Alert Configuration

SecureLink integrates with AlertManager to provide advanced alerting capabilities. This page covers how to configure alert rules, routing, grouping, and silencing.

Alert Rules

Alert rules define the conditions that trigger notifications. Configure rules to match your operational requirements.

Built-in Alert Rules

Alert	Condition	Default Threshold
Edge Offline	Edge has not sent a keepalive heartbeat	5 minutes
Config Sync Failure	Batch config push failed after retries	3 consecutive failures
High Packet Drop Rate	VPP interface packet drops exceed threshold	> 1% drop rate over 5 minutes
Suricata Critical Alert	Suricata IDS/IPS detects a critical-severity event	Any critical event
Certificate Expiring	TLS or communication certificate approaching expiry	30 days before expiration

Custom Alert Rules

You can create custom alert rules based on any metric collected by the observability pipeline:

1. Navigate to Settings > System > Alerts
2. Click Create Alert Rule
3. Define the PromQL expression that triggers the alert
4. Set the severity level (Critical, Warning, Info)
5. Configure the evaluation interval and pending duration
6. Click Save

Custom rules are evaluated by VictoriaMetrics vmalert and routed through AlertManager alongside built-in rules.

Routing Rules

Routing rules determine where alerts are delivered based on their attributes:

Attribute	Description
Severity	Route critical alerts to PagerDuty, warnings to email
Tenant	Route tenant-specific alerts to that tenant's admin
Alert Type	Route security alerts to the security team, infrastructure alerts to the ops team

Configuring Routes

1. Navigate to Settings > System > Alerts > Routing
2. Define match conditions (severity, labels, tenant)
3. Assign a notification channel (email, webhook)
4. Set optional continue flag to match multiple routes

Routes are evaluated in order. The first matching route handles the alert unless the continue flag is set, in which case evaluation continues to subsequent routes.

Grouping

Alert grouping reduces notification noise by batching related alerts into a single notification.

• Group by: Define which labels to group on (e.g., tenant_id, edge_serial)
• Group wait: How long to wait before sending the first notification for a new group (default: 30 seconds)
• Group interval: How long to wait before sending updates for an existing group (default: 5 minutes)

For example, if five edges in the same tenant go offline simultaneously, grouping by tenant_id sends one notification listing all five edges instead of five separate notifications.

Silencing

Temporarily suppress alerts during planned maintenance or known issues.

Creating a Silence

1. Navigate to Settings > System > Alerts > Silences
2. Click Create Silence
3. Define matchers to select which alerts to silence (e.g., tenant_id = "12345", alertname = "EdgeOffline")
4. Set the duration or end time
5. Add a comment explaining the reason for the silence
6. Click Save

Active silences are displayed with their remaining duration and can be expired early if the maintenance window completes ahead of schedule.

tip

Always add a descriptive comment when creating a silence. This helps other administrators understand why certain alerts are suppressed.

caution

Silences suppress notifications only. The underlying alert conditions are still evaluated and recorded. Review silenced alerts after the maintenance window to ensure no real issues were masked.