# Rules vmalert evaluates against VictoriaLogs' /select/logsql/stats_query endpoints (LogsQL, not PromQL).
groups:
  - name: logs
    interval: 2m
    type: vlogs
    rules:
      - alert: SweepFailing
        # normalize-sweep writes event=failed and leaves a .normalize-failed.log beside the file.
        expr: 'component:=sweep level:=error event:=failed | stats count() as hits'
        for: 1m
        labels: {severity: warning}
        annotations:
          summary: "the normalize sweep failed {{ $value }} time(s) in the last 2m"
          detail: "A recording or clip did not convert. Look for *.normalize-failed.log under /srv/media."
      - alert: PublishDenied
        # A few are normal (expired token, wrong prefix). A burst means a streamer is locked out.
        expr: 'component:=dumpd event:=publish_deny | stats count() as hits'
        for: 5m
        labels: {severity: warning}
        annotations: {summary: "{{ $value }} publish denials in 2m — a streamer may be unable to go live"}
      - alert: BotDeployFailed
        expr: 'component:=dumpd event:=bot_deploy_exit level:=error | stats count() as hits'
        labels: {severity: warning}
        annotations: {summary: "a Discord bot release failed to install"}
      - alert: ServiceErrors
        expr: 'level:=error | stats by (service) count() as hits'
        for: 5m
        labels: {severity: warning}
        annotations: {summary: "{{ $labels.service }} logged {{ $value }} errors in 2m"}
      - alert: CertificateTrouble
        expr: 'service:=caddy _msg:"obtain" _msg:"error" | stats count() as hits'
        labels: {severity: warning}
        annotations: {summary: "Caddy could not obtain or renew a certificate"}