{
  "title": "WARNING: abnormal message volume from one server",
  "description": "A single server is sending far more syslog messages than its established baseline - possible log loop, misconfiguration, or a genuine incident generating excessive events. Left unchecked this can fill the retention window's disk budget early. Threshold calibrated live on 2026-07-22 against real accel-ppp/RADIUS traffic: the one active NAS server was steadily sending ~46,000-48,000 msgs/10min (~278k/hour) under totally normal load, so the threshold is set to roughly 3x that baseline. Note: a server's first-ever Vector startup can trigger this once, harmlessly - Vector's file source reads existing log content from the start on a fresh run, producing a one-time burst of backlog rather than a real ongoing issue.",
  "priority": 2,
  "alert": true,
  "config": {
    "type": "aggregation-v1",
    "query": "*",
    "streams": ["__SERVERS_STREAM_ID__"],
    "group_by": ["gl2_remote_ip"],
    "series": [{"type": "count", "id": "count-", "field": null}],
    "conditions": {"expression": {"expr": ">", "left": {"expr": "number-ref", "ref": "count-"}, "right": {"expr": "number", "value": 150000.0}}},
    "search_within_ms": 600000,
    "execute_every_ms": 600000,
    "event_limit": 50
  },
  "field_spec": {},
  "key_spec": [],
  "notification_settings": {"grace_period_ms": 1800000, "backlog_size": 5},
  "notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
}