// 
// Some Common Performance Monitoring Scenarios
//
// The CPU Group
//

delta = 2 sec;	// more often for demonstration purposes

// common prefixes
//
percpu	= "kernel.percpu";
all	= "kernel.all";

//
// Unusual usr-sys split when some CPU is more than 20% in usr mode
// and sys mode is at least 1.5 times usr mode
//
cpu_usr_sys =
    some_inst (
	$percpu.cpu.sys > $percpu.cpu.user * 1.5 && $percpu.cpu.user > 0.2
    )
	->  alarm "Unusual sys time: " "%i ";

//
// Over all CPUs, syscall_rate > 1000 * no_of_cpus
//
cpu_syscall =
    $all.syscall > 1000 count/sec * hinv.ncpu
    ->  print "high aggregate syscalls: %v";

// Sustained high syscall rate on a single CPU
//
delta = 30 sec;
percpu_syscall =
    some_inst (
	$percpu.syscall > 2000 count/sec
    )
	-> syslog "Sustained syscalls per second? " "[%i] %v ";

//
// the 1 minute load average exceeds 5 * number of CPUs on any host
//

hosts = ":gonzo :moomba";	// change as required
delta = 1 minute;		// no need to evaluate more often than this
high_load =
    some_host (
	$all.load $hosts #'1 minute' > 5 * hinv.ncpu $hosts
    ) -> alarm "High Load Average? " "%h: %v ";