init prometheus监控配置文件

2026-07-09 10:12:19 +08:00
commit 5e9088793c
55 changed files with 205440 additions and 0 deletions
@@ -0,0 +1,133 @@
+groups:
+  - name: freeipa_alerts
+    rules:
+      # 1. FreeIPA 节点宕机 / node_exporter 挂了
+      - alert: FreeIPA_Node_Down
+        expr: up{job=~"freeipa|ipa"} == 0
+        for: 30s
+        labels:
+          severity: critical
+        annotations:
+          summary: "FreeIPA 节点失联"
+          description: "节点 {{ $labels.instance }} node-exporter 掉线超过30秒，主机不可达"
+
+      # 2. FreeIPA 核心综合服务异常（krb5kdc/httpd/ipa-custodia/pki-tomcatd）
+      - alert: FreeIPA_Service_Down
+        expr: sum by(instance,name) (node_systemd_unit_state{name=~"krb5kdc.service|httpd.service|ipa-custodia.service|pki-tomcatd@.*.service",state="active"}) != 1
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: "FreeIPA 核心服务异常停止"
+          description: "节点 {{ $labels.instance }} 服务 {{ $labels.name }} 未处于运行状态"
+
+      # 3. Kerberos KDC 认证服务异常
+      - alert: FreeIPA_Kerberos_Down
+        expr: sum by(instance,name) (node_systemd_unit_state{name="krb5kdc.service",state="active"}) != 1
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Kerberos KDC 认证服务异常"
+          description: "krb5kdc.service 停止，域用户无法完成Kerberos认证登录"
+
+      # 4. FreeIPA Web 管理界面 httpd 服务异常
+      - alert: FreeIPA_HTTP_Down
+        expr: sum by(instance,name) (node_systemd_unit_state{name="httpd.service",state="active"}) != 1
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: "FreeIPA Web 管理界面服务异常"
+          description: "httpd.service 已停止，无法访问IPA网页管理端"
+
+      # 5. PKI 证书签发服务 pki-tomcatd 异常
+      - alert: FreeIPA_PKI_Tomcat_Down
+        expr: sum by(instance,name) (node_systemd_unit_state{name=~"pki-tomcatd@.*.service",state="active"}) != 1
+        for: 2m
+        labels:
+          severity: warning
+        annotations:
+          summary: "FreeIPA PKI 证书服务异常"
+          description: "pki-tomcatd 证书签发服务停止，新证书无法申请下发"
+
+      # 6. 专属监控 dirsrv@ADVANTEST-COM.service 389 LDAP目录服务停机
+      - alert: DirsrvServiceDown
+        expr: sum by(instance,name) (node_systemd_unit_state{name="dirsrv@ADVANTEST-COM.service",state="active"}) != 1
+        for: 30s
+        labels:
+          severity: critical
+          service: dirsrv-ADVANTEST
+        annotations:
+          summary: "389 LDAP目录服务已停止"
+          description: "主机{{ $labels.instance }} dirsrv@ADVANTEST-COM.service 非运行状态，LDAP查询/认证失效，请立即检查"
+
+      # 7. LDAP 端口 389/636 探测不通
+      - alert: FreeIPA_LDAP_Port_Down
+        expr: probe_tcp_port{target=~".*:389|.*:636"} == 0
+        for: 30s
+        labels:
+          severity: critical
+        annotations:
+          summary: "LDAP 端口连通性异常"
+          description: "无法TCP连接 {{ $labels.target }}，防火墙/服务异常"
+
+      # 8. Kerberos 88端口探测不通
+      - alert: FreeIPA_KRB5_Port_Down
+        expr: probe_tcp_port{target=~".*:88"} == 0
+        for: 30s
+        labels:
+          severity: critical
+        annotations:
+          summary: "Kerberos 88端口不通"
+          description: "目标 {{ $labels.target }} TCP88端口无法访问，Kerberos认证阻断"
+
+      # 9. 证书剩余 <30天 预警
+      - alert: FreeIPA_Certificate_Will_Expire
+        expr: ipa_cert_expiry_hours < 720
+        for: 1m
+        labels:
+          severity: warning
+        annotations:
+          summary: "FreeIPA 证书即将过期（剩余<30天）"
+          description: "证书 {{ $labels.cert }} 有效期剩余不足30天，请规划续期"
+
+      # 10. 证书剩余 <7天 紧急告警
+      - alert: FreeIPA_Certificate_Will_Expire_Critical
+        expr: ipa_cert_expiry_hours < 168
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: "FreeIPA 证书即将过期！紧急处理"
+          description: "证书 {{ $labels.cert }} 有效期剩余不足7天，逾期会导致域认证全部失效"
+
+      # 11. 内存使用率超过85%
+      - alert: FreeIPA_High_Memory_Usage
+        expr: 100 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes * 100) > 85
+        for: 2m
+        labels:
+          severity: warning
+        annotations:
+          summary: "FreeIPA主机内存使用率过高"
+          description: "{{ $labels.instance }} 内存使用率 > 85%，存在OOM风险"
+
+      # 12. CPU使用率超过90%
+      - alert: FreeIPA_High_CPU_Usage
+        expr: 100 - (avg by(instance) (irate(node_cpu_seconds_total{mode="idle"}[2m])) * 100) > 90
+        for: 2m
+        labels:
+          severity: warning
+        annotations:
+          summary: "FreeIPA主机CPU使用率过高"
+          description: "{{ $labels.instance }} CPU持续占用高于90%，业务响应缓慢"
+
+      # 13. 根分区磁盘使用率超85%
+      - alert: FreeIPA_High_Disk_Usage
+        expr: 100 - (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes * 100) > 85
+        for: 2m
+        labels:
+          severity: warning
+        annotations:
+          summary: "主机根分区磁盘使用率过高"
+          description: "{{ $labels.instance }} / 分区磁盘占用 > 85%，请清理日志/扩容"