Alerts notify you when a host metric exceeds a threshold you define. VordFleet supports email and webhook notifications.
Creating an Alert Rule
Creating and customizing your own alert rules requires a Team plan. Alerting starts on Pro, which provisions the built-in default rules (listed below) with email and webhook delivery — you can enable or disable them but not create custom rules. The Free plan has no alert rules.
- Navigate to Settings > Alerts in the dashboard.
- Click Create Rule.
- Configure the rule:
- Name — A descriptive name (e.g., “High CPU Warning”)
- Metric — The metric to monitor (CPU, memory, disk, etc.)
- Condition — The threshold (e.g., “CPU usage > 90%“)
- Duration — How long the condition must persist before firing (e.g., “5 minutes”)
- Scope — Assign the rule to one or more hosts
- Choose a notification method (email or webhook URL).
- Click Save.
Default Alert Rules
When you upgrade to Pro or Team, these ten built-in default rules are provisioned for your fleet:
| Rule | Condition | Severity | Duration |
|---|---|---|---|
| Machine offline | Host stops reporting | Critical | 10 min |
| Disk health issues | SMART reports a failing disk | Critical | 1 min |
| Disk usage above 90% | Disk usage > 90% | Warning | 5 min |
| Failed services detected | One or more services failed | Warning | 5 min |
| CPU usage above 90% | CPU usage > 90% | Warning | 15 min |
| Memory usage above 90% | Memory usage > 90% | Warning | 15 min |
| Telemetry stopped | Host still answers but has stopped sending metrics | Warning | 10 min |
| More than 5 failed SSH logins | Failed SSH logins on a host, more than 5 | Warning | 5 min |
| Security updates available | Security updates pending | Info | 1 min |
| New SSH connection | A new SSH session is opened | Info | Immediate |
A host paused for being over your plan’s host limit raises no alerts, so none of these rules, including Machine offline, fire for it.
Built-in rules are provisioned unassigned — they watch no hosts, and fire for nothing, until you assign them. That is deliberate: VordFleet does not start paging you about hosts you never opted in. Open Settings > Alerts, pick a rule, and assign it to the hosts you want it to cover.
The failed-SSH-login rule counts failed authentication attempts against a host over a rolling five-minute window and fires when the count goes above five — six or more. The threshold sits above ordinary background noise (internet-facing SSH always sees a trickle, and a person mistyping a passphrase twice is not an incident), so what trips it looks like something working through a list. It resolves on its own once a five-minute window passes with no failures.
On the Pro plan these rules are read-only — you can enable or disable them and choose which hosts they cover, but not edit their thresholds. On the Team plan you can also create and customize your own rules and thresholds. The Free plan has no alert rules at all.
Alert Severities
| Severity | Use Case |
|---|---|
| Info | Informational, no action needed |
| Warning | Investigate when convenient |
| Critical | Requires immediate attention |
Webhook Notifications
To send alerts to Slack, PagerDuty, or another service, use a webhook URL as the notification target. VordFleet sends a JSON payload with the alert details.