Files
windows_exporter/docs/runbooks/_index.md
T
Jan-Otto Kröpke ae5d0cca2a mixin: group alerts by collector area and add tier 1 alerts
The alerts of the mixin now come in one rule group per collector area
(windows-exporter, windows-cpu, windows-memory, windows-disk,
windows-network, windows-service, windows-system, windows-active-directory,
windows-time). Every alert names the collectors it reads and is generated
only when _config.collectors enables them, the same switch the dashboard
uses; enableActiveDirectory and enableTime set collectors.ad and
collectors.time. _config.alerts switches single alerts off by name, and an
unknown name fails the build.

New alerts for the default collectors: WindowsCollectorTimeout,
WindowsScrapeQueueTimeout, WindowsCPUSaturation (processor queue per core),
WindowsMemoryPagingHigh, WindowsNetworkUtilizationHigh,
WindowsNetworkInterfaceFlapping, WindowsServiceNotRunning (automatic
services without triggers), WindowsServiceCrashLooping (processes per
service in 15 minutes) and WindowsHostRebooted (info, fires once per
reboot). WindowsNetworkErrors and WindowsNetworkDiscards compare the error
and discard rates with the packet rate (networkErrorRatioThreshold and
networkDiscardRatioThreshold, in percent) instead of an absolute packet
rate. Threshold alerts set keep_firing_for from keepFiringFor (5m); the new
infoSeverity and serviceSelector knobs follow the existing ones.

New recordings: windows:cpu_queue_per_core:ratio,
windows:net_received_packets:rate and windows:net_sent_packets:rate.

Each new alert has a runbook, a README row and a unit test;
tests/alerts.test.jsonnet checks the collector gating, the alert switches
and the group layout. The runbook check renders the alerts of every
collector. contrib/mixin/AGENTS.md documents the checklist for new alerts.

Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
2026-10-16 23:06:59 +00:00

800 B

title
title
Windows exporter runbooks

These runbooks describe alerts from the Windows exporter mixin. Use the alert's job, instance, and any cluster or environment labels to find the affected host. Disk alerts also identify a volume; network alerts identify a nic. Adjust example PromQL selectors to match your scrape configuration.

The default thresholds are starting points. Check the generated alert rules for your configured thresholds and durations. The rules are grouped by collector area, and each alert is generated only when the collectors it reads are enabled in the mixin configuration. Active Directory and NTP clock alerts need the ad and time collectors, which are off by default.