Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ROX-23900: Add prometheus alert for SELinux violations #230

Merged
merged 1 commit into from
May 22, 2024
Merged

ROX-23900: Add prometheus alert for SELinux violations #230

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions resources/prometheus/prometheus-rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -756,3 +756,13 @@ cluster autoscaler. Limits can be adjusted by modifying the cluster autoscaler c
the cluster autoscaler. This is calculated by summing the memory capacity for all nodes in the cluster and comparing that number against the maximum memory bytes value set
for the cluster autoscaler. Limits can be adjusted by modifying the cluster autoscaler configuration."
sop_url: "https://gitlab.cee.redhat.com/stackrox/acs-cloud-service/runbooks/-/blob/master/sops/dp-042-modify-cluster-autoscaler.md"
- alert: ClusterAuditSELinuxViolations
expr: |
selinux_denials_sample_count > 0
labels:
severity: info
mclasmeier marked this conversation as resolved.
Show resolved Hide resolved
annotations:
summary: "SELinux Violations occuring on cluster."
description: |
A cluster node logged {{ $value }} SELinux AVC denial(s) per minute to the audit log.
sop_url: "https://gitlab.cee.redhat.com/stackrox/acs-cloud-service/runbooks/-/blob/master/sops/dp-043-selinux-violation.md"
23 changes: 23 additions & 0 deletions resources/prometheus/unit_tests/ClusterAuditSELinuxViolations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
rule_files:
- /tmp/prometheus-rules-test.yaml

evaluation_interval: 1m

tests:
- interval: 1m
input_series:
- series: selinux_denials_sample_count{namespace="rhacs-cloudwatch"}
values: "1x5"
alert_rule_test:
- eval_time: 70s
alertname: ClusterAuditSELinuxViolations
exp_alerts:
- exp_labels:
alertname: ClusterAuditSELinuxViolations
namespace: rhacs-cloudwatch
severity: info
exp_annotations:
summary: "SELinux Violations occuring on cluster."
description: |
A cluster node logged 1 SELinux AVC denial(s) per minute to the audit log.
sop_url: "https://gitlab.cee.redhat.com/stackrox/acs-cloud-service/runbooks/-/blob/master/sops/dp-043-selinux-violation.md"
Loading