alert8: any-match critical hardware/power alarms (dying_gasp, ONU
config/HAL/info failures, PSU/memory/ASIC faults, cold start) - same
fire-on-every-occurrence philosophy as alert4_juniper_chassis_alarm.
alert9: repeated-warning threshold on severity_tag:warning, grouped by
device+event_type, >5 in 5min - same philosophy as
alert7_accelppp_repeated_error_warn (a single occurrence can be
transient; repetition means a real problem). Covers signal degradation,
low optical power, BGP/LACP flapping, DDoS/SNMP violations, etc.
Deliberately excludes purely informational event_types (logins,
config_saved, ONU registration, alarm-cleared/recovery events) to avoid
noise.
Not yet verified live - same caveat as the rule27-84 commit, the test
container is still unreachable.
byrsapty
7c0738d68e