Grafana Tempo Prometheus Alert Rules

groups:
- name: EmbeddedExporter
  rules:
    - alert: TempoDistributorUnhealthy
      expr: max by (job) (tempo_ring_members{state="Unhealthy", name="distributor"}) > 0
      for: 15m
      labels:
        severity: warning
      annotations:
        summary: Tempo distributor unhealthy (instance {{ $labels.instance }})
        description: "Tempo has {{ $value }} unhealthy distributor(s).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoLiveStoreUnhealthy
      expr: max by (job) (tempo_ring_members{state="Unhealthy", name="live-store"}) > 0
      for: 15m
      labels:
        severity: critical
      annotations:
        summary: Tempo live store unhealthy (instance {{ $labels.instance }})
        description: "Tempo has {{ $value }} unhealthy live store(s).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoMetricsGeneratorUnhealthy
      expr: max by (job) (tempo_ring_members{state="Unhealthy", name="metrics-generator"}) > 0
      for: 15m
      labels:
        severity: critical
      annotations:
        summary: Tempo metrics generator unhealthy (instance {{ $labels.instance }})
        description: "Tempo has {{ $value }} unhealthy metrics generator(s).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Uses a two-window approach: 1h for historical count and 5m to confirm the issue is ongoing.
    - alert: TempoCompactionsFailing
      expr: sum by (job) (increase(tempodb_compaction_errors_total[1h])) > 2 and sum by (job) (increase(tempodb_compaction_errors_total[5m])) > 0
      for: 1h
      labels:
        severity: critical
      annotations:
        summary: Tempo compactions failing (instance {{ $labels.instance }})
        description: "{{ $value }} compactions have failed in the past hour.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoPollsFailing
      expr: sum by (job) (increase(tempodb_blocklist_poll_errors_total[1h])) > 2 and sum by (job) (increase(tempodb_blocklist_poll_errors_total[5m])) > 0
      for: 0m
      labels:
        severity: critical
      annotations:
        summary: Tempo polls failing (instance {{ $labels.instance }})
        description: "{{ $value }} blocklist polls have failed in the past hour.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoTenantIndexFailures
      expr: sum by (job) (increase(tempodb_blocklist_tenant_index_errors_total[1h])) > 2 and sum by (job) (increase(tempodb_blocklist_tenant_index_errors_total[5m])) > 0
      for: 0m
      labels:
        severity: critical
      annotations:
        summary: Tempo tenant index failures (instance {{ $labels.instance }})
        description: "{{ $value }} tenant index failures in the past hour.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoNoTenantIndexBuilders
      expr: sum by (tenant) (tempodb_blocklist_tenant_index_builder) == 0 and on() max(tempodb_blocklist_length) > 0
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: Tempo no tenant index builders (instance {{ $labels.instance }})
        description: "No tenant index builders for tenant {{ $labels.tenant }}. Tenant index will quickly become stale.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Threshold of 600s (10 minutes). Adjust based on your tenant index build interval.
    - alert: TempoTenantIndexTooOld
      expr: max by (tenant) (tempodb_blocklist_tenant_index_age_seconds) > 600
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: Tempo tenant index too old (instance {{ $labels.instance }})
        description: "Tenant index for {{ $labels.tenant }} is {{ $value }}s old.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Fires when the blocklist grows more than 40% over 7 days.
    - alert: TempoBlockListRisingQuickly
      expr: (avg(tempodb_blocklist_length) / avg(tempodb_blocklist_length offset 7d) - 1) * 100 > 40 and avg(tempodb_blocklist_length offset 7d) > 0
      for: 15m
      labels:
        severity: critical
      annotations:
        summary: Tempo block list rising quickly (instance {{ $labels.instance }})
        description: "Tempo blocklist length is up {{ printf \"%.0f\" $value }}% over the last 7 days. Consider scaling compactors.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoBadOverrides
      expr: sum by (job) (tempo_runtime_config_last_reload_successful == 0) > 0
      for: 15m
      labels:
        severity: critical
      annotations:
        summary: Tempo bad overrides (instance {{ $labels.instance }})
        description: "{{ $labels.job }} failed to reload runtime overrides.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoUserConfigurableOverridesReloadFailing
      expr: sum by (job) (increase(tempo_overrides_user_configurable_overrides_reload_failed_total[1h])) > 5 and sum by (job) (increase(tempo_overrides_user_configurable_overrides_reload_failed_total[5m])) > 0
      for: 0m
      labels:
        severity: critical
      annotations:
        summary: Tempo user configurable overrides reload failing (instance {{ $labels.instance }})
        description: "{{ $value }} user-configurable overrides reloads have failed in the past hour.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Threshold of 100 blocks per compactor instance. Adjust based on your environment.
