# Arcline OS — pre-built alerting rules (Prometheus)
groups:
  - name: arcline-node
    rules:
      - alert: NodeDown
        expr: up == 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "{{ $labels.instance }} is unreachable"

      - alert: HighCpuLoad
        expr: node_load1 / count(node_cpu_seconds_total{mode="idle"}) > 2
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "sustained load average > 2 on {{ $labels.instance }}"

      - alert: DiskAlmostFull
        expr: (1 - node_filesystem_avail_bytes{fstype!~"tmpfs|overlay|squashfs"} / node_filesystem_size_bytes) * 100 > 85
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "filesystem {{ $labels.mountpoint }} on {{ $labels.instance }} > 85%"

      - alert: RootDiskCritical
        expr: (1 - node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) * 100 > 95
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "root filesystem on {{ $labels.instance }} > 95%"

      - alert: ServiceRestarts
        expr: increase(node_systemd_unit_restart_total[15m]) > 2
        for: 0m
        labels:
          severity: warning
        annotations:
          summary: "unit {{ $labels.name }} restarting repeatedly on {{ $labels.instance }}"