How can an AI SRE see which values moved most during a disk filling up?

Tares gives an AI SRE the stats tool, which counts each value of one label in the current window against the window before and lists the largest change first. During a disk filling up, that shows which values moved most without reading lines one by one. Stats is one of the two default tools of a Tares agent, as described on Tools and MCP servers.

How it works

A Tares agent has two tools by default, read and stats. Both go through the same Tares read path. Both cover the sources of the projects the run is for, unless the agent names other sources with sources.

The stats tool works like this:

• You pick one label, and stats counts events per value of that label.
• It counts this window and the window before it.
• It sorts by change, largest first, so the values that moved most are at the top.

This suits a busy stream. When a disk is filling up, the stream around it can be noisy. Reading lines from a stream like that only shows the latest few, which can hide the values that changed. A ranked comparison of two windows puts the change first.

read is the other default tool. It returns one correlated timeline for an entity. Use stats to see which values changed, and read to look at one entity’s timeline.

By default a Tares agent reads and concludes. It does not act, so it does not restart, deploy or ticket anything. The AI SRE guide, AI SRE, covers how this fits into a wider workflow.

Set it up

1. Start Tares locally, or use Tares Cloud. On a local install, run:

   tares up

2. Check that the project the run is for holds the sources that carry your disk signals. Stats covers the sources of the projects its run is for by default.

3. Check that those sources declare a label for the field you want ranked, such as a host or a service name. stats counts per value of one label, so the label has to exist on the events.

4. If a run should look at specific sources instead of the project’s own, name them with sources.

5. When the disk starts filling, read the agent’s run to see what it found. The tools page describes the agent’s tools and their scope, so you can compare the values it ranked with the label you chose.

The stats tool is already part of every agent’s default tools, so there is nothing to switch on. See Tools and MCP servers for the full list of default tools.

What you get

• A ranked view of change. Each value of the label you chose is counted in this window and in the window before, with the largest change first.
• Less noise than reading lines. On a busy stream you see the values that moved most instead of only the latest few lines.
• The same scope as read. Both tools cover the sources of the projects the run is for, so the ranking and the timeline come from the same data.
• A read-only default. The agent reads and concludes. It does not act on the host that is running out of disk unless you connect external tools.

When something else fits

• Use read when you already know the entity and want one correlated timeline for it, rather than a ranking of values.
• Connect an external MCP server on the tools page if an agent should act, for example to open a ticket. Tools from such a server can act on whatever the server exposes, and each run records the external tools it called.

Related