# check for common /proc/net/softnet_stat errors

   alarm: 1hour_netdev_backlog_exceeded
      on: system.softnet_stat
  lookup: sum -1h unaligned absolute of dropped
   units: packets
   every: 1m
    warn: $this > 0
   delay: down 30m multiplier 1.5 max 1h
    info: number of packets dropped because sysctl net.core.netdev_max_backlog was exceeded (this can be a cause for dropped packets)
      to: sysadmin

   alarm: 1hour_netdev_budget_ran_outs
      on: system.softnet_stat
  lookup: sum -1h unaligned absolute of squeezed
   units: events
   every: 1m
    warn: $this > (($status >= $WARNING)  ? (0) : (10))
   delay: down 30m multiplier 1.5 max 1h
    info: number of times ksoftirq ran out of sysctl net.core.netdev_budget or time slice, with work remaining (this can be a cause for dropped packets)
      to: silent