network bottleneck (+network error rate check)

default alarmdef rule for network card bottleneck

# The Network bottleneck symptom default relies on general throughput
# metrics.  Not all network interfaces report collision data.  To be
# useful as a bottleneck indicator, the rate thresholds should be
# adjusted based on values seen in historical data for a particular
# system or network.  For example, 100mbit networks cannot handle as
# high packet rates without a bottleneck than can gigabit networks.
symptom Network_Bottleneck type=NETWORK
rule GBL_NFS_CALL_RATE         >  500  prob 25
rule GBL_NET_COLLISION_PCT     >   10  prob 10
rule GBL_NET_COLLISION_PCT     >   25  prob 20
rule GBL_NET_COLLISION_PCT     >   50  prob 30
rule GBL_NET_PACKET_RATE       >  500  prob 10
rule GBL_NET_PACKET_RATE       > 1000  prob 15
rule GBL_NET_PACKET_RATE       > 3000  prob 20
rule GBL_NET_PACKET_RATE       > 5000  prob 25
rule GBL_NET_PACKET_RATE       > 9000  prob 25

alarm Network_Bottleneck > 50 for 5 minutes
  type = "Network"
  start
    if Network_Bottleneck > 90 then
      red alert "Network Bottleneck probability= ", Network_Bottleneck, "%"
    else
      yellow alert "Network Bottleneck probability= ", Network_Bottleneck, "%"
  repeat every 10 minutes
    if Network_Bottleneck > 90 then
      red alert "Network Bottleneck probability= ", Network_Bottleneck, "%"
    else
      yellow alert "Network Bottleneck probability= ", Network_Bottleneck, "%"
  end
    reset alert "End of Network Bottleneck Alert"

# The following alarm assumes that on a good network, few errors occur:
alarm GBL_NET_ERROR_RATE > 1 for 5 minutes
  type = "Network"
  start
    red alert "Network error rate is greater than one per second"
  end
    reset alert "End of network error rate condition"