From 10cc1c823b473ecfae83bd06ba13e62c9835a409 Mon Sep 17 00:00:00 2001
From: poprhythm <james.kolpack@gmail.com>
Date: Fri, 21 Aug 2026 01:28:33 +0000
Subject: [PATCH] netdata: silence 10min_cpu_usage alarm now that Falco covers
 miner detection

This alarm was originally the crude proxy for catching cryptominers, but
Falco now detects that directly via process/network behavior. It was
firing several times a day from Ollama's legitimate sustained CPU use
(subwave-controller driving chat completions), with no way to tell that
apart from a real problem using aggregate CPU % alone. Routed to netdata's
"silent" role so it stays visible on the dashboard but stops paging
Telegram/Cloud email.
---
 netdata/health.d/cpu.conf | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 netdata/health.d/cpu.conf

diff --git a/netdata/health.d/cpu.conf b/netdata/health.d/cpu.conf
new file mode 100644
index 0000000..dbdf004
--- /dev/null
+++ b/netdata/health.d/cpu.conf
@@ -0,0 +1,25 @@
+# Silence the stock 10min_cpu_usage notification. Cryptominer detection is
+# now handled directly and far more precisely by Falco (process/network
+# behavior, not aggregate load) - see falco/rules/miner-detect.yaml and
+# falco/rules/miner-pool-ports.yaml. This alarm was firing several times a
+# day from Ollama's own legitimate sustained CPU use (subwave-controller
+# driving chat completions), with no way to distinguish that from a real
+# problem using system-wide CPU % alone. Kept evaluated (still visible on
+# the netdata dashboard/API) but routed to the "silent" role, which has no
+# configured recipients, so it no longer reaches Telegram or Netdata Cloud
+# email - same idiom as the stock file's own comment recommends.
+
+   template: 10min_cpu_usage
+         on: system.cpu
+      class: Utilization
+       type: System
+  component: CPU
+host labels: _os=linux
+     lookup: average -10m unaligned of user,system,softirq,irq,guest
+      units: %
+      every: 1m
+       warn: $this > (($status >= $WARNING)  ? (75) : (85))
+       crit: $this > (($status == $CRITICAL) ? (85) : (95))
+      delay: down 15m multiplier 1.5 max 1h
+    summary: System CPU utilization
+         to: silent