Alertmonitor is a webapp for displaying alerts from Prometheus or other data sources. Alerts are received from Alertmanager (push notifications) or they can be retrieved directly from Prometheus (polling).

Combination of both push and poll mechanisms assure always up-to-date state of alerts without any data loss.

Alertmonitor receives alerts from Alertmanager on the HTTP endpoint: /alertmonitor/webhook. Alternatively, if webhook receiver is not configured, Alertmonitor can pull alerts directly from Prometheus. Ideally both approaches should be used in combination. This way you'll always receive alert immediately when it is fired, and yet it synchronizes alerts with Prometheus in case if any alert (or clear) has been lost.

Alertmonitor automatically correlates firing and resolving alerts to display current state of active alarms.

Alertmonitor displays monitored objects as Instances or SmartTargets. Instance is one particular exporter on a server, while SmartTarget combines all instances on the same server and displays all active alerts on that server.

Alertmonitor supports PromQL for making queries and range queries.

Tags provide a quick way of filtering alerts.

Alertmonitor can store alerts in MongoDB database. It stores all incoming messages and whole journal (history) of alerts.

Screenshots:

Deploy Alertmonitor on Docker:

docker run -d -p 8080:8080 matjaz99/alertmonitor:latest

Open web browser and go to address: http://hostname:8080/alertmonitor/

There is also docker-compose.yml file available for deployment in Swarm cluster.

Docker images are available on Docker hub: https://hub.docker.com/r/matjaz99/alertmonitor

Alertmonitor strongly relies on properly configured labels in alert rules. Placing additional labels into alert rules will enrich the information that alert carries, such as: severity, metric labels, current metric value, alert tags or group name.

Alertmonitor recognizes the following labels:

Alert's correlationId is defined by: alertname, info, instance and job. Clear event should produce the same correlationId.

It is highly recommended to write alert rules in such manner that instance, job and info are always present in the resulting alert.

Example of alert rule in Prometheus:

groups:
- name: my-alerts
  rules:
  - alert: High CPU usage
    expr: sum(rate(process_cpu_seconds_total[5m])) by (instance) * 100 > 80
    for: 1m
    labels:
      severity: critical
      info: CPU alert for Node '{{ $labels.instance }}'
      tags: hardware, server, cpu, overload
      url: 'http://${GRAFANA_HOSTNAME}/dashboard/'
      description: Node {{ $labels.instance }}
    annotations:
      currentValue: '{{ $value }}%'

In order to receive alerts, configure an Alertmonitor receiver endpoint in alertmanager.yml configuration file.

route:
  receiver: alertmonitor
  group_by: [alertname]
  group_wait: 10s
  group_interval: 5m
  repeat_interval: 3h

receivers:
- name: alertmonitor
  webhook_configs:
  - url: http://alertmonitor:8080/alertmonitor/webhook
    send_resolved: true

Since version 3, Alertmonitor supports Data Providers. Data providers are sources that will send data to Alertmonitor. It is possible to define more Prometheus servers or some other sources.

Alertmonitor supports the following data providers:

• Prometheus
• Eventlogger

Data Providers are configured in providers.yml configuration file.

If no providers are defined, there still exists a single data provider (called .default) that is constructed from the environment variables and is bound to the /alertmonitor/webhook URI endpoint. All requests received on that endpoint will be processed by .default data provider process.

All URI endpoints must start with /alertmonitor/webhook.

It is not recommended to configure two or more providers to send events to the same URI endpoint!

Alertmonitor offers the following views.

This view shows all currently active alerts.

Active alerts can be filtered by selecting one or more tags. Deselect all tags to show all alerts.

Search (in upper right corner) allows searching alerts by: instance, alertname, info, job, description. Search can be used in combination with tags.

Query view provides a GUI for executing PromQL queries. Two types of queries are supported: query and query_range. When executing query range, start/end date and step are configurable.

This view shows all history of received events. The size of journal is limited by ALERTMONITOR_JOURNAL_SIZE parameter. When journal reaches its maximum size, the oldest events will be removed (First in, first out).

Remark: all the data in Alertmonitor is based on journal events. For example, Alertmonitor can only show targets, which have at least one alert recorded in journal.

This view shows raw messages as they were received by the HTTP webhook.

Alertmonitor strips protocol and port from instance label and what remains is target's hostname or IP address or FQDN.

Alertmonitor then filters alerts and displays those who's hostnames match.

Each target shows number of active alerts and an icon indicating the highest severity of raised alert.

Show configured data providers.

