#pmieconf-rules 1
# --- DO NOT MODIFY THIS FILE --- see pmieconf(4)
# $Id: tcp_drop_connects,v 1.1 1999/04/28 10:39:51 kenmcd Exp $
#

rule	network.tcp_drop_connects
	default	= "$rule$"
	predicate =
"some_host (
    100 * ( network.tcp.drops $hosts$ +
	    network.tcp.conndrops $hosts$ +
	    network.tcp.timeoutdrop $hosts$ )
	    / network.tcp.closed $hosts$ > $threshold$
    && network.tcp.closed $hosts$ > $min_close$ count/minute
)"
	enabled	= yes
	version	= 1
	help	=
"There is some TCP connection activity (at least min_close
connections closed per minute) and the ratio of TCP dropped
connections to all closed connections exceeds threshold percent
during the last sample interval.  High drop rates indicate either
network congestion (check the packet retransmission rate) or an
application like a Web browser that is prone to terminating TCP
connections prematurely, perhaps due to sluggish response or user
impatience.";

string	rule
	default	= "High ratio of TCP connections dropped"
	modify	= no
	display	= no;

percent	threshold
	default	= 50
	help	=
"Maximum acceptable percentage of dropped TCP connections as a
fraction of all closed TCP connections, in the range 0 (not
expecting any connections to be dropped) to 100 (expect most
connections to be dropped).";

double	min_close
	default = 20
	help =
"Unless at least min_close connections per minutes are being
closed, the rule will not be true.";

string	action_expand
	default	= %v%drops@%h
	display	= no
	modify	= no;

string	email_expand
	default	= "host: %h drops: %v% of TCP closes"
	display	= no
	modify	= no;


# Configuration info specific to non-PCP tools follows...
# 

# for SGI Embedded Support Partner integration:
string	esp_type
	default	= "0x200052"
	display	= no
	modify	= no;

# 
# --- DO NOT MODIFY THIS FILE --- see pmieconf(4)
