From Scribby Peccary, 5 Years ago, written in Plain Text.
Embed
  1. $config['alert']['macros']['rule']['dynamic_out_speed'] = '(%ports.ifOutOctets_rate*8/1000000)';
  2. $config['alert']['macros']['rule']['dynamic_in_speed'] = '(%ports.ifInOctets_rate*8/1000000)';
  3. $config['alert']['macros']['rule']['inbound'] = '%ports.port_descr_speed != "" && %macros.dynamic_in_speed > SUBSTRING_INDEX(%ports.port_descr_speed,"/",-1)';
  4. $config['alert']['macros']['rule']['outbound'] = '%ports.port_descr_speed != "" && %macros.dynamic_out_speed > SUBSTRING_INDEX(%ports.port_descr_speed,"/",1)';
  5.  
  6.