What is the Prometheus alert rule for "Vault sealed"?

Vault instance is sealed on {{ $labels.instance }} PromQL expression: vault_core_unsealed == 0. Severity: critical. Duration: 1m.

What is the Prometheus alert rule for "Vault cluster health"?

Vault cluster has no active node — the cluster cannot serve requests. PromQL expression: sum(vault_core_active) < 1. Severity: critical. Duration: 5m.

What is the Prometheus alert rule for "Vault too many infinity tokens"?

Too many non-expiring tokens on {{ $labels.instance }}: {{ $value }} tokens with infinite TTL. PromQL expression: vault_token_count_by_ttl{creation_ttl="+Inf"} > 3. Severity: warning. Duration: 5m.

What is the Prometheus alert rule for "Vault audit log write failures"?

Vault failed to write to an audit device on {{ $labels.instance }} ({{ $value | printf "%.2f" }} failures/s), so audit log entries may be incomplete. Check audit device connectivity, disk space, or permissions. PromQL expression: sum(rate(vault_audit_log_request_failure[5m])) by (instance) > 0 or sum(rate(vault_audit_log_response_failure[5m])) by (instance) > 0. Severity: warning. Duration: 5m.

What is the Prometheus alert rule for "Vault low response success rate"?

Less than 95% of Vault API responses succeeded (non-5xx) on {{ $labels.instance }} (current value: {{ $value | printf "%.1f" }}%). PromQL expression: (1 - sum(rate(vault_core_response_status_code{type="5xx"}[5m])) by (instance) / sum(rate(vault_core_response_status_code[5m])) by (instance)) * 100 1. Severity: warning. Duration: 5m.

Hashicorp Vault Prometheus Alert Rules

7 Prometheus alerting rules for Hashicorp Vault.Exported via Embedded exporter.These rules cover critical and warning conditions — copy and paste the YAML into your Prometheus configuration.

⚠️

Alert thresholds depend on the nature of your applications. Some queries may have arbitrary tolerance thresholds. Building an efficient monitoring platform takes time. 😉

groups:
- name: EmbeddedExporter
  rules:
    - alert: VaultAutopilotUnhealthy
      expr: min(vault_autopilot_healthy) by (instance) == 0
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: Vault autopilot unhealthy (instance {{ $labels.instance }})
        description: "Vault Autopilot reports the Raft integrated storage cluster on {{ $labels.instance }} as unhealthy, which may indicate node health, quorum, or version mismatch issues.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: VaultSealed
      expr: vault_core_unsealed == 0
      for: 1m
      labels:
        severity: critical
      annotations:
        summary: Vault sealed (instance {{ $labels.instance }})
        description: "Vault instance is sealed on {{ $labels.instance }}\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: VaultClusterHealth
      expr: sum(vault_core_active) < 1
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: Vault cluster health (instance {{ $labels.instance }})
        description: "Vault cluster has no active node — the cluster cannot serve requests.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # 3 is a rough default; some long-lived service tokens are legitimate by design — adjust based on your token issuance policy.
    - alert: VaultTooManyInfinityTokens
      expr: vault_token_count_by_ttl{creation_ttl="+Inf"} > 3
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: Vault too many infinity tokens (instance {{ $labels.instance }})
        description: "Too many non-expiring tokens on {{ $labels.instance }}: {{ $value }} tokens with infinite TTL.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: VaultAuditLogWriteFailures
      expr: sum(rate(vault_audit_log_request_failure[5m])) by (instance) > 0 or sum(rate(vault_audit_log_response_failure[5m])) by (instance) > 0
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: Vault audit log write failures (instance {{ $labels.instance }})
        description: "Vault failed to write to an audit device on {{ $labels.instance }} ({{ $value | printf \"%.2f\" }} failures/s), so audit log entries may be incomplete. Check audit device connectivity, disk space, or permissions.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: VaultLowResponseSuccessRate
      expr: (1 - sum(rate(vault_core_response_status_code{type="5xx"}[5m])) by (instance) / sum(rate(vault_core_response_status_code[5m])) by (instance)) * 100 < 95 and sum(rate(vault_core_response_status_code{type="5xx"}[5m])) by (instance) > 1
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: Vault low response success rate (instance {{ $labels.instance }})
        description: "Less than 95% of Vault API responses succeeded (non-5xx) on {{ $labels.instance }} (current value: {{ $value | printf \"%.1f\" }}%).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # 100 is a rough default; storage-apply backlog scales with your Raft cluster's write throughput — adjust based on your workload.
    - alert: VaultRaftFSMPendingHigh
      expr: vault_raft_storage_stats_fsm_pending > 100
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: Vault raft FSM pending high (instance {{ $labels.instance }})
        description: "Vault Raft peer {{ $labels.peer_id }} on {{ $labels.instance }} has {{ $value }} pending FSM operations, indicating a storage apply backlog on the integrated Raft storage backend.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

9.7.Embedded exporter(7 rules)

wget https://raw.githubusercontent.com/samber/awesome-prometheus-alerts/refs/heads/master/dist/rules/hashicorp-vault/embedded-exporter.yml

critical

9.7.1.Vault autopilot unhealthy

Vault Autopilot reports the Raft integrated storage cluster on {{ $labels.instance }} as unhealthy, which may indicate node health, quorum, or version mismatch issues.

