---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  creationTimestamp: "2025-10-27T11:31:16Z"
  generation: 1
  managedFields:
  - apiVersion: monitoring.coreos.com/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:spec:
        .: {}
        f:groups:
          .: {}
          k:{"name":"apiserver-audit"}:
            .: {}
            f:name: {}
            f:rules: {}
    manager: cluster-kube-apiserver-operator
    operation: Update
    time: "2025-10-27T11:31:16Z"
  name: audit-errors
  namespace: openshift-kube-apiserver
  resourceVersion: "7410"
  uid: ada1297a-f935-4ff3-a68b-d0d0cbf2eba4
spec:
  groups:
  - name: apiserver-audit
    rules:
    - alert: AuditLogError
      annotations:
        description: An API Server had an error writing to an audit log.
        summary: |-
          An API Server instance was unable to write audit logs. This could be
          triggered by the node running out of space, or a malicious actor
          tampering with the audit logs.
      expr: |
        sum by (apiserver,instance)(rate(apiserver_audit_error_total{apiserver=~".+-apiserver"}[5m])) / sum by (apiserver,instance) (rate(apiserver_audit_event_total{apiserver=~".+-apiserver"}[5m])) > 0
      for: 1m
      labels:
        namespace: openshift-kube-apiserver
        severity: warning
