From f25c09350b8da213fa78b762cf7775845ca87102 Mon Sep 17 00:00:00 2001
From: dzaczek <jacekzaleski@protonmail.ch>
Date: Thu, 17 Aug 2023 08:31:39 +0200
Subject: [PATCH] Update google-cadvisor.yml

    Expression Explanation:
    The expression calculates the absolute change in CPU usage for containers by comparing the current rate of CPU usage (within the last 1 minute) with the rate of CPU usage from the previous minute. If this change exceeds 25%, the alert is triggered. Additionally, it compares the current rate of CPU usage with the rate from the previous 5 minutes to capture larger trends. If any of these conditions are met, the alert fires.

    Alert Details:
    - Alert Name: ContainerHighLowChangeCpuUsage
    - Trigger Condition: Absolute change in CPU usage exceeding 25%
    - Alert Severity: Informational (info)
---
 dist/rules/docker-containers/google-cadvisor.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/dist/rules/docker-containers/google-cadvisor.yml b/dist/rules/docker-containers/google-cadvisor.yml
index 4215f15..d0c343b 100644
--- a/dist/rules/docker-containers/google-cadvisor.yml
+++ b/dist/rules/docker-containers/google-cadvisor.yml
@@ -57,6 +57,16 @@ groups:
       annotations:
         summary: Container high throttle rate (instance {{ $labels.instance }})
         description: "Container is being throttled\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
+        
+    - alert: ContainerHighLowChangeCpuUsage
+      expr: '(abs((  sum by (instance, name) (rate(container_cpu_usage_seconds_total{name!=""}[1m])) * 100)- (  sum by (instance, name) (rate(container_cpu_usage_seconds_total{name!=""}[1m] offset 1m)) * 100)) or abs((  sum by (instance, name) (rate(container_cpu_usage_seconds_total{name!=""}[1m])) * 100)- (  sum by (instance, name) (rate(container_cpu_usage_seconds_total{name!=""}[5m] offset 1m)) * 100)) )>25'
+      for: 0m
+      labels:
+        severity: info
+      annotations:
+        summary: Container change CPU utilization (instance {{ $labels.instance }})
+        description: "This alert rule monitors the absolute change in CPU usage within a time window and triggers an alert when the change exceeds 25%.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
+
 
     - alert: ContainerLowCpuUtilization
       expr: '(sum(rate(container_cpu_usage_seconds_total{name!=""}[3m])) BY (instance, name) * 100) < 20'