mixin: group alerts by collector area and add alerts for default and opt-in collectors (#2777)

Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>

docs/runbooks/windowsnetworkinterfaceflapping.md

@@ -0,0 +1,35 @@
+---
+title: WindowsNetworkInterfaceFlapping
+---
+
+## Meaning
+
+The operational status of the interface `nic` changed more than twice within
+the rate window, and did so for two minutes. The alert counts the changes of
+`windows_net_nic_operation_status{status="up"}` between `1` and `0`.
+
+## Impact
+
+Every transition drops the connections that use the interface and triggers
+route, DHCP and DNS registration changes. A flapping uplink on a server causes
+intermittent application failures that are hard to attribute.
+
+## Diagnosis
+
+1. Inspect `windows_net_nic_operation_status` for the interface to see the
+   status it flips to; `down` and `lower layer down` point at the link,
+   `dormant` at authentication such as 802.1X.
+2. Check the System event log for NDIS, the adapter driver and
+   `Microsoft-Windows-NetworkProfile` events, and the switch port for link
+   state changes, errors and port security actions.
+3. Check the cable, SFP, speed and duplex negotiation, and whether a teaming or
+   failover configuration switches between members.
+4. On virtual machines, check the hypervisor for virtual switch changes, live
+   migrations, or a host adapter that flaps.
+
+## Mitigation
+
+Replace the cable or transceiver, fix the speed and duplex settings, update the
+adapter driver, or correct the switch port and authentication configuration.
+Exclude an interface that flaps by design, such as a Wi-Fi or VPN adapter,
+with the `nicSelector`. Confirm the status stays `up`.