2 # -----------------------------------------------------------------------------
5 # check if an interface is dropping packets
6 # the alarm is checked every 1 minute
7 # and examines the last 10 minutes of data
9 template: inbound_packets_dropped
12 lookup: sum -10m unaligned absolute of inbound
16 delay: down 1h multiplier 1.5 max 2h
17 info: interface inbound dropped packets in the last 10 minutes
20 template: outbound_packets_dropped
23 lookup: sum -10m unaligned absolute of outbound
27 delay: down 1h multiplier 1.5 max 2h
28 info: interface outbound dropped packets in the last 10 minutes
31 template: inbound_packets_dropped_ratio
34 lookup: sum -10m unaligned absolute of received
35 calc: (($inbound_packets_dropped != nan AND $this > 0) ? ($inbound_packets_dropped * 100 / $this) : (0))
40 delay: down 1h multiplier 1.5 max 2h
41 info: the ratio of inbound dropped packets vs the total number of received packets of the network interface, during the last 10 minutes
44 template: outbound_packets_dropped_ratio
47 lookup: sum -10m unaligned absolute of sent
48 calc: (($outbound_packets_dropped != nan AND $this > 0) ? ($outbound_packets_dropped * 100 / $this) : (0))
53 delay: down 1h multiplier 1.5 max 2h
54 info: the ratio of outbound dropped packets vs the total number of sent packets of the network interface, during the last 10 minutes
58 # -----------------------------------------------------------------------------
61 # check if an interface is having FIFO
63 # the alarm is checked every 1 minute
64 # and examines the last 10 minutes of data
66 template: 10min_fifo_errors
69 lookup: sum -10m unaligned absolute
73 delay: down 1h multiplier 1.5 max 2h
74 info: interface fifo errors in the last 10 minutes
78 # -----------------------------------------------------------------------------
79 # check for packet storms
81 # 1. calculate the rate packets are received in 1m: 1m_received_packets_rate
82 # 2. do the same for the last 10s
83 # 3. raise an alarm if the later is 10x or 20x the first
84 # we assume the minimum packet storm should at least have
85 # 10000 packets/s, average of the last 10 seconds
87 template: 1m_received_packets_rate
90 lookup: average -1m of received
93 info: the average number of packets received during the last minute
95 template: 10s_received_packets_storm
98 lookup: average -10s of received
99 calc: $this * 100 / (($1m_received_packets_rate < 1000)?(1000):($1m_received_packets_rate))
102 warn: $this > (($status >= $WARNING)?(200):(1000))
103 crit: $this > (($status >= $WARNING)?(1000):(2000))
104 options: no-clear-notification
105 info: the % of the rate of received packets in the last 10 seconds, compared to the rate of the last minute