A controller includes at least one processor coupled to a memory storing instructions that, when executed by the at least one processor, cause the at least one processor to: perform operations comprising: determining a concentration of a plurality of wear metal particles in a lubricant for an engine system; determining a filtered concentration of the plurality of wear metal particles using a baseline concentration of the plurality of wear metal particles; setting a diagnostic threshold based on the filtered concentration of the wear metal particles; and, responsive to determining that the concentration of the wear metal particles exceeds the diagnostic threshold, providing a notification.