메뉴
Prometheus alert rule patterns and Alertmanager routing config for uFawkesObs. Load when writing new alert rules, tuning thresholds, or configuring Alertmanager receivers.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
DORA metric queries for uFawkesObs: PromQL expressions for deployment frequency, lead time, change failure rate, and FDRT sourced from deployment spans processed by the OTel Collector. Load when writing DORA dashboards or interpreting DORA metric data in Prometheus.
Complete uFawkesObs stack reference: service versions, port map, config file locations, Docker Compose operations, and signal flow. Load when configuring, troubleshooting, or extending the uFawkesObs stack.
OpenTelemetry Collector configuration rules for uFawkesObs. Covers pipeline anatomy, common wiring errors, and the specific constraints of the Docker Compose deployment.
Grafana Alloy River configuration syntax reference for uFawkesObs. Covers the River DSL, Docker container log discovery, label manipulation, and hot-reload compatibility constraints.
Grafana dashboard JSON patterns, PromQL/LogQL/TraceQL query templates, panel types, and provisioning conventions for uFawkesObs dashboards/. Load when creating or modifying Grafana dashboards.
Grafana dashboard JSON and provisioning configuration rules for uFawkesObs. Covers UID-based datasource references, provisioning file structure, and dashboard JSON conventions.
| name | alerting |
| description | Prometheus alert rule patterns and Alertmanager routing config for uFawkesObs. Load when writing new alert rules, tuning thresholds, or configuring Alertmanager receivers. |
| license | MIT |
| compatibility | Claude Code, GitHub Copilot, OpenCode, Cursor, Codex, Gemini CLI |
| metadata | {"author":"paruff","suite":"uFawkesObs"} |
config/prometheus-rules/[service-name].yml — one file per service or concern.
Loaded by Prometheus via rule_files: in config/prometheus.yml.
| Severity | Use for | Repeat interval |
|---|---|---|
critical | Service down, data loss risk, DORA threshold breach | 1h |
warning | Degraded performance, approaching thresholds | 4h |
info | Informational, trends worth watching | 12h |
Every alert must have:
summary: one sentence, includes service namedescription: includes {{ $value }} so the value is visible in the alertrunbook_url: for critical alerts only — must be a real file in docs/runbooks/# Rate over 5 minutes (use for counters)
rate(metric_name[5m])
# Increase over 1 hour (use for counts)
increase(metric_name[1h])
# Percentile from histogram
histogram_quantile(0.95, sum(rate(metric_bucket[5m])) by (le))
# Ratio (error rate)
sum(rate(errors[5m])) / sum(rate(requests[5m]))
# Label selector
metric{job="service-name", env="$ENVIRONMENT"}
# Humanize in annotations
{{ $value | humanize }} # 1234 → 1.234k
{{ $value | humanizePercentage }} # 0.05 → 5%
{{ $value | humanizeDuration }} # 125 → 2m 5s
- name: slack-warnings
slack_configs:
- api_url: "${SLACK_WEBHOOK_URL}"
channel: "#alerts"
title: "{{ .GroupLabels.alertname }}"
text: "{{ range .Alerts }}{{ .Annotations.description }}{{ end }}"
send_resolved: true
- name: webhook
webhook_configs:
- url: "${ALERTMANAGER_WEBHOOK_URL}"
send_resolved: true
http_config:
bearer_token: "${ALERTMANAGER_WEBHOOK_TOKEN}"
# Syntax check
docker compose exec prometheus \
promtool check rules /etc/prometheus/rules/[filename].yml
# Test a query live
curl -s "http://localhost:9090/api/v1/query?query=up" | python3 -m json.tool
# See all currently firing alerts
curl -s http://localhost:9093/api/v2/alerts | python3 -m json.tool
# Via Alertmanager API
curl -X POST http://localhost:9093/api/v2/silences \
-H "Content-Type: application/json" \
-d '{
"matchers": [{"name": "alertname", "value": "ServiceDown", "isRegex": false}],
"startsAt": "2026-01-01T00:00:00Z",
"endsAt": "2026-01-01T02:00:00Z",
"comment": "Planned maintenance",
"createdBy": "ops"
}'