- alert: VaultAutopilotUnhealthy
  expr: min(vault_autopilot_healthy) by (instance) == 0
  for: 5m
  labels:
    severity: critical
  annotations:
    summary: Vault autopilot unhealthy (instance {{ $labels.instance }})
    description: "Vault Autopilot reports the Raft integrated storage cluster on {{ $labels.instance }} as unhealthy, which may indicate node health, quorum, or version mismatch issues.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

critical

9.7.2.Vault sealed

Vault instance is sealed on {{ $labels.instance }}

- alert: VaultSealed
  expr: vault_core_unsealed == 0
  for: 1m
  labels:
    severity: critical
  annotations:
    summary: Vault sealed (instance {{ $labels.instance }})
    description: "Vault instance is sealed on {{ $labels.instance }}\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

critical

9.7.3.Vault cluster health

Vault cluster has no active node — the cluster cannot serve requests.

- alert: VaultClusterHealth
  expr: sum(vault_core_active) < 1
  for: 5m
  labels:
    severity: critical
  annotations:
    summary: Vault cluster health (instance {{ $labels.instance }})
    description: "Vault cluster has no active node — the cluster cannot serve requests.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

warning

9.7.4.Vault too many infinity tokens

Too many non-expiring tokens on {{ $labels.instance }}: {{ $value }} tokens with infinite TTL.

  # 3 is a rough default; some long-lived service tokens are legitimate by design — adjust based on your token issuance policy.
- alert: VaultTooManyInfinityTokens
  expr: vault_token_count_by_ttl{creation_ttl="+Inf"} > 3
  for: 5m
  labels:
    severity: warning
  annotations:
    summary: Vault too many infinity tokens (instance {{ $labels.instance }})
    description: "Too many non-expiring tokens on {{ $labels.instance }}: {{ $value }} tokens with infinite TTL.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

warning

9.7.5.Vault audit log write failures

Vault failed to write to an audit device on {{ $labels.instance }} ({{ $value | printf "%.2f" }} failures/s), so audit log entries may be incomplete. Check audit device connectivity, disk space, or permissions.

- alert: VaultAuditLogWriteFailures
  expr: sum(rate(vault_audit_log_request_failure[5m])) by (instance) > 0 or sum(rate(vault_audit_log_response_failure[5m])) by (instance) > 0
  for: 5m
  labels:
    severity: warning
  annotations:
    summary: Vault audit log write failures (instance {{ $labels.instance }})
    description: "Vault failed to write to an audit device on {{ $labels.instance }} ({{ $value | printf \"%.2f\" }} failures/s), so audit log entries may be incomplete. Check audit device connectivity, disk space, or permissions.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

warning

9.7.6.Vault low response success rate

Less than 95% of Vault API responses succeeded (non-5xx) on {{ $labels.instance }} (current value: {{ $value | printf "%.1f" }}%).

- alert: VaultLowResponseSuccessRate
  expr: (1 - sum(rate(vault_core_response_status_code{type="5xx"}[5m])) by (instance) / sum(rate(vault_core_response_status_code[5m])) by (instance)) * 100 < 95 and sum(rate(vault_core_response_status_code{type="5xx"}[5m])) by (instance) > 1
  for: 5m
  labels:
    severity: warning
  annotations:
    summary: Vault low response success rate (instance {{ $labels.instance }})
    description: "Less than 95% of Vault API responses succeeded (non-5xx) on {{ $labels.instance }} (current value: {{ $value | printf \"%.1f\" }}%).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

warning

9.7.7.Vault raft FSM pending high

Vault Raft peer {{ $labels.peer_id }} on {{ $labels.instance }} has {{ $value }} pending FSM operations, indicating a storage apply backlog on the integrated Raft storage backend.

  # 100 is a rough default; storage-apply backlog scales with your Raft cluster's write throughput — adjust based on your workload.
- alert: VaultRaftFSMPendingHigh
  expr: vault_raft_storage_stats_fsm_pending > 100
  for: 5m
  labels:
    severity: warning
  annotations:
    summary: Vault raft FSM pending high (instance {{ $labels.instance }})
    description: "Vault Raft peer {{ $labels.peer_id }} on {{ $labels.instance }} has {{ $value }} pending FSM operations, indicating a storage apply backlog on the integrated Raft storage backend.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

More in Network and security

SpeedTest SSL/TLS cert-manager Juniper CoreDNS Freeswitch Keycloak Cloudflare SNMP Cilium WireGuard