poprhythm
10cc1c823b
This alarm was originally the crude proxy for catching cryptominers, but Falco now detects that directly via process/network behavior. It was firing several times a day from Ollama's legitimate sustained CPU use (subwave-controller driving chat completions), with no way to tell that apart from a real problem using aggregate CPU % alone. Routed to netdata's "silent" role so it stays visible on the dashboard but stops paging Telegram/Cloud email.
26 lines
1.2 KiB
Plaintext
26 lines
1.2 KiB
Plaintext
# Silence the stock 10min_cpu_usage notification. Cryptominer detection is
|
|
# now handled directly and far more precisely by Falco (process/network
|
|
# behavior, not aggregate load) - see falco/rules/miner-detect.yaml and
|
|
# falco/rules/miner-pool-ports.yaml. This alarm was firing several times a
|
|
# day from Ollama's own legitimate sustained CPU use (subwave-controller
|
|
# driving chat completions), with no way to distinguish that from a real
|
|
# problem using system-wide CPU % alone. Kept evaluated (still visible on
|
|
# the netdata dashboard/API) but routed to the "silent" role, which has no
|
|
# configured recipients, so it no longer reaches Telegram or Netdata Cloud
|
|
# email - same idiom as the stock file's own comment recommends.
|
|
|
|
template: 10min_cpu_usage
|
|
on: system.cpu
|
|
class: Utilization
|
|
type: System
|
|
component: CPU
|
|
host labels: _os=linux
|
|
lookup: average -10m unaligned of user,system,softirq,irq,guest
|
|
units: %
|
|
every: 1m
|
|
warn: $this > (($status >= $WARNING) ? (75) : (85))
|
|
crit: $this > (($status == $CRITICAL) ? (85) : (95))
|
|
delay: down 15m multiplier 1.5 max 1h
|
|
summary: System CPU utilization
|
|
to: silent
|