A system and method for monitoring a heating, ventilation, or air conditioning (HVAC) system of a building is provided. A monitoring server, located remotely from the building, receives operating parameter data from a monitoring device at the building that measures an operating parameter of the HVAC system. The monitoring server generates a plurality of data clusters from the operating parameter data, each data cluster corresponding to operating parameter data generated during steady-state operation of the HVAC system. The monitoring server calculates an average operating parameter value for each data cluster. The monitoring server calculates normalized operating parameter values based on normalizing the average operating parameter values for the data clusters over a predetermined normalization time period. The monitoring server compares the normalized operating parameter values with a threshold. The monitoring server determine whether an air filter of the HVAC system needs to be replaced based on the comparison and generates a notification based on the determination indicating that the air filter needs to be replaced.