Alerts

alert: Fail2banServiceDown
expr: node_systemd_unit_state{name="fail2ban.service",state="active"}
  == 0
for: 1m
labels:
  severity: warning
annotations:
  description: Fail2ban is inactive on {{ $labels.instance }}. SSH brute-force defense
    is unmonitored.
  summary: Fail2ban Security Service Down

alert: UnauthorizedPortScanningSpike
expr: rate(node_netstat_Tcp_AttemptFails[2m])
  > 10
for: 1m
labels:
  severity: critical
annotations:
  description: Over 10 failed TCP connection attempts/sec detected on server host.
  summary: Unauthorized Port Scan or TCP Attack Detected

alert: ShantiProd4xxClientError
expr: probe_http_status_code{instance="https://app.shanti.click"}
  >= 400 and probe_http_status_code{instance="https://app.shanti.click"}
  < 500
for: 2m
labels:
  severity: warning
annotations:
  description: URL https://app.shanti.click returned HTTP status {{ $value }}.
  summary: Shanti Production HTTP 4xx Client Error

alert: ShantiProd5xxServerError
expr: probe_http_status_code{instance="https://app.shanti.click"}
  >= 500
for: 15s
labels:
  severity: critical
annotations:
  description: URL https://app.shanti.click returned HTTP status {{ $value }} (e.g.
    502 Bad Gateway). Backend container or DB is failing.
  summary: Shanti Production HTTP 5xx Server Error

alert: ShantiProdContainerDown
expr: (time()
  - container_last_seen{name=~".*shanti_prod_app.*"} > 30) or (probe_success{instance="https://app.shanti.click"}
  == 0)
for: 15s
labels:
  severity: critical
annotations:
  description: Container shanti_prod_app has not updated metrics in > 30s.
  summary: 'Docker Container Down: shanti_prod_app'

alert: ShantiProdDatabaseDown
expr: (time()
  - container_last_seen{container_label_com_docker_compose_service="shanti_prod_db"}
  > 30) or absent(container_last_seen{container_label_com_docker_compose_service="shanti_prod_db"})
for: 15s
labels:
  severity: critical
annotations:
  description: The production database container 'shanti_prod_db' has stopped
    or has not reported metrics for more than 30 seconds.
  summary: 'Database Container Down: shanti_prod_db'

alert: ShantiProdEndpointDown
expr: probe_success{instance="https://app.shanti.click"}
  == 0
for: 30s
labels:
  severity: critical
annotations:
  description: URL https://app.shanti.click is completely unreachable or timing out.
  summary: 'Production Endpoint Down: app.shanti.click'

alert: HighCpuUsage
expr: 100
  - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)
  > 90
for: 5m
labels:
  severity: warning
annotations:
  description: 'CPU load is above 90% for over 5 minutes (Current: {{ $value | printf
    "%.1f" }}%).'
  summary: High CPU Usage on {{ $labels.instance }}

alert: HighDiskUsage
expr: ((node_filesystem_size_bytes{mountpoint="/"}
  - node_filesystem_free_bytes{mountpoint="/"}) / node_filesystem_size_bytes{mountpoint="/"})
  * 100 > 85
for: 5m
labels:
  severity: critical
annotations:
  description: Root partition `/` is {{ $value | printf "%.1f" }}% full.
  summary: Low Disk Space on {{ $labels.instance }}

alert: HighMemoryUsage
expr: ((node_memory_MemTotal_bytes
  - node_memory_MemAvailable_bytes) / node_memory_MemTotal_bytes) * 100 > 85
for: 3m
labels:
  severity: critical
annotations:
  description: 'RAM usage is above 85% (Current: {{ $value | printf "%.1f"
    }}%). Risk of OOM container kills.'
  summary: High Memory Usage on {{ $labels.instance }}