Windows Server Prometheus Alert Rules8 Prometheus alerting rules for Windows Server.Exported via prometheus-community/windows_exporter.These rules cover critical and warning conditions — copy and paste the YAML into your Prometheus configuration.
Alert thresholds depend on the nature of your applications. Some queries may have arbitrary tolerance thresholds. Building an efficient monitoring platform takes time. 😉
groups:
- name: WindowsExporter
rules:
- alert: WindowsServerCPUUsage
expr: 100 - (avg by (instance) (rate(windows_cpu_time_total{mode="idle"}[2m])) * 100) > 80
for: 0m
labels:
severity: warning
annotations:
summary: Windows Server CPU Usage (instance {{ $labels.instance }})
description: "CPU Usage is more than 80%\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"
- alert: WindowsServerMemoryUsage
expr: 100 - ((windows_memory_physical_free_bytes / windows_memory_physical_total_bytes) * 100) > 90
for: 2m
labels:
severity: warning
annotations:
summary: Windows Server memory Usage (instance {{ $labels.instance }})
description: "Memory usage is more than 90%\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"
- alert: WindowsServerDiskSpaceUsage
expr: 100 - 100 * (windows_logical_disk_free_bytes / windows_logical_disk_size_bytes) > 80 and windows_logical_disk_size_bytes > 0
for: 2m
labels:
severity: critical
annotations:
summary: Windows Server disk Space Usage (instance {{ $labels.instance }})
description: "Disk usage is more than 80%\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"
- alert: WindowsServerDiskDriveStatus
expr: windows_disk_drive_status{status="OK"} != 1
for: 1m
labels:
severity: critical
annotations:
summary: Windows Server disk drive Status (instance {{ $labels.instance }})
description: "Physical disk {{ $labels.name }} on {{ $labels.instance }} is reporting a status other than OK, which can indicate an imminent physical disk failure or a degraded array member.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"
# 1s threshold is a rough default; acceptable round-trip time depends on your network topology (local NTP server vs internet-based) — adjust based on your baseline.
- alert: WindowsServerNTPClientDelay
expr: windows_time_ntp_round_trip_delay_seconds > 1
for: 5m
labels:
severity: warning
annotations:
summary: Windows Server NTP client delay (instance {{ $labels.instance }})
description: "NTP round-trip delay between {{ $labels.instance }} and its time source exceeds 1 second, which reduces time synchronization accuracy and may point to network issues.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"
- alert: WindowsServerCollectorError
expr: windows_exporter_collector_success == 0
for: 0m
labels:
severity: critical
annotations:
summary: Windows Server collector Error (instance {{ $labels.instance }})
description: "Collector {{ $labels.collector }} was not successful\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"
- alert: WindowsServerServiceStatus
expr: windows_service_state{state="running"} == 0
for: 1m
labels:
severity: critical
annotations:
summary: Windows Server service Status (instance {{ $labels.instance }})
description: "Windows Service state is not OK\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"
- alert: WindowsServerClockOffset
expr: windows_time_computed_time_offset_seconds > 1
for: 5m
labels:
severity: warning
annotations:
summary: Windows Server clock offset (instance {{ $labels.instance }})
description: "System clock on {{ $labels.instance }} is offset from its configured time source by more than 1 second, which can break Kerberos authentication, Active Directory replication and log correlation.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"prometheus-community/windows_exporter(8 rules)wget https://raw.githubusercontent.com/samber/awesome-prometheus-alerts/refs/heads/master/dist/rules/windows-server/windows-exporter.yml
CPU Usage is more than 80%
- alert: WindowsServerCPUUsage
expr: 100 - (avg by (instance) (rate(windows_cpu_time_total{mode="idle"}[2m])) * 100) > 80
for: 0m
labels:
severity: warning
annotations:
summary: Windows Server CPU Usage (instance {{ $labels.instance }})
description: "CPU Usage is more than 80%\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"Memory usage is more than 90%
- alert: WindowsServerMemoryUsage
expr: 100 - ((windows_memory_physical_free_bytes / windows_memory_physical_total_bytes) * 100) > 90
for: 2m
labels:
severity: warning
annotations:
summary: Windows Server memory Usage (instance {{ $labels.instance }})
description: "Memory usage is more than 90%\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"Disk usage is more than 80%
- alert: WindowsServerDiskSpaceUsage
expr: 100 - 100 * (windows_logical_disk_free_bytes / windows_logical_disk_size_bytes) > 80 and windows_logical_disk_size_bytes > 0
for: 2m
labels:
severity: critical
annotations:
summary: Windows Server disk Space Usage (instance {{ $labels.instance }})
description: "Disk usage is more than 80%\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"Physical disk {{ $labels.name }} on {{ $labels.instance }} is reporting a status other than OK, which can indicate an imminent physical disk failure or a degraded array member.
- alert: WindowsServerDiskDriveStatus
expr: windows_disk_drive_status{status="OK"} != 1
for: 1m
labels:
severity: critical
annotations:
summary: Windows Server disk drive Status (instance {{ $labels.instance }})
description: "Physical disk {{ $labels.name }} on {{ $labels.instance }} is reporting a status other than OK, which can indicate an imminent physical disk failure or a degraded array member.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"NTP round-trip delay between {{ $labels.instance }} and its time source exceeds 1 second, which reduces time synchronization accuracy and may point to network issues.
# 1s threshold is a rough default; acceptable round-trip time depends on your network topology (local NTP server vs internet-based) — adjust based on your baseline.
- alert: WindowsServerNTPClientDelay
expr: windows_time_ntp_round_trip_delay_seconds > 1
for: 5m
labels:
severity: warning
annotations:
summary: Windows Server NTP client delay (instance {{ $labels.instance }})
description: "NTP round-trip delay between {{ $labels.instance }} and its time source exceeds 1 second, which reduces time synchronization accuracy and may point to network issues.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"Collector {{ $labels.collector }} was not successful
- alert: WindowsServerCollectorError
expr: windows_exporter_collector_success == 0
for: 0m
labels:
severity: critical
annotations:
summary: Windows Server collector Error (instance {{ $labels.instance }})
description: "Collector {{ $labels.collector }} was not successful\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"Windows Service state is not OK
- alert: WindowsServerServiceStatus
expr: windows_service_state{state="running"} == 0
for: 1m
labels:
severity: critical
annotations:
summary: Windows Server service Status (instance {{ $labels.instance }})
description: "Windows Service state is not OK\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"System clock on {{ $labels.instance }} is offset from its configured time source by more than 1 second, which can break Kerberos authentication, Active Directory replication and log correlation.
- alert: WindowsServerClockOffset
expr: windows_time_computed_time_offset_seconds > 1
for: 5m
labels:
severity: warning
annotations:
summary: Windows Server clock offset (instance {{ $labels.instance }})
description: "System clock on {{ $labels.instance }} is offset from its configured time source by more than 1 second, which can break Kerberos authentication, Active Directory replication and log correlation.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}"