   alarm: 30min_packet_drops_mon0
      on: proc_net_dev_local.net_drops.mon0
  lookup: sum -30m unaligned absolute
   every: 10s
   delay: down 15m multiplier 1.5 max 1h                                                     
    warn: $this > 0
    info: packet drop for mon0
      to: sysadmin

   alarm: 30min_packet_drops_mon1
      on: proc_net_dev_local.net_drops.mon1
  lookup: sum -30m unaligned absolute
   every: 10s
   delay: down 15m multiplier 1.5 max 1h                                                     
    warn: $this > 0
    info: packet drop for mon1
      to: sysadmin

   alarm: 30min_packet_drops_mon2
      on: proc_net_dev_local.net_drops.mon2
  lookup: sum -30m unaligned absolute
   every: 10s
   delay: down 15m multiplier 1.5 max 1h                                                     
    warn: $this > 0
    info: packet drop for mon2
      to: sysadmin

   alarm: 30min_packet_drops_mon3
      on: proc_net_dev_local.net_drops.mon3
  lookup: sum -30m unaligned absolute
   every: 10s
   delay: down 15m multiplier 1.5 max 1h                                                     
    warn: $this > 0
    info: packet drop for mon3
      to: sysadmin
 
   alarm: 30min_packet_drops_suricata
      on: suricata_local.received_packets
  lookup: sum -30m of Dropped packets
   every: 10s
   delay: down 15m multiplier 1.5 max 1h
    warn: $this > 0
    info: packet drop for suricata
      to: sysadmin


