# The following symptoms are used by the default Alarm Window
# Bottleneck alarms.  They are re-evaluated every interval and
# the probabilities are summed.  These summed probabilities are
# checked by the bottleneck alarms.  The buttons on the xglance
# main window will turn yellow when a probability exceeds 50%
# for an interval, and red when a probability exceeds 90% for
# an interval.  

# You may edit these rules to suit your environment!

# The CPU bottleneck symptom default is influenced mostly by the overall
# cpu utilization.  Note that cpu utilization may be high even though
# there is no bottleneck.  The run queue is an indicator processes are
# waiting for cpu resources, and that the cpu may be bottlenecked.
symptom CPU_Bottleneck type=CPU
rule GBL_CPU_TOTAL_UTIL         > 75  prob 25
rule GBL_CPU_TOTAL_UTIL         > 85  prob 25
rule GBL_CPU_TOTAL_UTIL         > 90  prob 25
rule GBL_RUN_QUEUE              > 2   prob 25

# The Disk bottleneck symptom default is influenced mostly by the busiest
# disk's utilization.  The disk request queue is an indicator that processes
# may be waiting for disk resources.
symptom Disk_Bottleneck type=DISK
rule GBL_DISK_UTIL_PEAK     > 50   prob GBL_DISK_UTIL_PEAK
rule GBL_DISK_REQUEST_QUEUE >  3   prob 25

# The Memory bottleneck symptom default is triggered by a combination
# of several metrics.  Excessive page outs can be an indicator of memory
# pressure when the memory utilization is high, however memory-mapped
# file writes also generate pageouts.  Under heavy memory pressure, data
# will start to be swapped out.
symptom Memory_Bottleneck type=MEMORY
rule GBL_MEM_UTIL              >   95  prob 30
rule GBL_MEM_UTIL              >   98  prob 20
rule GBL_MEM_PAGEOUT_BYTE_RATE >  200  prob 20
rule GBL_MEM_SWAPOUT_BYTE_RATE >    0  prob 20
rule GBL_MEM_SWAPOUT_BYTE_RATE >   10  prob 50

# The Network bottleneck symptom default relies on general throughput
# metrics.  Not all network interfaces report collision data.  To be
# useful as a bottleneck indicator, the rate thresholds should be
# adjusted based on values seen in historical data for a particular
# system or network.  For example, 100mbit networks cannot handle as
# high packet rates without a bottleneck than can gigabit networks.
symptom Network_Bottleneck type=NETWORK
rule GBL_NFS_CALL_RATE         >  500  prob 25
rule GBL_NET_COLLISION_PCT     >   10  prob 10
rule GBL_NET_COLLISION_PCT     >   25  prob 20
rule GBL_NET_COLLISION_PCT     >   50  prob 30
rule GBL_NET_PACKET_RATE       >  500  prob 10
rule GBL_NET_PACKET_RATE       > 1000  prob 15
rule GBL_NET_PACKET_RATE       > 3000  prob 20
rule GBL_NET_PACKET_RATE       > 5000  prob 25
rule GBL_NET_PACKET_RATE       > 9000  prob 25

# Below are the primary CPU, Disk, Memory, and Network Bottleneck alarms.
# For each area, a calculated bottleneck symptom probability is used
# to define yellow or red alerts.

alarm CPU_Bottleneck > 50 for 2 minutes
  start
    if CPU_Bottleneck > 90 then
      red alert "CPU Bottleneck probability= ", CPU_Bottleneck, "%"
    else
      yellow alert "CPU Bottleneck probability= ", CPU_Bottleneck, "%"
  repeat every 10 minutes
    if CPU_Bottleneck > 90 then
      red alert "CPU Bottleneck probability= ", CPU_Bottleneck, "%"
    else
      yellow alert "CPU Bottleneck probability= ", CPU_Bottleneck, "%"
  end
    reset alert "End of CPU Bottleneck Alert"

alarm Disk_Bottleneck > 50 for 2 minutes
  start
    if Disk_Bottleneck > 90 then
      red alert "Disk Bottleneck probability= ", Disk_Bottleneck, "%"
    else
      yellow alert "Disk Bottleneck probability= ", Disk_Bottleneck, "%"
  repeat every 10 minutes
    if Disk_Bottleneck > 90 then
      red alert "Disk Bottleneck probability= ", Disk_Bottleneck, "%"
    else
      yellow alert "Disk Bottleneck probability= ", Disk_Bottleneck, "%"
  end
    reset alert "End of Disk Bottleneck Alert"

alarm Memory_Bottleneck > 50 for 2 minutes
  start
    if Memory_Bottleneck > 90 then
      red alert "Memory Bottleneck probability= ", Memory_Bottleneck, "%"
    else
      yellow alert "Memory Bottleneck probability= ", Memory_Bottleneck, "%"
  repeat every 10 minutes
    if Memory_Bottleneck > 90 then
      red alert "Memory Bottleneck probability= ", Memory_Bottleneck, "%"
    else
      yellow alert "Memory Bottleneck probability= ", Memory_Bottleneck, "%"
  end
    reset alert "End of Memory Bottleneck Alert"

alarm Network_Bottleneck > 50 for 2 minutes
  start
    if Network_Bottleneck > 90 then
      red alert "Network Bottleneck probability= ", Network_Bottleneck, "%"
    else
      yellow alert "Network Bottleneck probability= ", Network_Bottleneck, "%"
  repeat every 10 minutes
    if Network_Bottleneck > 90 then
      red alert "Network Bottleneck probability= ", Network_Bottleneck, "%"
    else
      yellow alert "Network Bottleneck probability= ", Network_Bottleneck, "%"
  end
    reset alert "End of Network Bottleneck Alert"

# The following alarm may be appropriate for detecting high packet error
# percentages that can occur on some network interface types.  The alarm
# threshold depends on the percentage of errors only when the packet
# rate exceeds a threshold. The values may need to be modified for your
# environment.
alarm  (GBL_NET_PACKET_RATE > 100) and
      ((GBL_NET_IN_ERROR_PCT > 4) or
       (GBL_NET_OUT_ERROR_PCT > 2))
  start
    yellow alert "Network error rate exceeded threshold"
  end
    reset alert "End of network error rate alert"

# The following are system table alarms.

# Global swap space utilization alarm:
alarm GBL_SWAP_SPACE_UTIL > 95
  start
    red alert "Global swap space is nearly full"
  end
    reset alert "End of global swap space full condition"

# Shared memory table alarm:
alarm TBL_SHMEM_TABLE_UTIL > 90
  start
    red alert "Shared memory table is nearly full"
  end
    reset alert "End of shared memory table full condition"

# Semaphore table alarm:
alarm TBL_SEM_TABLE_UTIL > 90
  start
    red alert "Semaphore table is nearly full"
  end
    reset alert "End of semaphore table full condition"

# Message queue table alarm:
alarm TBL_MSG_TABLE_UTIL > 90
  start
    red alert "Message queue table is nearly full"
  end
    reset alert "End of message queue full condition"

# This alarm tests for Transaction Tracker overflows.  If you have old
# transactions then restarting the ttd will free up that memory.  Otherwise,
# you may need to restart the midaemon with the -udts parm to increase
# midaemon capacity.
alarm  GBL_TT_OVERFLOW_COUNT > 0
  start
    yellow alert "Transaction Tracker overflow - restart ttd or midaemon - see man pages"
  repeat every 30 minutes
    yellow alert "Transaction Tracker overflow"

# Some examples of adviser syntax are included for you information 
# in the /opt/perf/examples/adviser directory.