// Module included in the following assemblies:
//
// * network_observability/network-observability-health-rules.adoc

:_mod-docs-content-type: REFERENCE
[id="network-observability-health-rules-monitoring-and-alerting_{context}"]
= Detecting network issues with automated health rules

[role="_abstract"]
The Network Observability Operator includes a rule-based system to detect network anomalies and infrastructure failures. By converting configurations into alerting rules, the Operator provides automated monitoring and troubleshooting through the {product-title} web console.

[id="network-observability-health-outcomes_{context}"]
== Monitoring outcomes
The Network Observability Operator displays network status in the following views:

*Alerting* UI:: Specific alerts appear in *Observe* → *Alerting*. Notifications are managed through the Prometheus `Alertmanager`.
*Network Health* dashboard:: A specialized dashboard in *Observe* → *Network Health* provides a summary of cluster network status.

The *Network Health* dashboard categorizes violations into tabs to isolate the scope of an issue:

* *Global*: Aggregate health of the cluster.
* *Nodes*: Violations specific to infrastructure nodes.
* *Namespaces*: Violations specific to individual namespaces.
* *Workloads*: Violations specific to resources, such as `Deployments` or `DaemonSets`.

[id="network-observability-default-rules_{context}"]
== Predefined health rules
The Network Observability Operator provides default rules for common networking scenarios. These rules are active only if the corresponding feature is enabled in the `FlowCollector` custom resource (CR).

The following list contains a subset of available default rules:

`PacketDropsByDevice`:: Reports a high percentage of packet drops from network devices. This rule is based on node-exporter metrics and does not require the `PacketDrop` agent feature.
`PacketDropsByKernel`:: Reports a high percentage of packet drops by the kernel. This rule requires the `PacketDrop` agent feature.
`IPsecErrors`:: Reports IPsec encryption errors. This rule requires the `IPSec` agent feature.
`NetpolDenied`:: Reports traffic denied by network policies. This rule requires the `NetworkEvents` agent feature.
`LatencyHighTrend`:: Reports a significant increase in TCP latency. This rule requires the `FlowRTT` agent feature.
`DNSErrors`:: Reports DNS errors. This rule requires the `DNSTracking` agent feature.

The following operational alerts apply to the Network Observability Operator:

`NetObservNoFlows`:: Reports when the pipeline is active but no flows are observed.
`NetObservLokiError`:: Reports when flows are dropped because of Loki errors.

For a complete list of rules and runbooks, see the link:https://github.com/openshift/runbooks/tree/master/alerts/network-observability-operator[Network Observability Operator runbooks].

[id="network-observability-enabling-features-for-health-monitoring_{context}"]
== Enabling features for health monitoring
The Network Observability Operator creates rules based on the features enabled in the `FlowCollector` CR.

For example, packet drop rules are created only if the `PacketDrop` agent feature is enabled. Rules depend on metrics; if the required metrics are unavailable, configuration warnings might appear. Configure metrics in the `spec.processor.metrics.includeList` field of the `FlowCollector` resource.