    - alert: TempoCompactionTooManyOutstandingBlocksWarning
      expr: sum by (instance) (tempodb_compaction_outstanding_blocks) > 100
      for: 6h
      labels:
        severity: warning
      annotations:
        summary: Tempo compaction too many outstanding blocks warning (instance {{ $labels.instance }})
        description: "There are too many outstanding compaction blocks for {{ $labels.instance }}. Consider increasing compactor resources.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Threshold of 100 blocks per compactor instance. Normalize by backend-worker count if needed. Adjust based on your environment.
    - alert: TempoCompactionTooManyOutstandingBlocksCritical
      expr: sum by (instance) (tempodb_compaction_outstanding_blocks) > 250
      for: 24h
      labels:
        severity: critical
      annotations:
        summary: Tempo compaction too many outstanding blocks critical (instance {{ $labels.instance }})
        description: "There are too many outstanding compaction blocks for {{ $labels.instance }}. Increase compactor resources immediately.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Threshold of 0.05/s avoids firing on transient single-event spikes.
    - alert: TempoDistributorUsageTrackerErrors
      expr: sum by (job, reason) (rate(tempo_distributor_usage_tracker_errors_total[5m])) > 0.05
      for: 30m
      labels:
        severity: critical
      annotations:
        summary: Tempo distributor usage tracker errors (instance {{ $labels.instance }})
        description: "Tempo distributor usage tracker errors for {{ $labels.job }} at {{ $value | humanize }}/s (reason {{ $labels.reason }}).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoMetricsGeneratorProcessorUpdatesFailing
      expr: sum by (job) (increase(tempo_metrics_generator_active_processors_update_failed_total[5m])) > 2
      for: 15m
      labels:
        severity: critical
      annotations:
        summary: Tempo metrics generator processor updates failing (instance {{ $labels.instance }})
        description: "Tempo metrics generator processor updates are failing for {{ $labels.job }} ({{ $value }} failures in 5m).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoMetricsGeneratorServiceGraphsDroppingSpans
      expr: 100 * sum by (job) (rate(tempo_metrics_generator_processor_service_graphs_dropped_spans_total[5m])) / sum by (job) (rate(tempo_metrics_generator_spans_received_total[5m])) > 0.5 and sum by (job) (rate(tempo_metrics_generator_spans_received_total[5m])) > 0
      for: 15m
      labels:
        severity: warning
      annotations:
        summary: Tempo metrics generator service graphs dropping spans (instance {{ $labels.instance }})
        description: "Tempo metrics generator is dropping {{ printf \"%.2f\" $value }}% of spans in service graphs for {{ $labels.job }}.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: TempoMetricsGeneratorCollectionsFailing
      expr: sum by (job) (increase(tempo_metrics_generator_registry_collections_failed_total[5m])) > 2
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: Tempo metrics generator collections failing (instance {{ $labels.instance }})
        description: "Tempo metrics generator collections are failing for {{ $labels.job }} ({{ $value }} failures in 5m).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Fires when the memcached error rate exceeds 20%. Only relevant if Tempo is configured with memcached caching.
