Alerts

alert: DovecotDown
expr: node_systemd_unit_state{name="dovecot.service",state="active"}
  == 0
for: 2m
labels:
  service: dovecot
  severity: critical
annotations:
  description: Dovecot has been inactive for more than 2 minutes
  summary: Dovecot is down on {{ $labels.instance }}

alert: PostfixDown
expr: node_systemd_unit_state{name="postfix.service",state="active"}
  == 0
for: 2m
labels:
  service: postfix
  severity: critical
annotations:
  description: Postfix has been inactive for more than 2 minutes
  summary: Postfix is down on {{ $labels.instance }}

alert: PostfixMailQueueCritical
expr: node_postfix_queue_size
  > 200
for: 5m
labels:
  service: postfix
  severity: critical
annotations:
  description: Mail queue has {{ $value }} messages — possible delivery failure
  summary: Postfix mail queue critical on {{ $labels.instance }}

alert: PostfixMailQueueGrowing
expr: node_postfix_queue_size
  > 50
for: 15m
labels:
  service: postfix
  severity: warning
annotations:
  description: Mail queue has {{ $value }} messages
  summary: Postfix mail queue growing on {{ $labels.instance }}

alert: CriticalCPULoad
expr: (1
  - avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m]))) * 100
  > 95
for: 5m
labels:
  severity: critical
annotations:
  description: CPU {{ printf "%.1f" $value }}% (avg all cores, threshold 95%)
  summary: Critical CPU load on {{ $labels.instance }}

alert: CriticalLoadAverage
expr: node_load15 >
  10
for: 10m
labels:
  severity: critical
annotations:
  description: 15-min load avg {{ printf "%.2f" $value }} (threshold 10)
  summary: Critical load average on {{ $labels.instance }}

alert: HighCPULoad
expr: (1
  - avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m]))) * 100
  > 85
for: 10m
labels:
  severity: warning
annotations:
  description: CPU {{ printf "%.1f" $value }}% (avg all cores, threshold 85%)
  summary: High CPU load on {{ $labels.instance }}

alert: HighLoadAverage
expr: node_load15 >
  6
for: 15m
labels:
  severity: warning
annotations:
  description: 15-min load avg {{ printf "%.2f" $value }} (threshold 6)
  summary: High load average on {{ $labels.instance }}

alert: ApacheDown
expr: node_systemd_unit_state{name="apache2.service",state="active"}
  == 0
for: 1m
labels:
  service: apache2
  severity: critical
annotations:
  description: Apache has been inactive for more than 1 minute
  summary: Apache is down on {{ $labels.instance }}

alert: NginxDown
expr: node_systemd_unit_state{name="nginx.service",state="active"}
  == 0
for: 1m
labels:
  service: nginx
  severity: critical
annotations:
  description: Nginx has been inactive for more than 1 minute
  summary: Nginx is down on {{ $labels.instance }}

alert: SSLCertExpiringCritical
expr: probe_ssl_earliest_cert_expiry
  - time() < 86400 * 7
for: 1h
labels:
  severity: critical
annotations:
  description: Certificate expires in {{ $value | humanizeDuration }}
  summary: 'SSL certificate expiring in 7 days: {{ $labels.instance }}'

alert: SSLCertExpiringWarning
expr: probe_ssl_earliest_cert_expiry
  - time() < 86400 * 30
for: 1h
labels:
  severity: warning
annotations:
  description: Certificate expires in {{ $value | humanizeDuration }}
  summary: 'SSL certificate expiring soon: {{ $labels.instance }}'