# NautheraAuditPartitionsNotMaintained

Audit log partitions for the coming months are missing.

## Meaning

`nauthera_audit_partitions_missing{month="upcoming"}` has been above 0 for an hour:
partitions the maintenance keeps ready ahead of the writes are missing. With
`audit.partition_maintenance: external` the maintenance CronJob (`appendOnlyAudit`) has
not run lately or is failing; with `internal`, the server's own pass, every
`audit.maintenance_interval` (6h), cannot create them. Nothing fails until a month
without a partition begins.

## Impact

Nobody is affected yet. If nothing is done before the first missing month starts (UTC),
NautheraAuditPartitionMissing follows, with its risk of an outage at the next restart
under external maintenance.

## Diagnosis

1. How many: `nauthera_audit_partitions_missing{job="<name>"}`.
2. External: `kubectl -n <ns> get cronjob <name>-maintain -o wide` (is it suspended? when
   did it last succeed?), `kubectl -n <ns> get jobs`, and the failing run's log. The
   server logs `audit log partitions for the coming months are missing; ...` at each
   check, with the `missing` partition names.
3. Internal: `kubectl -n &lt;ns&gt; logs &lt;pod&gt; | jq 'select(.msg|startswith("could not create
   audit log partitions"))'`. The failure is also recorded as a failed
   `system.audit.partition_created`.

## Mitigation

- External: run it now,
  `kubectl -n <ns> create job --from=cronjob/<name>-maintain <name>-maintain-manual`, and
  fix whatever stops the scheduled runs (a suspended CronJob, a failing image pull, an
  expired owner credential, `activeDeadlineSeconds` too short for an index build).
- Internal: fix what the log names, usually privileges or a lock timeout; the next pass
  or a pod restart creates the partitions.

## Escalation

No page. Escalate to the identity platform owner if the cause is not fixed within a few
days, and well before the month boundary. Open an issue if `maintain` succeeds but the
server still reports partitions missing, with the maintenance log and the partition list.

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.