# you can disable an alarm notification by setting the 'to' line to: silent

# -----------------------------------------------------------------------------
# net traffic overflow

 template: interface_speed
       on: net.net
    class: Latency
     type: System
component: Network
     calc: ( $nic_speed_max > 0 ) ? ( $nic_speed_max / 1000) : ( nan )
    units: Mbit
    every: 10s
     info: Network interface ${label:device} current speed

   template: 1m_received_traffic_overflow
         on: net.net
      class: Workload
       type: System
  component: Network
host labels: _os=linux windows
     lookup: average -1m unaligned absolute of received
       calc: ($interface_speed > 0) ? ($this * 100 / ($interface_speed * 1000)) : ( nan )
      units: %
      every: 10s
       warn: $this > (($status >= $WARNING)  ? (85) : (90))
      delay: up 1m down 1m multiplier 1.5 max 1h
    summary: System network interface ${label:device} inbound utilization
       info: Average inbound utilization for the network interface ${label:device} over the last minute
         to: silent

   template: 1m_sent_traffic_overflow
         on: net.net
      class: Workload
       type: System
  component: Network
host labels: _os=linux windows
     lookup: average -1m unaligned absolute of sent
       calc: ($interface_speed > 0) ? ($this * 100 / ($interface_speed * 1000)) : ( nan )
      units: %
      every: 10s
       warn: $this > (($status >= $WARNING)  ? (85) : (90))
      delay: up 1m down 1m multiplier 1.5 max 1h
    summary: System network interface ${label:device} outbound utilization
       info: Average outbound utilization for the network interface ${label:device} over the last minute
         to: silent

# -----------------------------------------------------------------------------
# dropped packets

# check if an interface is dropping packets
# the alarm is checked every 1 minute
# and examines the last 10 minutes of data
#
# it is possible to have expected packet drops on an interface for some network configurations
# look at the Monitoring Network Interfaces section in the proc.plugin documentation for more information

 template: net_interface_inbound_packets
       on: net.packets
    class: Workload
     type: System
component: Network
   lookup: sum -10m unaligned absolute of received
    units: packets
    every: 1m
  summary: Network interface ${label:device} received packets
     info: Received packets for the network interface ${label:device} in the last 10 minutes

 template: net_interface_outbound_packets
       on: net.packets
    class: Workload
     type: System
component: Network
   lookup: sum -10m unaligned absolute of sent
    units: packets
    every: 1m
  summary: Network interface ${label:device} sent packets
     info: Sent packets for the network interface ${label:device} in the last 10 minutes

    template: inbound_packets_dropped_ratio
          on: net.drops
       class: Errors
        type: System
   component: Network
chart labels: device=!wl* *
      lookup: sum -10m unaligned absolute of inbound
        calc: (($net_interface_inbound_packets > 10000) ? ($this * 100 / $net_interface_inbound_packets) : (0))
       units: %
       every: 1m
        warn: $this >= 2
       delay: up 1m down 1h multiplier 1.5 max 2h
     summary: System network interface ${label:device} inbound drops
        info: Ratio of inbound dropped packets for the network interface ${label:device} over the last 10 minutes
          to: silent

    template: outbound_packets_dropped_ratio
          on: net.drops
       class: Errors
        type: System
   component: Network
chart labels: device=!wl* *
      lookup: sum -10m unaligned absolute of outbound
        calc: (($net_interface_outbound_packets > 1000) ? ($this * 100 / $net_interface_outbound_packets) : (0))
       units: %
       every: 1m
        warn: $this >= 2
       delay: up 1m down 1h multiplier 1.5 max 2h
     summary: System network interface ${label:device} outbound drops
        info: Ratio of outbound dropped packets for the network interface ${label:device} over the last 10 minutes
          to: silent

    template: wifi_inbound_packets_dropped_ratio
          on: net.drops
       class: Errors
        type: System
   component: Network
 host labels: _os=linux
chart labels: device=wl*
      lookup: sum -10m unaligned absolute of received
        calc: (($net_interface_inbound_packets > 10000) ? ($this * 100 / $net_interface_inbound_packets) : (0))
       units: %
       every: 1m
        warn: $this >= 10
       delay: up 1m down 1h multiplier 1.5 max 2h
     summary: System network interface ${label:device} inbound drops ratio
        info: Ratio of inbound dropped packets for the network interface ${label:device} over the last 10 minutes
          to: silent

