Most alerting is a smoke detector: it tells you the building is on fire. Preventive alerting is the part that notices the wiring getting warm three weeks earlier. Almost every outage has a leading indicator, and almost none of them get watched.
The signals that predict downtime
Certificates and domains. SSL expiry is the most preventable outage in existence, it still takes down major services monthly. Warn at 30 days, escalate at 7. Same for domain renewals.
Disk fill rate. A disk does not go from fine to full instantly, it grows for weeks. Alert on the trend, not the threshold: at this growth rate the volume fills in 14 days is actionable, 95 percent full at 2 AM is just a bad night.
Memory leaks. Slowly rising memory that never releases is a crash scheduled for next week. Watching the process RSS trend catches it while a restart is still a choice, not an emergency.
Certificate chains and config drift. A renewed cert deployed to one of three servers, a firewall rule that expires, a dependency deprecating an API version. These produce weird partial failures that external checks flag as intermittent long before users complain loudly.
Dependency health. Your app can be green while the payment provider, the object storage, or the auth service upstream is quietly timing out. Monitor the critical paths through dependencies, not just your own edge.
Why teams skip this
Preventive alerts do not feel urgent because nothing is broken yet, so the alerts get set to quiet channels and ignored. The fix is a routing rule: warnings go to a low-urgency channel someone reviews weekly, escalations to the normal on-call path. Cert in 30 days is a ticket. Cert in 48 hours is a page.
The compound effect
Every leading indicator you catch converts a 2 AM incident into a Tuesday afternoon task. Over a year, the difference between "we had 3 outages" and "we had 12" is mostly which warnings got watched.