    - alert: TempoMemcachedErrorsElevated
      expr: 100 * sum by (name, job) (rate(tempo_memcache_request_duration_seconds_count{status_code="500"}[5m])) / sum by (name, job) (rate(tempo_memcache_request_duration_seconds_count[5m])) > 20 and sum by (name, job) (rate(tempo_memcache_request_duration_seconds_count[5m])) > 0
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Tempo memcached errors elevated (instance {{ $labels.instance }})
        description: "Tempo memcached error rate is {{ printf \"%.2f\" $value }}% for {{ $labels.name }} in {{ $labels.job }}.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

wget https://raw.githubusercontent.com/samber/awesome-prometheus-alerts/refs/heads/master/dist/rules/grafana-tempo/embedded-exporter.yml

- alert: TempoDistributorUnhealthy
  expr: max by (job) (tempo_ring_members{state="Unhealthy", name="distributor"}) > 0
  for: 15m
  labels:
    severity: warning
  annotations:
    summary: Tempo distributor unhealthy (instance {{ $labels.instance }})
    description: "Tempo has {{ $value }} unhealthy distributor(s).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoLiveStoreUnhealthy
  expr: max by (job) (tempo_ring_members{state="Unhealthy", name="live-store"}) > 0
  for: 15m
  labels:
    severity: critical
  annotations:
    summary: Tempo live store unhealthy (instance {{ $labels.instance }})
    description: "Tempo has {{ $value }} unhealthy live store(s).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoMetricsGeneratorUnhealthy
  expr: max by (job) (tempo_ring_members{state="Unhealthy", name="metrics-generator"}) > 0
  for: 15m
  labels:
    severity: critical
  annotations:
    summary: Tempo metrics generator unhealthy (instance {{ $labels.instance }})
    description: "Tempo has {{ $value }} unhealthy metrics generator(s).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Uses a two-window approach: 1h for historical count and 5m to confirm the issue is ongoing.
- alert: TempoCompactionsFailing
  expr: sum by (job) (increase(tempodb_compaction_errors_total[1h])) > 2 and sum by (job) (increase(tempodb_compaction_errors_total[5m])) > 0
  for: 1h
  labels:
    severity: critical
  annotations:
    summary: Tempo compactions failing (instance {{ $labels.instance }})
    description: "{{ $value }} compactions have failed in the past hour.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoPollsFailing
  expr: sum by (job) (increase(tempodb_blocklist_poll_errors_total[1h])) > 2 and sum by (job) (increase(tempodb_blocklist_poll_errors_total[5m])) > 0
  for: 0m
  labels:
    severity: critical
  annotations:
    summary: Tempo polls failing (instance {{ $labels.instance }})
    description: "{{ $value }} blocklist polls have failed in the past hour.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoTenantIndexFailures
  expr: sum by (job) (increase(tempodb_blocklist_tenant_index_errors_total[1h])) > 2 and sum by (job) (increase(tempodb_blocklist_tenant_index_errors_total[5m])) > 0
  for: 0m
  labels:
    severity: critical
  annotations:
    summary: Tempo tenant index failures (instance {{ $labels.instance }})
    description: "{{ $value }} tenant index failures in the past hour.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoNoTenantIndexBuilders
  expr: sum by (tenant) (tempodb_blocklist_tenant_index_builder) == 0 and on() max(tempodb_blocklist_length) > 0
  for: 5m
  labels:
    severity: critical
  annotations:
    summary: Tempo no tenant index builders (instance {{ $labels.instance }})
    description: "No tenant index builders for tenant {{ $labels.tenant }}. Tenant index will quickly become stale.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Threshold of 600s (10 minutes). Adjust based on your tenant index build interval.
- alert: TempoTenantIndexTooOld
  expr: max by (tenant) (tempodb_blocklist_tenant_index_age_seconds) > 600
  for: 5m
  labels:
    severity: critical
  annotations:
    summary: Tempo tenant index too old (instance {{ $labels.instance }})
    description: "Tenant index for {{ $labels.tenant }} is {{ $value }}s old.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Fires when the blocklist grows more than 40% over 7 days.
- alert: TempoBlockListRisingQuickly
  expr: (avg(tempodb_blocklist_length) / avg(tempodb_blocklist_length offset 7d) - 1) * 100 > 40 and avg(tempodb_blocklist_length offset 7d) > 0
  for: 15m
  labels:
    severity: critical
  annotations:
    summary: Tempo block list rising quickly (instance {{ $labels.instance }})
    description: "Tempo blocklist length is up {{ printf \"%.0f\" $value }}% over the last 7 days. Consider scaling compactors.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoBadOverrides
  expr: sum by (job) (tempo_runtime_config_last_reload_successful == 0) > 0
  for: 15m
  labels:
    severity: critical
  annotations:
    summary: Tempo bad overrides (instance {{ $labels.instance }})
    description: "{{ $labels.job }} failed to reload runtime overrides.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoUserConfigurableOverridesReloadFailing
  expr: sum by (job) (increase(tempo_overrides_user_configurable_overrides_reload_failed_total[1h])) > 5 and sum by (job) (increase(tempo_overrides_user_configurable_overrides_reload_failed_total[5m])) > 0
  for: 0m
  labels:
    severity: critical
  annotations:
    summary: Tempo user configurable overrides reload failing (instance {{ $labels.instance }})
    description: "{{ $value }} user-configurable overrides reloads have failed in the past hour.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Threshold of 100 blocks per compactor instance. Adjust based on your environment.
