# the alarm is checked every 1 minute
# and examines the last hour of data
-template: 1hour_packet_drops
+template: 1hour_packet_drops_inbound
on: net.drops
- lookup: sum -1h unaligned absolute
+ lookup: sum -1h unaligned absolute of inbound
+ units: packets
+ every: 1m
+ warn: $this > 0
+ delay: down 30m multiplier 1.5 max 1h
+ info: interface inbound dropped packets in the last hour
+ to: sysadmin
+
+template: 1hour_packet_drops_outbound
+ on: net.drops
+ lookup: sum -1h unaligned absolute of outbound
units: packets
every: 1m
warn: $this > 0
delay: down 30m multiplier 1.5 max 1h
- info: interface dropped packets in the last hour
+ info: interface outbound dropped packets in the last hour
+ to: sysadmin
+
+template: 1hour_packet_drops_ratio_inbound
+ on: net.packets
+ lookup: sum -1h unaligned absolute of received
+ calc: (($1hour_packet_drops_inbound != nan AND $this > 0) ? ($1hour_packet_drops_inbound * 100 / $this) : (0))
+ units: %
+ every: 1m
+ warn: $this > 0.5
+ crit: $this > 3
+ delay: down 30m multiplier 1.5 max 1h
+ info: the ratio of inbound dropped packets vs the total number of received packets of the network interface, during the last hour
+ to: sysadmin
+
+template: 1hour_packet_drops_ratio_outbound
+ on: net.packets
+ lookup: sum -1h unaligned absolute of sent
+ calc: (($1hour_packet_drops_outbound != nan AND $this > 0) ? ($1hour_packet_drops_outbound * 100 / $this) : (0))
+ units: %
+ every: 1m
+ warn: $this > 0.5
+ crit: $this > 3
+ delay: down 30m multiplier 1.5 max 1h
+ info: the ratio of outbound dropped packets vs the total number of sent packets of the network interface, during the last hour
to: sysadmin