed. CPU at 80% means 80% of the cycles are in use; disk at 70% means 70% of the storage is full.
• The number you have used.: Utilization is a backward-looking measure: out of total capacity, how much has been claimed. The metric is intuitive but limited.
• Useful for trends.: Utilization trends matter. Disk filling at 1% per day projects when it will be full. CPU averaging higher week-over-week indicates capacity pressure. The trends are useful for capacity planning.
• But late as a leading indicator.: By the time utilization is high, the saturation has often already started. The user-visible impact arrives before the utilization metric crosses the alert threshold.
• Capacity planning vs operational alerting.: Utilization is the right metric for capacity planning. It is a poor metric for operational alerting because it lags the user impact.

Utilization is the basic resource metric. It serves capacity planning well; it serves alerting poorly.

Saturation

Saturation measures overload directly. Queue depth, wait time, throttle events all indicate that the resource is overwhelmed. The metric fires before utilization peaks; the alert is more timely.

• Queue depth.: Requests waiting in queue indicate the system cannot keep up. Queue depth above zero means saturation; growing queue depth means worsening saturation.
• Wait time.: The time requests spend waiting for resources. High wait time indicates the resource is overloaded; users feel the wait time directly.
• Throttle events.: Rate-limited requests, dropped connections, queue overflows. Each is a saturation symptom; their presence indicates the resource has exceeded its capacity.
• The number telling you the resource is overloaded.: Saturation tells you the answer the user cares about: is the resource keeping up with demand? Utilization tells you how much capacity is used; saturation tells you whether it is enough.
• Fires earlier.: CPU at 80% might be fine; queue depth growing while CPU is at 80% is not. The saturation signal arrives before the utilization signal.

Saturation is the operational metric. It captures user impact directly; it fires early enough to drive useful action.

Alert on saturation

The right alerting strategy uses saturation, not utilization, for operational signals. Capacity planning still uses utilization; the operational alerts focus on saturation.

• Queue depth over N for M minutes.: Specific saturation alerts watch for queue depth above thresholds. The alert fires when the queue is sustainedly above the threshold; transient spikes are filtered out.
• Pager fires before users notice.: Saturation alerts catch the issue before user impact becomes visible. The team responds to the leading indicator; the user impact is prevented or minimized.
• Most teams alert on utilization only.: The default alerting strategy is "CPU above 90% pages, disk above 95% pages". The strategy is intuitive; the strategy is also late.
• Add saturation alerts.: The team adds saturation alerts on top of (not instead of) utilization. The combination produces complete coverage; saturation catches early; utilization confirms.
• The leading indicator catches issues earlier.: Saturation alerts produce earlier intervention. The total incident impact is reduced; the response is timely.

Saturation alert vs utilization is one of those alerting disciplines that pays off in faster incident response. Nova AI Ops integrates with telemetry across both dimensions, surfaces saturation patterns, and produces the leading-indicator alerts that catch issues before users notice.