# you can disable an alarm notification by setting the 'to' line to: silent

# check for common /proc/net/softnet_stat errors

   alarm: 10min_netdev_backlog_exceeded
      on: system.softnet_stat
      os: linux
   hosts: *
  lookup: sum -10m unaligned absolute of dropped
   units: packets
   every: 1m
    warn: $this > 0
   delay: down 1h multiplier 1.5 max 2h
    info: number of packets dropped in the last 10min, because sysctl net.core.netdev_max_backlog was exceeded (this can be a cause for dropped packets)
      to: sysadmin

   alarm: 10min_netdev_budget_ran_outs
      on: system.softnet_stat
      os: linux
   hosts: *
  lookup: sum -10m unaligned absolute of squeezed
   units: events
   every: 1m
    warn: $this > (($status >= $WARNING)  ? (0) : (10))
   delay: down 1h multiplier 1.5 max 2h
    info: number of times, during the last 10min, ksoftirq ran out of sysctl net.core.netdev_budget or net.core.netdev_budget_usecs, with work remaining (this can be a cause for dropped packets)
      to: silent

   alarm: 10min_netisr_backlog_exceeded
      on: system.softnet_stat
      os: freebsd
   hosts: *
   lookup: sum -10m unaligned absolute of qdrops
   units: packets
   every: 1m
    warn: $this > 0
   delay: down 1h multiplier 1.5 max 2h
    info: number of drops in the last 10min, because sysctl net.route.netisr_maxqlen was exceeded (this can be a cause for dropped packets)
      to: sysadmin