Publish

dist/rules/ebpf/ebpf-exporter.yml

@@ -0,0 +1,34 @@
+groups:
+
+- name: EbpfExporter
+
+  
+  rules:
+
+    # The exporter uses loose attachment: if a program fails to load (missing BTF, kernel incompatibility), it sets this metric to 0 and continues running.
+    - alert: EbpfExporterProgramNotAttached
+      expr: 'ebpf_exporter_ebpf_program_attached == 0'
+      for: 5m
+      labels:
+        severity: warning
+      annotations:
+        summary: eBPF exporter program not attached (instance {{ $labels.instance }})
+        description: "eBPF program {{ $labels.name }} failed to attach. The program is not collecting data. (instance {{ $labels.instance }})\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
+
+    - alert: EbpfExporterDecoderErrors
+      expr: 'rate(ebpf_exporter_decoder_errors_total[5m]) > 0'
+      for: 5m
+      labels:
+        severity: warning
+      annotations:
+        summary: eBPF exporter decoder errors (instance {{ $labels.instance }})
+        description: "eBPF exporter is experiencing decoder errors for program {{ $labels.name }}. Kernel data is not being correctly transformed into labels. (instance {{ $labels.instance }})\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
+
+    - alert: EbpfExporterNoEnabledConfigs
+      expr: 'ebpf_exporter_enabled_configs == 0'
+      for: 5m
+      labels:
+        severity: warning
+      annotations:
+        summary: eBPF exporter no enabled configs (instance {{ $labels.instance }})
+        description: "eBPF exporter has no enabled configurations. No eBPF programs are being run. (instance {{ $labels.instance }})\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"