X-Git-Url: https://arthur.barton.de/gitweb/?a=blobdiff_plain;f=conf.d%2Fhealth.d%2Fnet.conf;h=0232395acfd2cd1e5c313a72a4ecd1e6997f43b4;hb=73212e3a8731012fee476e373f4a5b647f5126e5;hp=dc54d937ce0ea52ef395663cc0e5a154ce2e0c5b;hpb=6f2c5d8fbc873944a84ae11bac5ff0b6c343932d;p=netdata.git

diff --git a/conf.d/health.d/net.conf b/conf.d/health.d/net.conf
index dc54d937..0232395a 100644
--- a/conf.d/health.d/net.conf
+++ b/conf.d/health.d/net.conf
@@ -1,48 +1,107 @@
-# -----------------------------------------------------------------------------
-# make sure we collect values for each interface
-
-template: interface_last_collected_secs
-      on: net.net
-    calc: $now - $last_collected_t
-   units: seconds ago
-   every: 10s
-    warn: $this > ( 5 * $update_every)
-    crit: $this > (60 * $update_every)
-   delay: up 0 down 15m multiplier 1.5 max 1h
-    info: number of seconds since the last successful data collection
-      to: sysadmin
-
 
 # -----------------------------------------------------------------------------
+# dropped packets
 
 # check if an interface is dropping packets
 # the alarm is checked every 1 minute
-# and examines the last hour of data
+# and examines the last 10 minutes of data
+
+template: inbound_packets_dropped
+      on: net.drops
+families: *
+  lookup: sum -10m unaligned absolute of inbound
+   units: packets
+   every: 1m
+    warn: $this > 0
+   delay: down 1h multiplier 1.5 max 2h
+    info: interface inbound dropped packets in the last 10 minutes
+      to: sysadmin
 
-template: 1hour_packet_drops
+template: outbound_packets_dropped
       on: net.drops
-  lookup: sum -1h unaligned absolute
+families: *
+  lookup: sum -10m unaligned absolute of outbound
    units: packets
    every: 1m
     warn: $this > 0
-   delay: up 0 down 15m multiplier 1.5 max 1h
-    info: interface dropped packets in the last hour
+   delay: down 1h multiplier 1.5 max 2h
+    info: interface outbound dropped packets in the last 10 minutes
+      to: sysadmin
+
+template: inbound_packets_dropped_ratio
+      on: net.packets
+families: *
+  lookup: sum -10m unaligned absolute of received
+    calc: (($inbound_packets_dropped != nan AND $this > 0) ? ($inbound_packets_dropped * 100 / $this) : (0))
+   units: %
+   every: 1m
+    warn: $this > 0.5
+    crit: $this > 3
+   delay: down 1h multiplier 1.5 max 2h
+    info: the ratio of inbound dropped packets vs the total number of received packets of the network interface, during the last 10 minutes
+      to: sysadmin
+
+template: outbound_packets_dropped_ratio
+      on: net.packets
+families: *
+  lookup: sum -10m unaligned absolute of sent
+    calc: (($outbound_packets_dropped != nan AND $this > 0) ? ($outbound_packets_dropped * 100 / $this) : (0))
+   units: %
+   every: 1m
+    warn: $this > 0.5
+    crit: $this > 3
+   delay: down 1h multiplier 1.5 max 2h
+    info: the ratio of outbound dropped packets vs the total number of sent packets of the network interface, during the last 10 minutes
       to: sysadmin
 
 
 # -----------------------------------------------------------------------------
+# FIFO errors
 
 # check if an interface is having FIFO
 # buffer errors
 # the alarm is checked every 1 minute
-# and examines the last hour of data
+# and examines the last 10 minutes of data
 
-template: 1hour_fifo_errors
+template: 10min_fifo_errors
       on: net.fifo
-  lookup: sum -1h unaligned absolute
+families: *
+  lookup: sum -10m unaligned absolute
    units: errors
    every: 1m
     warn: $this > 0
-   delay: up 0 down 15m multiplier 1.5 max 1h
-    info: interface fifo errors in the last hour
+   delay: down 1h multiplier 1.5 max 2h
+    info: interface fifo errors in the last 10 minutes
       to: sysadmin
+
+
+# -----------------------------------------------------------------------------
+# check for packet storms
+
+# 1. calculate the rate packets are received in 1m: 1m_received_packets_rate
+# 2. do the same for the last 10s
+# 3. raise an alarm if the later is 10x or 20x the first
+# we assume the minimum packet storm should at least have
+# 10000 packets/s, average of the last 10 seconds
+
+template: 1m_received_packets_rate
+      on: net.packets
+families: *
+  lookup: average -1m of received
+   units: packets
+   every: 10s
+    info: the average number of packets received during the last minute
+
+template: 10s_received_packets_storm
+      on: net.packets
+families: *
+  lookup: average -10s of received
+    calc: $this * 100 / (($1m_received_packets_rate < 1000)?(1000):($1m_received_packets_rate))
+   every: 10s
+   units: %
+   warn: $this > (($status >= $WARNING)?(200):(1000))
+   crit: $this > (($status >= $WARNING)?(1000):(2000))
+options: no-clear-notification
+   info: the % of the rate of received packets in the last 10 seconds, compared to the rate of the last minute
+     to: sysadmin
+