netdata: silence 10min_cpu_usage alarm now that Falco covers miner detection
This alarm was originally the crude proxy for catching cryptominers, but Falco now detects that directly via process/network behavior. It was firing several times a day from Ollama's legitimate sustained CPU use (subwave-controller driving chat completions), with no way to tell that apart from a real problem using aggregate CPU % alone. Routed to netdata's "silent" role so it stays visible on the dashboard but stops paging Telegram/Cloud email.
This commit is contained in:
@@ -0,0 +1,25 @@
|
|||||||
|
# Silence the stock 10min_cpu_usage notification. Cryptominer detection is
|
||||||
|
# now handled directly and far more precisely by Falco (process/network
|
||||||
|
# behavior, not aggregate load) - see falco/rules/miner-detect.yaml and
|
||||||
|
# falco/rules/miner-pool-ports.yaml. This alarm was firing several times a
|
||||||
|
# day from Ollama's own legitimate sustained CPU use (subwave-controller
|
||||||
|
# driving chat completions), with no way to distinguish that from a real
|
||||||
|
# problem using system-wide CPU % alone. Kept evaluated (still visible on
|
||||||
|
# the netdata dashboard/API) but routed to the "silent" role, which has no
|
||||||
|
# configured recipients, so it no longer reaches Telegram or Netdata Cloud
|
||||||
|
# email - same idiom as the stock file's own comment recommends.
|
||||||
|
|
||||||
|
template: 10min_cpu_usage
|
||||||
|
on: system.cpu
|
||||||
|
class: Utilization
|
||||||
|
type: System
|
||||||
|
component: CPU
|
||||||
|
host labels: _os=linux
|
||||||
|
lookup: average -10m unaligned of user,system,softirq,irq,guest
|
||||||
|
units: %
|
||||||
|
every: 1m
|
||||||
|
warn: $this > (($status >= $WARNING) ? (75) : (85))
|
||||||
|
crit: $this > (($status == $CRITICAL) ? (85) : (95))
|
||||||
|
delay: down 15m multiplier 1.5 max 1h
|
||||||
|
summary: System CPU utilization
|
||||||
|
to: silent
|
||||||
Reference in New Issue
Block a user