Alerts

alert: KeycloakAuditAdminProbeAbsent
expr: absent(keycloak_audit_admin_probe_last_success_seconds)
for: 1d2h
labels:
  invariant: INV-IAM-09
  pd_ref: PD-235
  severity: critical
annotations:
  description: Aucune métrique keycloak_audit_admin_probe_last_success_seconds.
  summary: Preuve d'écriture des événements d'administration jamais réussie

alert: KeycloakAuditReconciliationAbsent
expr: absent(keycloak_audit_reconciliation_success)
for: 1d2h
labels:
  invariant: INV-IAM-09
  pd_ref: PD-235
  severity: critical
annotations:
  description: Aucune métrique de réconciliation depuis plus de 26 h (cron quotidien
    de 02:00).
  summary: Réconciliation d'audit Keycloak non exécutée

alert: KeycloakAuditSourceMetricsAbsent
expr: absent(keycloak_audit_source_up)
for: 15m
labels:
  invariant: INV-IAM-09
  pd_ref: PD-235
  severity: critical
annotations:
  description: 'Aucune métrique keycloak_audit_source_up : la lecture de la source
    n'est pas exécutée.'
  summary: Métriques de la source d'audit Keycloak absentes

alert: KeycloakAuditAdminProbeStale
expr: time()
  - keycloak_audit_admin_probe_last_success_seconds > 97200
for: 10m
labels:
  invariant: INV-IAM-09
  pd_ref: PD-235
  severity: critical
annotations:
  description: Aucun événement d'administration de sonde retrouvé depuis plus
    de 97200 s (déploiement nocturne).
  summary: Preuve d'écriture des événements d'administration périmée

alert: KeycloakAuditReconciliationFailed
expr: keycloak_audit_reconciliation_success
  == 0
for: 1m
labels:
  invariant: INV-IAM-09
  pd_ref: PD-235
  severity: critical
annotations:
  description: Source illisible ou retention inferieure a 3 jours.
  summary: Reconciliation d'audit Keycloak en echec

alert: KeycloakAuditReconciliationStale
expr: time()
  - keycloak_audit_reconciliation_last_success_seconds > 97200
for: 10m
labels:
  invariant: INV-IAM-09
  pd_ref: PD-235
  severity: critical
annotations:
  description: Dernière réconciliation réussie il y a plus de 97200 s (cron quotidien
    de 02:00).
  summary: Aucune réconciliation d'audit Keycloak réussie récemment

alert: KeycloakAuditSourceDown
expr: keycloak_audit_source_up
  == 0
for: 5m
labels:
  invariant: INV-IAM-09
  pd_ref: PD-235
  severity: critical
annotations:
  description: Le stockage d'evenements de Keycloak n'est pas lisible par
    l'API d'administration.
  summary: Source d'audit Keycloak illisible

alert: KeycloakAuditSourceStale
expr: time()
  - keycloak_audit_source_last_success_seconds > 900
for: 5m
labels:
  invariant: INV-IAM-09
  pd_ref: PD-235
  severity: warning
annotations:
  description: Aucune lecture reussie du stockage d'evenements depuis plus de
    900 s.
  summary: Source d'audit Keycloak non lue recemment

alert: HighErrorRate5xx
expr: ((sum(increase(http_requests_total{status=~"5.."}[5m]))
  / sum(increase(http_requests_total[5m]))) * 100 >= 5) and sum(increase(http_requests_total[5m]))
  >= 20 and sum(increase(http_requests_total{status=~"5.."}[5m])) >=
  5
for: 2m
labels:
  component: api
  pv_alert_kind: errorrate
  severity: critical
annotations:
  description: Le taux de réponses 5xx applicatives dépasse 5% sur 5 min (>= 20
    requêtes, >= 5 erreurs 5xx).
  runbook: docs/runbooks/alerting5xx-high-5xx.md
  summary: High 5xx error rate (>= 5%)

alert: DiskSpaceCritical
expr: (node_filesystem_avail_bytes{mountpoint="/"}
  / node_filesystem_size_bytes{mountpoint="/"}) * 100 < 5
for: 2m
labels:
  severity: critical
annotations:
  description: Disk space < 5% on {{ $labels.instance }}
  summary: Critical disk space

alert: DiskSpaceLow
expr: (node_filesystem_avail_bytes{mountpoint="/"}
  / node_filesystem_size_bytes{mountpoint="/"}) * 100 < 15
for: 5m
labels:
  severity: warning
annotations:
  description: Disk space < 15% on {{ $labels.instance }}
  summary: Low disk space

alert: HighCPUUsage
expr: 100
  - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)
  > 80
for: 10m
labels:
  severity: warning
annotations:
  description: CPU usage > 80% on {{ $labels.instance }}
  summary: High CPU usage

alert: HighMemoryUsage
expr: (1
  - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100 > 85
for: 5m
labels:
  severity: warning
annotations:
  description: Memory usage > 85% on {{ $labels.instance }}
  summary: High memory usage

alert: NodeDown
expr: up{job="node"}
  == 0
for: 2m
labels:
  severity: critical
annotations:
  description: '{{ $labels.instance }} is down'
  summary: Node exporter down

alert: PostgreSQLDeadlocks
expr: increase(pg_stat_database_deadlocks[5m])
  > 0
for: 1m
labels:
  severity: warning
annotations:
  description: Deadlocks detected on {{ $labels.datname }}
  summary: PostgreSQL deadlocks

alert: PostgreSQLDown
expr: pg_up == 0
for: 1m
labels:
  severity: critical
annotations:
  description: PostgreSQL on {{ $labels.instance }} is down
  summary: PostgreSQL is down

alert: PostgreSQLSlowQueries
expr: rate(pg_stat_statements_seconds_total[5m])
  > 1
for: 10m
labels:
  severity: warning
annotations:
  description: High query time on {{ $labels.instance }}
  summary: Slow queries detected

alert: PostgreSQLTooManyConnections
expr: pg_stat_activity_count
  > 80
for: 5m
labels:
  severity: warning
annotations:
  description: '{{ $value }} connections (>80)'
  summary: PostgreSQL connections high

alert: APIDown
expr: up{job="api"}
  == 0
for: 2m
labels:
  severity: critical
annotations:
  description: ProbatioVault API is not responding
  summary: API Backend down

alert: GrafanaDown
expr: probe_success{instance=~".*grafana.*"}
  == 0
for: 3m
labels:
  severity: warning
annotations:
  description: Grafana dashboard is not responding
  summary: Grafana unreachable

alert: PrometheusDown
expr: up{job="prometheus"}
  == 0
for: 1m
labels:
  severity: critical
annotations:
  description: Prometheus monitoring is down
  summary: Prometheus down

alert: ServiceDown
expr: probe_success
  == 0
for: 3m
labels:
  severity: critical
annotations:
  description: '{{ $labels.instance }} is not responding'
  summary: Service unreachable

alert: SonarQubeDown
expr: probe_success{instance=~".*sonar.*"}
  == 0
for: 5m
labels:
  severity: warning
annotations:
  description: SonarQube is not responding
  summary: SonarQube unreachable

alert: SSLCertExpired
expr: probe_ssl_earliest_cert_expiry
  - time() < 0
for: 1m
labels:
  severity: critical
annotations:
  description: Certificate for {{ $labels.instance }} has expired
  summary: SSL certificate expired

alert: SSLCertExpiringSoon
expr: probe_ssl_earliest_cert_expiry
  - time() < 86400 * 14
for: 1h
labels:
  severity: warning
annotations:
  description: Certificate for {{ $labels.instance }} expires in < 14 days
  summary: SSL certificate expiring soon