rsyslog/meta/prometheus.yml

{%- from "rsyslog/map.jinja" import global, monitoring with context %}

{%- if global.get('enabled', False) %}
{%- raw %}
server:
  alert:
    SshFailedLoginsTooHigh:
{%- endraw %}
      {%- set threshold = monitoring.failed_auths_per_sec|float %}
      if: >-
        rate(failed_logins_total[5m]) > {{ threshold }}
{%- raw %}
      labels:
        severity: warning
        service: ssh
      annotations:
        summary: 'Too many failed SSH logins'
        description: 'The rate of failed logins is too high on node {{ $labels.host }} (current value={{ $value }}, threshold={%- endraw %}{{ threshold }}).'
{%- endif %}