    template: wifi_outbound_packets_dropped_ratio
          on: net.drops
       class: Errors
        type: System
   component: Network
 host labels: _os=linux
chart labels: device=wl*
      lookup: sum -10m unaligned absolute of sent
        calc: (($net_interface_outbound_packets > 1000) ? ($this * 100 / $net_interface_outbound_packets) : (0))
       units: %
       every: 1m
        warn: $this >= 10
       delay: up 1m down 1h multiplier 1.5 max 2h
     summary: System network interface ${label:device} outbound drops ratio
        info: Ratio of outbound dropped packets for the network interface ${label:device} over the last 10 minutes
          to: silent

# -----------------------------------------------------------------------------
# interface errors

   template: interface_inbound_errors
         on: net.errors
      class: Errors
       type: System
  component: Network
host labels: _os=freebsd
     lookup: sum -10m unaligned absolute of inbound
      units: errors
      every: 1m
       warn: $this >= 5
      delay: down 1h multiplier 1.5 max 2h
    summary: System network interface ${label:device} inbound errors
       info: Number of inbound errors for the network interface ${label:device} in the last 10 minutes
         to: silent

   template: interface_outbound_errors
         on: net.errors
      class: Errors
       type: System
  component: Network
host labels: _os=freebsd
     lookup: sum -10m unaligned absolute of outbound
      units: errors
      every: 1m
       warn: $this >= 5
      delay: down 1h multiplier 1.5 max 2h
    summary: System network interface ${label:device} outbound errors
       info: Number of outbound errors for the network interface ${label:device} in the last 10 minutes
         to: silent

# -----------------------------------------------------------------------------
# FIFO errors

# check if an interface is having FIFO
# buffer errors
# the alarm is checked every 1 minute
# and examines the last 10 minutes of data

   template: 10min_fifo_errors
         on: net.fifo
      class: Errors
       type: System
  component: Network
host labels: _os=linux
     lookup: sum -10m unaligned absolute
      units: errors
      every: 1m
       warn: $this > 0
      delay: down 1h multiplier 1.5 max 2h
    summary: System network interface ${label:device} FIFO errors
       info: Number of FIFO errors for the network interface ${label:device} in the last 10 minutes
         to: silent

# -----------------------------------------------------------------------------
# check for packet storms

# 1. calculate the rate packets are received in 1m: 1m_received_packets_rate
# 2. do the same for the last 10s
# 3. raise an alarm if the later is 10x or 20x the first
# we assume the minimum packet storm should at least have
# 10000 packets/s, average of the last 10 seconds

   template: 1m_received_packets_rate
         on: net.packets
      class: Workload
       type: System
  component: Network
     lookup: average -1m unaligned of received
      units: packets
      every: 10s
       info: Average number of packets received by the network interface ${label:device} over the last minute

   template: 10s_received_packets_storm
         on: net.packets
      class: Workload
       type: System
  component: Network
     lookup: average -10s unaligned of received
       calc: $this * 100 / (($1m_received_packets_rate < 1000)?(1000):($1m_received_packets_rate))
      every: 10s
      units: %
       warn: $this > (($status >= $WARNING)?(200):(5000))
       crit: $this > (($status == $CRITICAL)?(5000):(6000))
    options: no-clear-notification
    summary: System network interface ${label:device} inbound packet storm
       info: Ratio of average number of received packets for the network interface ${label:device} over the last 10 seconds, \
             compared to the rate over the last minute
         to: silent

# -----------------------------------------------------------------------------
# output queue length

   template: network_interface_output_queue_length
         on: net.queue_length
      class: Errors
       type: System
  component: Network
host labels: _os=windows
      units: packets
      every: 10s
       warn: $length > 2
      delay: up 1m down 1m multiplier 1.5 max 1h
    summary: System network interface ${label:device} output queue length
       info: The Output Queue Length on interface ${label:device} should be zero, otherwise there are delays and bottlenecks.
         to: silent