groups:
  - name: auth.rules
    rules:
      - alert: UserLoggedIn
        expr: changes(auth_sessions_active_by_user[1m]) > 0
        labels:
          severity: info
        annotations:
          summary: "Login: {{ $labels.username }} on dev-01"
          description: "User {{ $labels.username }} logged in via {{ $labels.source }} on dev-01."
  - name: disk.rules
    rules:
      - alert: DiskUnhealthy
        expr: count(disk_info{})-count(disk_healthy{}) > 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "Disk unhealthy: {{ $labels.device }} on dev-01"
          description: "SMART overall health failed for device {{ $labels.device }} (disk_healthy=0). Investigate immediately."