added detection of packet storms

diff --git a/conf.d/health.d/net.conf b/conf.d/health.d/net.conf
index 6865f55e221983178cd3191556c4dba9d59c3cdd..651a6cf5209dc6123011e323cbe8b8fb16189887 100644 (file)
--- a/conf.d/health.d/net.conf
+++ b/conf.d/health.d/net.conf
@@ -14,6 +14,7 @@ template: interface_last_collected_secs
 
 
 # -----------------------------------------------------------------------------
+# dropped packets
 
 # check if an interface is dropping packets
 # the alarm is checked every 1 minute
@@ -31,6 +32,7 @@ template: 1hour_packet_drops
 
 
 # -----------------------------------------------------------------------------
+# FIFO errors
 
 # check if an interface is having FIFO
 # buffer errors
@@ -46,3 +48,32 @@ template: 1hour_fifo_errors
    delay: down 30m multiplier 1.5 max 1h
     info: interface fifo errors in the last hour
       to: sysadmin
+
+
+# -----------------------------------------------------------------------------
+# check for packet storms
+
+# 1. calculate the rate packets are received in 1m: 1m_received_packets_rate
+# 2. do the same for the last 10s
+# 3. raise an alarm if the later is 10x or 20x the first
+# we assume the minimum packet storm should at least have
+# 10000 packets/s, average of the last 10 seconds
+
+template: 1m_received_packets_rate
+      on: net.packets
+  lookup: average -1m of received
+   units: packets
+   every: 10s
+    info: the average number of packets received during the last minute
+
+template: 10s_received_packets_storm
+      on: net.packets
+  lookup: average -10s of received
+    calc: $this * 100 / (($1m_received_packets_rate < 1000)?(1000):($1m_received_packets_rate))
+   every: 10s
+   units: %
+   warn: $this > (($status >= $WARNING)?(200):(1000))
+   crit: $this > (($status >= $WARNING)?(1000):(2000))
+   info: the % of the rate of received packets in the last 10 seconds, compared to the rate of the last minute
+   role: silent
+