From 375a36f82a4c7ab6a07b6f3565e2b32e4c6b303b Mon Sep 17 00:00:00 2001
From: samber <samber@users.noreply.github.com>
Date: Mon, 16 Mar 2026 01:56:27 +0000
Subject: [PATCH] Publish

---
 dist/rules/ebpf/ebpf-exporter.yml | 34 +++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 dist/rules/ebpf/ebpf-exporter.yml

diff --git a/dist/rules/ebpf/ebpf-exporter.yml b/dist/rules/ebpf/ebpf-exporter.yml
new file mode 100644
index 0000000..432ca9d
--- /dev/null
+++ b/dist/rules/ebpf/ebpf-exporter.yml
@@ -0,0 +1,34 @@
+groups:
+
+- name: EbpfExporter
+
+  
+  rules:
+
+    # The exporter uses loose attachment: if a program fails to load (missing BTF, kernel incompatibility), it sets this metric to 0 and continues running.
+    - alert: EbpfExporterProgramNotAttached
+      expr: 'ebpf_exporter_ebpf_program_attached == 0'
+      for: 5m
+      labels:
+        severity: warning
+      annotations:
+        summary: eBPF exporter program not attached (instance {{ $labels.instance }})
+        description: "eBPF program {{ $labels.name }} failed to attach. The program is not collecting data. (instance {{ $labels.instance }})\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
+
+    - alert: EbpfExporterDecoderErrors
+      expr: 'rate(ebpf_exporter_decoder_errors_total[5m]) > 0'
+      for: 5m
+      labels:
+        severity: warning
+      annotations:
+        summary: eBPF exporter decoder errors (instance {{ $labels.instance }})
+        description: "eBPF exporter is experiencing decoder errors for program {{ $labels.name }}. Kernel data is not being correctly transformed into labels. (instance {{ $labels.instance }})\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
+
+    - alert: EbpfExporterNoEnabledConfigs
+      expr: 'ebpf_exporter_enabled_configs == 0'
+      for: 5m
+      labels:
+        severity: warning
+      annotations:
+        summary: eBPF exporter no enabled configs (instance {{ $labels.instance }})
+        description: "eBPF exporter has no enabled configurations. No eBPF programs are being run. (instance {{ $labels.instance }})\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"