groups:
- name: tidb-auditlog
  rules:
  - alert: AuditlogDiskLowSpace
    # We will delete the oldest log file directly if < 0.2
    expr: auditlog_storage_size_available_bytes / auditlog_storage_size_capacity_bytes < 0.5
    for: 5m
    labels:
      tier: next-gen
      severity: critical
      response_class: page
      expr: auditlog_storage_size_available_bytes / auditlog_storage_size_capacity_bytes < 0.5
      component: tidb-auditlog
      oncall_team: operator
    annotations:
      description: 'Audit log storage space in cluster {{ $labels.cluster_id }} on instance {{ $labels.instance }} has less than 50% available space ({{ $value }}). Low storage space may cause audit log collection to fail and affect compliance requirements. Please expand storage capacity or clean up old audit logs.'
      value: '{{ $value }}'
      summary: auditlog disk space low available size
  - alert: AuditlogFailtoPush
    # If fail to push and user should be blame(like revoke permission by mistake) we can try notify user,
    # other case we should fix it ourself.
    expr: increase(auditlog_push_file_duration_seconds_count{result="fail"}[1m])  > 0
    for: 5m
    labels:
      tier: next-gen
      severity: major
      response_class: ticket
      expr:  increase(auditlog_push_file_duration_seconds_count{result="fail"}[1m])  > 0
      component: tidb-auditlog
      oncall_team: operator
    annotations:
      description: 'Audit log service in cluster {{ $labels.cluster_id }} on instance {{ $labels.instance }} is failing to push logs to storage ({{ $value }} failures). This may affect audit log retention and compliance requirements. Please check storage connectivity, permissions, and resolve the push failures.'
      value: '{{ $value }}'
      summary: fail to push log to storage
  - alert: AuditlogSlowPush
    expr: histogram_quantile(0.99, sum(rate(auditlog_push_file_duration_seconds_bucket[5m])) by (le, cluster_id, instance)) > 4
    for: 10m
    labels:
      tier: next-gen
      severity: major
      response_class: ticket
      expr: histogram_quantile(0.99, sum(rate(auditlog_push_file_duration_seconds_bucket[5m])) by (le, cluster_id, instance)) > 4
      component: tidb-auditlog
      oncall_team: operator
    annotations:
      description: 'Audit log service in cluster {{ $labels.cluster_id }} on instance {{ $labels.instance }} is slow to push logs to storage (P99 duration {{ $value }}s > 1s). This may indicate network issues or storage performance degradation.'
      value: '{{ $value }}'
      summary: auditlog push log duration too slow
  - alert: AuditlogTooManyPendingPushFiles
    expr:  auditlog_pending_push_files > 500
    for: 10m
    labels:
      tier: next-gen
      severity: major
      response_class: ticket
      expr: auditlog_pending_push_files > 500
      component: tidb-auditlog
      oncall_team: operator
    annotations:
      description: 'Audit log service in cluster {{ $labels.cluster_id }} on instance {{ $labels.instance }} has too many pending push logs ({{ $value }}). This may indicate network issues or storage performance degradation.'
      value: '{{ $value }}'
      summary: too many pending push files