134 lines
5.3 KiB
YAML
134 lines
5.3 KiB
YAML
groups:
|
||
- name: freeipa_alerts
|
||
rules:
|
||
# 1. FreeIPA 节点宕机 / node_exporter 挂了
|
||
- alert: FreeIPA_Node_Down
|
||
expr: up{job=~"freeipa|ipa"} == 0
|
||
for: 30s
|
||
labels:
|
||
severity: critical
|
||
annotations:
|
||
summary: "FreeIPA 节点失联"
|
||
description: "节点 {{ $labels.instance }} node-exporter 掉线超过30秒，主机不可达"
|
||
|
||
# 2. FreeIPA 核心综合服务异常（krb5kdc/httpd/ipa-custodia/pki-tomcatd）
|
||
- alert: FreeIPA_Service_Down
|
||
expr: sum by(instance,name) (node_systemd_unit_state{name=~"krb5kdc.service|httpd.service|ipa-custodia.service|pki-tomcatd@.*.service",state="active"}) != 1
|
||
for: 1m
|
||
labels:
|
||
severity: critical
|
||
annotations:
|
||
summary: "FreeIPA 核心服务异常停止"
|
||
description: "节点 {{ $labels.instance }} 服务 {{ $labels.name }} 未处于运行状态"
|
||
|
||
# 3. Kerberos KDC 认证服务异常
|
||
- alert: FreeIPA_Kerberos_Down
|
||
expr: sum by(instance,name) (node_systemd_unit_state{name="krb5kdc.service",state="active"}) != 1
|
||
for: 1m
|
||
labels:
|
||
severity: critical
|
||
annotations:
|
||
summary: "Kerberos KDC 认证服务异常"
|
||
description: "krb5kdc.service 停止，域用户无法完成Kerberos认证登录"
|
||
|
||
# 4. FreeIPA Web 管理界面 httpd 服务异常
|
||
- alert: FreeIPA_HTTP_Down
|
||
expr: sum by(instance,name) (node_systemd_unit_state{name="httpd.service",state="active"}) != 1
|
||
for: 1m
|
||
labels:
|
||
severity: critical
|
||
annotations:
|
||
summary: "FreeIPA Web 管理界面服务异常"
|
||
description: "httpd.service 已停止，无法访问IPA网页管理端"
|
||
|
||
# 5. PKI 证书签发服务 pki-tomcatd 异常
|
||
- alert: FreeIPA_PKI_Tomcat_Down
|
||
expr: sum by(instance,name) (node_systemd_unit_state{name=~"pki-tomcatd@.*.service",state="active"}) != 1
|
||
for: 2m
|
||
labels:
|
||
severity: warning
|
||
annotations:
|
||
summary: "FreeIPA PKI 证书服务异常"
|
||
description: "pki-tomcatd 证书签发服务停止，新证书无法申请下发"
|
||
|
||
# 6. 专属监控 dirsrv@ADVANTEST-COM.service 389 LDAP目录服务停机
|
||
- alert: DirsrvServiceDown
|
||
expr: sum by(instance,name) (node_systemd_unit_state{name="dirsrv@ADVANTEST-COM.service",state="active"}) != 1
|
||
for: 30s
|
||
labels:
|
||
severity: critical
|
||
service: dirsrv-ADVANTEST
|
||
annotations:
|
||
summary: "389 LDAP目录服务已停止"
|
||
description: "主机{{ $labels.instance }} dirsrv@ADVANTEST-COM.service 非运行状态，LDAP查询/认证失效，请立即检查"
|
||
|
||
# 7. LDAP 端口 389/636 探测不通
|
||
- alert: FreeIPA_LDAP_Port_Down
|
||
expr: probe_tcp_port{target=~".*:389|.*:636"} == 0
|
||
for: 30s
|
||
labels:
|
||
severity: critical
|
||
annotations:
|
||
summary: "LDAP 端口连通性异常"
|
||
description: "无法TCP连接 {{ $labels.target }}，防火墙/服务异常"
|
||
|
||
# 8. Kerberos 88端口探测不通
|
||
- alert: FreeIPA_KRB5_Port_Down
|
||
expr: probe_tcp_port{target=~".*:88"} == 0
|
||
for: 30s
|
||
labels:
|
||
severity: critical
|
||
annotations:
|
||
summary: "Kerberos 88端口不通"
|
||
description: "目标 {{ $labels.target }} TCP88端口无法访问，Kerberos认证阻断"
|
||
|
||
# 9. 证书剩余 <30天 预警
|
||
- alert: FreeIPA_Certificate_Will_Expire
|
||
expr: ipa_cert_expiry_hours < 720
|
||
for: 1m
|
||
labels:
|
||
severity: warning
|
||
annotations:
|
||
summary: "FreeIPA 证书即将过期（剩余<30天）"
|
||
description: "证书 {{ $labels.cert }} 有效期剩余不足30天，请规划续期"
|
||
|
||
# 10. 证书剩余 <7天 紧急告警
|
||
- alert: FreeIPA_Certificate_Will_Expire_Critical
|
||
expr: ipa_cert_expiry_hours < 168
|
||
for: 1m
|
||
labels:
|
||
severity: critical
|
||
annotations:
|
||
summary: "FreeIPA 证书即将过期！紧急处理"
|
||
description: "证书 {{ $labels.cert }} 有效期剩余不足7天，逾期会导致域认证全部失效"
|
||
|
||
# 11. 内存使用率超过85%
|
||
- alert: FreeIPA_High_Memory_Usage
|
||
expr: 100 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes * 100) > 85
|
||
for: 2m
|
||
labels:
|
||
severity: warning
|
||
annotations:
|
||
summary: "FreeIPA主机内存使用率过高"
|
||
description: "{{ $labels.instance }} 内存使用率 > 85%，存在OOM风险"
|
||
|
||
# 12. CPU使用率超过90%
|
||
- alert: FreeIPA_High_CPU_Usage
|
||
expr: 100 - (avg by(instance) (irate(node_cpu_seconds_total{mode="idle"}[2m])) * 100) > 90
|
||
for: 2m
|
||
labels:
|
||
severity: warning
|
||
annotations:
|
||
summary: "FreeIPA主机CPU使用率过高"
|
||
description: "{{ $labels.instance }} CPU持续占用高于90%，业务响应缓慢"
|
||
|
||
# 13. 根分区磁盘使用率超85%
|
||
- alert: FreeIPA_High_Disk_Usage
|
||
expr: 100 - (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes * 100) > 85
|
||
for: 2m
|
||
labels:
|
||
severity: warning
|
||
annotations:
|
||
summary: "主机根分区磁盘使用率过高"
|
||
description: "{{ $labels.instance }} / 分区磁盘占用 > 85%，请清理日志/扩容"
|