# Alerts

Create a rule that fires when a host crosses a threshold, targeted at a group, an environment, or the whole fleet.

Source: https://opafra.com/docs/inventory/alerts

---

An alert rule watches one metric against a threshold. When a host crosses it, an alert
opens against that host; when the host comes back under, the alert resolves.

## Before you begin

You need the **Operator** role or above, and at least one registered server whose
connection check succeeds. Metrics come from that check, so a host that cannot be reached
produces no readings to compare.

## 1. Create the rule

Open **Alerts** and add a rule. It takes a metric, a comparison, and a threshold:

```text
Name        Production disks filling
Metric      disk_percent
Operator    greater than
Threshold   85
```

Available metrics are the ones collected on every connection check:

| Metric | What it is |
|---|---|
| `cpu_percent` | CPU in use |
| `mem_percent` | Memory in use |
| `disk_percent` | Root filesystem in use |
| `load_avg_1`, `load_avg_5` | Load average over one and five minutes |
| `server_status` | 1 when the host answered, 0 when it did not |

Comparisons are greater than, greater or equal, less than, less or equal, equal and not
equal. `server_status` equal to `0` is how you alert on a host going offline.

## 2. Target it

Two optional axes, combined with and:

```text
Group          web
Environment    production
```

Leaving both empty matches every host. Setting one narrows to that group or that
environment. Setting both means production web hosts only.

## 3. Leave it enabled

A rule can be disabled without being deleted, which is what you want during planned
maintenance rather than deleting a rule you will want back.

## Verify it worked

Set a threshold you know a host already crosses, such as `disk_percent` greater than `1`,
then run a connection check on that server. The alert appears against it:

```text title="alerts"
Production disks filling    web-01    disk_percent 34 > 1    active
```

Then raise the threshold back above the current value and check again. The alert resolves
on its own rather than needing to be dismissed:

```text title="alerts"
Production disks filling    web-01    resolved
```

That round trip proves both directions: rules fire on the reading, and they clear when the
reading changes.

## When rules are evaluated

**On a connection check, not on a timer.** Opafra is agentless, so nothing on the host
pushes readings and nothing polls continuously. Metrics are read when a server is tested,
which happens when you register it, when you test it by hand, and when a run touches it.

> **Important**
>
> This is a threshold check against the last reading, not continuous monitoring. A host that
> crosses a threshold and comes back before its next check is never seen crossing it. Treat
> alerts as a safety net on hosts you already touch regularly, rather than as the thing that
> tells you first.

Alerts are scoped to your tenant: a rule only ever evaluates against servers you own.

## Next steps

- [Registering servers](/docs/inventory/servers) for the check that produces the readings
- [Notifications](/docs/governance/notifications) for what does and does not get pushed to you