Prometheus Alerting Rules, Demystified

Prometheus evaluates alerting rules continuously, and a rule file is just a list of groups. Each group has a name and a list of rules; each rule has an alert name, an expr expression in PromQL, an optional for duration, labels, and annotations.

The expression is the condition — for example rate(http_requests_total[5m]) > 100 fires when the per-second rate exceeds 100. The for clause smooths noise: for: 10m means the condition must stay true for ten minutes before the alert actually fires, so a single bad scrape does not page you. Labels carry routing information like severity, and annotations hold human context — the summary and description that show up in the notification. Point Prometheus at the file through its rule_files config, reload, and the rules begin evaluating on every scrape.