added detection of packet storms
Costa Tsaousis (ktsaou) committed
Nov 6, 2016 at 18:59 UTC
b4cb87bd610500b4fb86f7b946b1d42fcb26020c
1 file changed
+31
conf.d/health.d/net.conf
+31
@@ -14,6 +14,7 @@ template: interface_last_collected_secs
14
15
16
# -----------------------------------------------------------------------------
17
+# dropped packets
18
19
# check if an interface is dropping packets
20
# the alarm is checked every 1 minute
@@ -31,6 +32,7 @@ template: 1hour_packet_drops
32
33
34
# -----------------------------------------------------------------------------
35
+# FIFO errors
36
37
# check if an interface is having FIFO
38
# buffer errors
@@ -46,3 +48,32 @@ template: 1hour_fifo_errors
48
delay: down 30m multiplier 1.5 max 1h
49
info: interface fifo errors in the last hour
50
to: sysadmin
51
+
52
+
53
+# -----------------------------------------------------------------------------
54
+# check for packet storms
55
+
56
+# 1. calculate the rate packets are received in 1m: 1m_received_packets_rate
57
+# 2. do the same for the last 10s
58
+# 3. raise an alarm if the later is 10x or 20x the first
59
+# we assume the minimum packet storm should at least have
60
+# 10000 packets/s, average of the last 10 seconds
61
+
62
+template: 1m_received_packets_rate
63
+ on: net.packets
64
+ lookup: average -1m of received
65
+ units: packets
66
+ every: 10s
67
+ info: the average number of packets received during the last minute
68
+
69
+template: 10s_received_packets_storm
70
+ on: net.packets
71
+ lookup: average -10s of received
72
+ calc: $this * 100 / (($1m_received_packets_rate < 1000)?(1000):($1m_received_packets_rate))
73
+ every: 10s
74
+ units: %
75
+ warn: $this > (($status >= $WARNING)?(200):(1000))
76
+ crit: $this > (($status >= $WARNING)?(1000):(2000))
77
+ info: the % of the rate of received packets in the last 10 seconds, compared to the rate of the last minute
78
+ role: silent
79
+