Quick statistics is shown for each data provider:

• number of alerts by severity
• number of received messages/alerts
• timers (up time, time since last event...)
• synchronization success rate

Report is an overview of the whole monitoring system. It shows some statistics of Alertmonitor and Prometheus. It also shows the status of instances, average availability and other KPIs.
Most KPIs and metrics are queried from Prometheus.

Here it is possible to change some configuration parameters during runtime.

Application meta data, version, build info, maintainers, public channels...

Alertmonitor supports the following data storage options:

• In memory
• MongoDB
• Kafka (experimental)

In memory option works out-of-the-box without any configuration.

To enable MongoDB data storage, set the environment variable ALERTMONITOR_MONGODB_ENABLED to true and configure ALERTMONITOR_MONGODB_CONNECTION_STRING. MongoDB is disabled by default. Data is deleted according to retention policy (ALERTMONITOR_DATA_RETENTION_DAYS).
Alertmonitor will automatically create new database alertmonitor in MongoDB, if it doesn't exist yet.

Kafka is experimental feature. If enabled, Alertmonitor will send all alerts to Kafka topic. This feature might be useful for further processing and analytics of alarms.

Alertmonitor can be configured with environment variables. Variables starting with ALERTMONITOR_* are related to behaviour of the application, while other variables may be used for other purposes such as log configuration or custom environment variable substitution.

With environment variables, only .default data provider (Prometheus) can be configured. Other providers are configured in providers.yml (see Data Providers). If providers config file is not found, default data provider is constructed from environment variables.

A list of supported environment variables:

Alertmonitor supports http and https protocols for communication with data providers.

In case of https, no certificate validation is checked.

Http client in Alertmonitor supports basic authentication when connecting to the data provider (only for https clients).

Currently, username and password can only be provided via ALERTMONITOR_PROMETHEUS_SERVER variable using syntax https://username:password@hostname:port.

Prometheus doesn't support substitution of environment variables in alert rules. Alertmonitor does that for you.

Environment variables can be set on system level or directly on docker containers. Example in docker-compose file.

    environment:
      - GRAFANA_HOSTNAME: my.grafana.domain

Template in labels to be replaced: ${GRAFANA_HOSTNAME}.

Alertmonitor will automatically replace all occurrences of templates with corresponding environment variables.

Example when comes this handy: you may link an alert with Grafana dashboard by using url label: http://${GRAFANA_HOSTNAME}/dashboard. Alertmonitor will replace all occurrences of template with corresponding environment variable: url: http://my.grafana.domain/dashboard.

Environment variable substitution works on the following labels:

• nodename
• info
• tags
• url
• description

Metrics are available in Prometheus format on URI endpoint:

GET /alertmonitor/metrics

Alertmonitor supports the following metrics in Prometheus format:

• alertmonitor_build_info
• alertmonitor_providers_info
• alertmonitor_webhook_requests_received_total
• alertmonitor_journal_events_total
• alertmonitor_active_alerts_count
• alertmonitor_alerts_balance_factor
• alertmonitor_last_event_timestamp
• alertmonitor_prom_api_duration_seconds
• alertmonitor_sync_success
• alertmonitor_sync_interval_seconds
• alertmonitor_db_inserts_total
• alertmonitor_db_queries_total
• alertmonitor_db_updates_total
• alertmonitor_db_deletes_total
• alertmonitor_db_failures_total
• alertmonitor_memory_total_bytes
• alertmonitor_memory_free_bytes
• alertmonitor_memory_max_bytes
• alertmonitor_available_processors

Inside container log files are located in directory /opt/alertmonitor/log.

Configure the log file location with environment variable SIMPLELOGGER_FILENAME=/opt/alertmonitor/log/alertmonitor.log

Rolling file policy can be also configured. For complete configuration of simple-logger visit https://github.com/matjaz99/simple-logger

Google group for Alertmonitor Users:

https://groups.google.com/g/alertmonitor-users

Alertmonitor is written in Java. It's a maven project. It runs as web app on Apache Tomcat server and uses JSF 2.2 with Primefaces 12.0 for frontend interface. In version 1.5.1 I switched from Java 8 to Java 13. I had to add javax.annotations dependency to pom.xml file.

Sorry, simple-logger is not available on Maven central repo. You can either build it on your own or download jar file from here.
Then manually import it into your local repository:

wget http://matjazcerkvenik.si/download/simple-logger-1.7.0.jar

mvn install:install-file -Dfile=simple-logger-1.7.0.jar -DgroupId=si.matjazcerkvenik.simplelogger -DartifactId=simple-logger -Dversion=1.7.0 -Dpackaging=jar

Run the project with maven:

mvn tomcat7:run

Build docker image and push to docker hub:

docker build -t {{namespace}}/{{image}}:{{tag}} .
docker push {{namespace}}/{{image}}:{{tag}}