From 276aaf36d1aeb070b08816f4312325040e111096 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Fri, 4 Sep 2026 01:56:55 +0500 Subject: [PATCH] fix(alerts): report exact OOM event counts --- config/observability-rules.yaml | 8 +++++++- internal/observabilityrules/rules_test.go | 1 + 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/config/observability-rules.yaml b/config/observability-rules.yaml index 07fc7b90..24473655 100644 --- a/config/observability-rules.yaml +++ b/config/observability-rules.yaml @@ -299,7 +299,13 @@ rules: severity: page query_language: promql stream_name: gha_fleet_host_oom_kills_total - expression: max by (host_name) (increase(gha_fleet_host_oom_kills_total[5m])) + # PromQL increase extrapolates a counter to both range boundaries. A single + # exact kernel event therefore appeared in the notification as + # 1.0526315789473684. Preserve increase's reset handling, but report the + # physical event count rather than its sampling extrapolation. `round` is + # supported by the deployed OpenObserve engine and leaves the > 0 detector + # unchanged for integer counter increments. + expression: round(max by (host_name) (increase(gha_fleet_host_oom_kills_total[5m]))) operator: ">" threshold: 0 evaluation_seconds: 30 diff --git a/internal/observabilityrules/rules_test.go b/internal/observabilityrules/rules_test.go index 45391527..cfb8e341 100644 --- a/internal/observabilityrules/rules_test.go +++ b/internal/observabilityrules/rules_test.go @@ -34,6 +34,7 @@ func TestRepositoryRulesUseCurrentMetricSemantics(t *testing.T) { "audit_suppression_burst": `signal_class="audit_suppressed"`, "kernel_workqueue_hog": `signal_class="kernel_workqueue_hog"`, "host_compliance_observer_missing": "gha_fleet_host_compliance_observer_up", + "host_oom_detected": "round(max by (host_name) (increase(gha_fleet_host_oom_kills_total[5m])))", "host_package_inventory_stale": "gha_fleet_host_package_inventory_age_seconds", "host_reboot_required": "gha_fleet_host_reboot_required", "host_standard_updates_available": "gha_fleet_host_standard_updates_available",