- alert: TempoCompactionTooManyOutstandingBlocksWarning
  expr: sum by (instance) (tempodb_compaction_outstanding_blocks) > 100
  for: 6h
  labels:
    severity: warning
  annotations:
    summary: Tempo compaction too many outstanding blocks warning (instance {{ $labels.instance }})
    description: "There are too many outstanding compaction blocks for {{ $labels.instance }}. Consider increasing compactor resources.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Threshold of 100 blocks per compactor instance. Normalize by backend-worker count if needed. Adjust based on your environment.
- alert: TempoCompactionTooManyOutstandingBlocksCritical
  expr: sum by (instance) (tempodb_compaction_outstanding_blocks) > 250
  for: 24h
  labels:
    severity: critical
  annotations:
    summary: Tempo compaction too many outstanding blocks critical (instance {{ $labels.instance }})
    description: "There are too many outstanding compaction blocks for {{ $labels.instance }}. Increase compactor resources immediately.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Threshold of 0.05/s avoids firing on transient single-event spikes.
- alert: TempoDistributorUsageTrackerErrors
  expr: sum by (job, reason) (rate(tempo_distributor_usage_tracker_errors_total[5m])) > 0.05
  for: 30m
  labels:
    severity: critical
  annotations:
    summary: Tempo distributor usage tracker errors (instance {{ $labels.instance }})
    description: "Tempo distributor usage tracker errors for {{ $labels.job }} at {{ $value | humanize }}/s (reason {{ $labels.reason }}).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoMetricsGeneratorProcessorUpdatesFailing
  expr: sum by (job) (increase(tempo_metrics_generator_active_processors_update_failed_total[5m])) > 2
  for: 15m
  labels:
    severity: critical
  annotations:
    summary: Tempo metrics generator processor updates failing (instance {{ $labels.instance }})
    description: "Tempo metrics generator processor updates are failing for {{ $labels.job }} ({{ $value }} failures in 5m).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoMetricsGeneratorServiceGraphsDroppingSpans
  expr: 100 * sum by (job) (rate(tempo_metrics_generator_processor_service_graphs_dropped_spans_total[5m])) / sum by (job) (rate(tempo_metrics_generator_spans_received_total[5m])) > 0.5 and sum by (job) (rate(tempo_metrics_generator_spans_received_total[5m])) > 0
  for: 15m
  labels:
    severity: warning
  annotations:
    summary: Tempo metrics generator service graphs dropping spans (instance {{ $labels.instance }})
    description: "Tempo metrics generator is dropping {{ printf \"%.2f\" $value }}% of spans in service graphs for {{ $labels.job }}.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: TempoMetricsGeneratorCollectionsFailing
  expr: sum by (job) (increase(tempo_metrics_generator_registry_collections_failed_total[5m])) > 2
  for: 5m
  labels:
    severity: critical
  annotations:
    summary: Tempo metrics generator collections failing (instance {{ $labels.instance }})
    description: "Tempo metrics generator collections are failing for {{ $labels.job }} ({{ $value }} failures in 5m).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Fires when the memcached error rate exceeds 20%. Only relevant if Tempo is configured with memcached caching.
- alert: TempoMemcachedErrorsElevated
  expr: 100 * sum by (name, job) (rate(tempo_memcache_request_duration_seconds_count{status_code="500"}[5m])) / sum by (name, job) (rate(tempo_memcache_request_duration_seconds_count[5m])) > 20 and sum by (name, job) (rate(tempo_memcache_request_duration_seconds_count[5m])) > 0
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Tempo memcached errors elevated (instance {{ $labels.instance }})
    description: "Tempo memcached error rate is {{ printf \"%.2f\" $value }}% for {{ $labels.name }} in {{ $labels.job }}.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"