---
title: Kuma Alert Triage Workflow
description: Uptime Kuma webhook → Ollama analysis → ntfy alert
published: true
date: 2026-04-12T00:00:00.000Z
tags: gremlin, n8n, kuma, alerts
editor: markdown
dateCreated: 2026-04-12T00:00:00.000Z
---

# Kuma Alert Triage Workflow

**Status:** ✅ Live and confirmed working

Triggered by Uptime Kuma webhook on service DOWN or RECOVERED events. DOWN events are analyzed by `llama3.2:3b` before alerting. RECOVERED events skip AI and send a simple notification.

---

## Webhook URL

```
https://n8n.netgrimoire.com/webhook/gremlin-kuma-alert
```

Configure in Uptime Kuma: Settings → Notifications → Webhook → apply to all monitors.

---

## Flow

```
Kuma Webhook
  ├── DOWN path:
  │     → Parse payload (service name, URL, error)
  │     → Ollama (llama3.2:3b): triage prompt
  │     → ntfy gremlin-alerts (urgent priority) with AI analysis
  │
  └── RECOVERED path:
        → ntfy gremlin-alerts (normal priority, no AI call)
```

---

## Why Two Paths

AI triage is only useful for DOWN events — there's nothing to analyze on a recovery. Skipping Ollama on RECOVERED keeps notification latency near-instant for good news.

---

## ntfy Output Format

DOWN alert includes:
- Service name and URL
- Kuma error message
- Ollama's triage assessment (probable cause, suggested first step)

RECOVERED alert is a simple one-liner.

---

## Parked: Doc Generation Workflows

Two additional doc generation workflows were built but are currently inactive. CPU-only `llama3.2:3b` output barely exceeds reformatting the source compose file — not useful enough to commit. Will be revisited when GPU support is added to the Gremlin stack.