# you can disable an alarm notification by setting the 'to' line to: silent

# check for common /proc/net/softnet_stat errors

    alarm: 1min_netdev_backlog_exceeded
       on: system.softnet_stat
    class: System
component: Network
     type: Errors
       os: linux
    hosts: *
   lookup: average -1m unaligned absolute of dropped
    units: packets
    every: 10s
     warn: $this > (($status >= $WARNING) ? (0) : (10))
    delay: down 1h multiplier 1.5 max 2h
     info: average number of dropped packets in the last minute \
           due to exceeded net.core.netdev_max_backlog
       to: sysadmin

    alarm: 1min_netdev_budget_ran_outs
       on: system.softnet_stat
    class: System
component: Network
     type: Errors
       os: linux
    hosts: *
   lookup: average -1m unaligned absolute of squeezed
    units: events
    every: 10s
     warn: $this > (($status >= $WARNING) ? (0) : (10))
    delay: down 1h multiplier 1.5 max 2h
     info: average number of times ksoftirq ran out of sysctl net.core.netdev_budget or \
           net.core.netdev_budget_usecs with work remaining over the last minute \
           (this can be a cause for dropped packets)
       to: silent

    alarm: 10min_netisr_backlog_exceeded
       on: system.softnet_stat
    class: System
component: Network
     type: Errors
       os: freebsd
    hosts: *
   lookup: average -1m unaligned absolute of qdrops
    units: packets
    every: 10s
     warn: $this > (($status >= $WARNING) ? (0) : (10))
    delay: down 1h multiplier 1.5 max 2h
     info: average number of drops in the last minute \
           due to exceeded sysctl net.route.netisr_maxqlen \
           (this can be a cause for dropped packets)
       to: sysadmin