If it's really an "allowed monthly traffic volume" you mean then you just compare the amount consumed over that time with the threshold: increase(foo[30d]) > some_threshold_value
However, I suspect you're actually talking about traffic *rates* (i.e. volume per unit time). A typical question is, "was the 5-minute average rate less than X Gbps for 95% of the time?") The pieces you need are: * rate(foo[5m]) to calculate the 5-minute average rate * a subquery <https://prometheus.io/docs/prometheus/latest/querying/basics/#subquery> to evaluate that expression multiple times over 30 days * quantile_over_time <https://prometheus.io/docs/prometheus/latest/querying/operators/#aggregation-operators> to pick the 95th percentile value Something like this: quantile_over_time(0.95, rate(ifHCInOctets{ifDescr="pppoe-out2"}[5m])[30d:5m]) * 8 (The *8 is to convert bytes per second into bits per second) Once you're happy with the results of this expression, to make an alerting rule you'd add a filter on the end as "> some_threshold_value" On Friday, 20 October 2023 at 09:49:55 UTC+1 Roman Melnyk wrote: > Hello. > Can someone help me to write alert rule for traffic quota exhausted: for > last 30 days server used more than 95% of allowed monthly traffic volume > Thank you! > -- You received this message because you are subscribed to the Google Groups "Prometheus Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/prometheus-users/5f9bd8c5-c01d-461d-828d-7ec03452f1ebn%40googlegroups.com.
