Summary

Create an advanced alert configuration guide covering complex alert rules, multi-metric correlation, notification routing, and alert pipeline customization beyond the basic examples in QUICK_START.md.

Parent Issue

Part of: [EPIC] docs: Address documentation gaps across all ecosystem systems (kcenon/common_system#325)

Background (Why)

The alert system has 7 components (alert/ directory) but only basic threshold alerts are covered in QUICK_START.md. Advanced features like rate-of-change triggers, continuous increase detection, alert deduplication, and notification routing are undocumented.

Source files:

• include/kcenon/monitoring/alert/alert_manager.h — Alert lifecycle management
• include/kcenon/monitoring/alert/alert_pipeline.h — Processing pipeline
• include/kcenon/monitoring/alert/alert_rule.h — Rule definitions
• include/kcenon/monitoring/alert/alert_triggers.h — Trigger conditions
• include/kcenon/monitoring/alert/alert_types.h — Alert data types
• include/kcenon/monitoring/alert/alert_notifiers.h — Notification channels
• include/kcenon/monitoring/alert/alert_config.h — Alert configuration

Scope (What)

Create docs/guides/ADVANCED_ALERTS.md covering:

1. Alert Rule Types

• Threshold alerts (static, dynamic)
• Rate-of-change alerts (spike/drop detection)
• Continuous increase/decrease alerts (trend detection)
• Absence alerts (missing metrics)
• Composite alerts (multi-metric AND/OR conditions)

2. Alert Pipeline Configuration

• Pipeline stages: detect → filter → deduplicate → route → notify
• Deduplication strategies
• Aggregation and grouping
• Inhibition rules (suppress alerts based on other alerts)
• Silencing and maintenance windows

3. Notification Channels

• Console notifier configuration
• Email notifier configuration
• Webhook notifier (Slack, PagerDuty, Teams)
• Custom notifier implementation
• Routing rules (which alerts to which channels)

4. Alert Configuration

• Config file format for alert rules
• Dynamic rule updates
• Alert severity levels and escalation
• Recovery notifications

5. Production Examples

• CPU spike detection with rate-of-change
• Memory leak detection with continuous increase
• Service health with composite alerts
• On-call rotation with webhook routing

Acceptance Criteria

• All alert rule types documented with examples
• Pipeline stages fully documented
• All notification channels documented
• At least 4 production alert examples
• Configuration file format documented