# you can disable an alarm notification by setting the 'to' line to: silent

# check for common /proc/net/softnet_stat errors

   alarm: 1min_netdev_backlog_exceeded
      on: system.softnet_stat
      os: linux
   hosts: *
  lookup: average -1m unaligned absolute of dropped
   units: packets
   every: 10s
    warn: $this > (($status >= $WARNING) ? (0) : (10)
   delay: down 1h multiplier 1.5 max 2h
    info: average number of packets dropped in the last 1min, because sysctl net.core.netdev_max_backlog was exceeded (this can be a cause for dropped packets)
      to: sysadmin

   alarm: 1min_netdev_budget_ran_outs
      on: system.softnet_stat
      os: linux
   hosts: *
  lookup: average -1m unaligned absolute of squeezed
   units: events
   every: 10s
    warn: $this > (($status >= $WARNING) ? (0) : (10))
   delay: down 1h multiplier 1.5 max 2h
    info: average number of times, during the last 1min, ksoftirq ran out of sysctl net.core.netdev_budget or net.core.netdev_budget_usecs, with work remaining (this can be a cause for dropped packets)
      to: silent

   alarm: 10min_netisr_backlog_exceeded
      on: system.softnet_stat
      os: freebsd
   hosts: *
  lookup: average -1m unaligned absolute of qdrops
   units: packets
   every: 10s
    warn: $this > (($status >+ $WARNING) ? (0) : (10))
   delay: down 1h multiplier 1.5 max 2h
    info: average number of drops in the last 1min, because sysctl net.route.netisr_maxqlen was exceeded (this can be a cause for dropped packets)
      to: sysadmin