booksync/_docker/alertmanager/alert.rules/alerts.rules.yml

groups:
 
- name: Alertes monitoring
  rules:
  - alert: NodeHasSwapIn
    expr: irate(node_vmstat_pswpin{job="prod"}[5m]) > 0 
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Node has swap in (instance {{ $labels.instance }})"
      description: "<!channel>  La VM SWAP (in)  LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: NodeHasSwapOut
    expr: irate(node_vmstat_pswpin{job="prod"}[5m]) > 0 
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Node has swap out (instance {{ $labels.instance }})"
      description: "<!channel>  La VM SWAP (out)  LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: OutOfInodes
    expr: node_filesystem_files_free{mountpoint ="/rootfs"} / node_filesystem_files{mountpoint ="/rootfs"} * 100 < 10
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Out of inodes (instance {{ $labels.instance }})"
      description: "<!channel>  Le disque n'a presque plus d'inode (< 10% restant)    VALUE = {{ humanize $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"


  - alert: OutOfMemory
    expr: (node_memory_MemFree_bytes + node_memory_Cached_bytes + node_memory_Buffers_bytes) / node_memory_MemTotal_bytes * 100 < 10
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Out of memory (instance {{ $labels.instance }})"
      description: "<!channel>  L'hôte n'a presque plus de RAM (< 10% restant)    VALUE = {{ $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"


  - alert: UnusualNetworkThroughputIn
    expr: sum by (instance) (irate(node_network_receive_bytes_total[2m])) / 1024 / 1024 > 100
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Unusual network throughput in (instance {{ $labels.instance }})"
      description: "<!channel>  Les interfaces réseau reçoivent sans doute trop de données (> 100 MB/s)    VALUE = {{ $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: UnusualNetworkThroughputOut
    expr: sum by (instance) (irate(node_network_transmit_bytes_total[2m])) / 1024 / 1024 > 100
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Unusual network throughput out (instance {{ $labels.instance }})"
      description: "<!channel>  Les interfaces réseau envoient sans doute trop de données (> 100 MB/s)    VALUE = {{ $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: UnusualDiskReadRate
    expr: sum by (instance) (irate(node_disk_read_bytes_total[2m])) / 1024 / 1024 > 50
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Unusual disk read rate (instance {{ $labels.instance }})"
      description: "<!channel>  Le disque lit sans doute trop de données (> 50 MB/s)    VALUE = {{ $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: UnusualDiskWriteRate
    expr: sum by (instance) (irate(node_disk_written_bytes_total[2m])) / 1024 / 1024 > 50
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Unusual disk write rate (instance {{ $labels.instance }})"
      description: "<!channel>  Le disque écrit sans doute trop de données (> 50 MB/s)    VALUE = {{ $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: OutOfDiskSpace
    expr: node_filesystem_free_bytes{mountpoint ="/"} / node_filesystem_size_bytes{mountpoint ="/"} * 100 < 20
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Out of disk space (instance {{ $labels.instance }})"
      description: "<!channel>  L'espace disque est presque complet (< 20% restant)    VALUE = {{ $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: UnusualDiskReadLatency
    expr: rate(node_disk_read_time_seconds_total[1m]) / rate(node_disk_reads_completed_total[1m]) > 100
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Unusual disk read latency (instance {{ $labels.instance }})"
      description: "<!channel>  La latence du disque augmente  (read operations > 100ms)    VALUE = {{ $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: CpuLoad
    expr: node_load15 / (count without (cpu, mode) (node_cpu_seconds_total{mode="system"})) > 2
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "CPU load (instance {{ $labels.instance }})"
      description: "<!channel>  La charge CPU (15m) est élevée    VALUE = {{ $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: ContextSwitching
    expr: rate(node_context_switches_total[5m]) > ((count without (cpu, mode) (node_cpu_seconds_total{mode="system"})) * 1500) 
    for: 15m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Context switching (instance {{ $labels.instance }})"
      description: "<!channel>  Le contexte switch augement sur l'hôte   VALUE = {{ $value }}    LABELS: {{ $labels.job }} : {{ $labels.instance }}"

  - alert: Health endpoint down
    expr: probe_success == 0
    for: 10s
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "Health endpoint is down"
      description: "<!channel>  L'URL ne répond pas : {{ $labels.addresse }}"

  - alert: Certificate exprire
    expr: probe_ssl_earliest_cert_expiry{job="blackbox"} - time() < 86400 * 30
    for: 10m
    labels:
      severity: critique
    annotations:
      identifier: "{{ $labels.instance }}"
      summary: "SSL certificate expire"
      description: "<!channel>  Le certificat SSL exprire dans 3 mois {{ $labels.addresse }}"