vaspian

vaspian-alerts

Vaspian operational alerts (incidents, degraded services)

Vaspian operational alerts — fraud detection on outbound calls and platform-health regressions on the voice infrastructure. Loud topic; treat any P1/P2 here as oncall-worthy.

ntfy.sh/vaspian-alerts · added 2026-05-13

Publishers

Every code path / config block that produces messages on this topic today. If you wire a new publisher, add it here.

voipmon-alert.py

voip-observability/scripts/voipmon-alert.py

Polls VoIPMonitor's MySQL backend on a fixed cron, evaluates each configured alert rule against the last 5-minute window, and publishes a ntfy notification per firing alert. Dedup window is 30 minutes; alerts that re-fire within the cooldown are suppressed.

· Outbound fraud rules — short-call ratios, high call-count to flagged country codes, suspicious caller patterns
· Platform-health rules — PDD spike, ASR drop, no-CDR window (call volume falls to zero)
· Each rule has its own severity (P1/P2/P3) which maps to ntfy priority and tags

short-call-ratio-scan.py

voip-observability/scripts/short-call-ratio-scan.py

Sibling scanner specifically for the short-call-ratio fraud heuristic. Emits a synthetic alert (alert_id 9101) that voipmon-alert.py's dispatcher routes to email + ntfy.

How priorities are assigned

Mapped from rule severity in code: P1 → 5 (urgent + bypass DND), P2 → 4 (high), P3 → 3 (default). Anything not mapped falls through to 3.

Example payloads

What an alert on this topic actually looks like on a phone.

[P1] PacketLoss

P5 · max rotating_lightred_circle

3 call(s) · sensors 5,6
• 7165551234 → 12125550987  4m32s  [US]
  +1-DEMO-CUSTOMER · Acme Co
• 7165551234 → 12125550987  3m12s  [US]
  +1-DEMO-CUSTOMER · Acme Co
+1 more

P1 alerts include the triggering CDRs inline so the on-call eng doesn't need to open VoIPMonitor on mobile. An 'Open in VoIPMonitor' action button is attached for desktop deep-dives.

[P2] ASR Drop

P4 · high warning

Sensors 5,6
Last 5m: 142 calls · ASR 38% · avg PDD 0.4s · max PDD 1.1s
24h ago: 167 calls · ASR 71% · avg PDD 0.3s

Platform-health alerts have no CDRs; the body shows the current 5-minute window vs the same window 24h ago for context.

Notes

Setting env var VMON_ALERT_TEST=1 redirects the publish to vaspian-test and prefixes the title with [TEST] — use this to dry-run a new rule before pointing it at the real topic.
Dedup state lives at /var/lib/voipmon-alert/state.json. Wiping it forces every active rule to re-page on the next run.

Subscribe on your phone

Topic name vaspian-alerts on server ntfy.sh.

Open in ntfy app