Earlier quoted context omitted.
Surely a 50% warning alarm on disk usage covers this without manual intervention?
You don't want an alarm on a usage threshold, you want a linear regression that predicts when utilization will cross a threshold. Then you set your alarms for "How long does it take me to remediate this condition?"
And a single large dump to disk, like some daemon suddenly bugging out and writing incessantly to logs, will render all that moot anyway.