From 40ad2e67a018b4c8fc621970d28d52747f6a0eea Mon Sep 17 00:00:00 2001
From: Samuel Berthe <dev@samuel-berthe.fr>
Date: Sun, 16 Feb 2025 23:43:34 +0100
Subject: [PATCH] Add alert rule for high CPU usage change

---
 _data/rules.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/_data/rules.yml b/_data/rules.yml
index a6f46d4..b603b1d 100644
--- a/_data/rules.yml
+++ b/_data/rules.yml
@@ -373,6 +373,10 @@ groups:
                 query: 'rate(container_cpu_cfs_throttled_seconds_total[3m]) > 1'
                 severity: warning
                 for: 2m
+              - name: Container high low change CPU usage
+                description: This alert rule monitors the absolute change in CPU usage within a time window and triggers an alert when the change exceeds 25%.
+                query: '(abs((sum by (instance, name) (rate(container_cpu_usage_seconds_total{name!=""}[1m])) * 100) - (sum by (instance, name) (rate(container_cpu_usage_seconds_total{name!=""}[1m] offset 1m)) * 100)) or abs((sum by (instance, name) (rate(container_cpu_usage_seconds_total{name!=""}[1m])) * 100) - (sum by (instance, name) (rate(container_cpu_usage_seconds_total{name!=""}[5m] offset 1m)) * 100))) > 25'
+                severity: warning
               - name: Container Low CPU utilization
                 description: Container CPU utilization is under 20% for 1 week. Consider reducing the allocated CPU.
                 query: '(sum(rate(container_cpu_usage_seconds_total{name!=""}[3m])) BY (instance, name) * 100) < 20'