# you can disable an alarm notification by setting the 'to' line to: silent

# --- Availability: Peer Down (SNMP) ---

 template: snmp_bgp_peer_down
       on: snmp.bgp.peers.availability
chart labels: neighbor=*
    class: Availability
     type: Network
component: BGP
   lookup: average -2m unaligned of admin_enabled,established
     calc: ($admin_enabled == 1 AND $established == 0) ? (1) : (0)
    units: status
    every: 30s
     crit: $this == 1
    delay: down 2m multiplier 1.5 max 30m
  summary: SNMP BGP peer ${label:neighbor} down
     info: SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) is administratively enabled but has remained out of Established for the full 2-minute evaluation window
       to: sysadmin

# --- Availability: Peer-Family Down (SNMP) ---

 template: snmp_bgp_peer_family_down
       on: snmp.bgp.peer_families.availability
chart labels: neighbor=* address_family=* subsequent_address_family=*
    class: Availability
     type: Network
component: BGP
   lookup: average -2m unaligned of admin_enabled,established
     calc: ($admin_enabled == 1 AND $established == 0) ? (1) : (0)
    units: status
    every: 30s
     crit: $this == 1
    delay: down 2m multiplier 1.5 max 30m
  summary: SNMP BGP peer-family ${label:neighbor} ${label:address_family}/${label:subsequent_address_family} down
     info: SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) for ${label:address_family}/${label:subsequent_address_family} has remained out of Established for the full 2-minute evaluation window
       to: sysadmin

# --- Errors: Established Transition Anomaly (SNMP) ---

 template: snmp_bgp_peer_transitions_anomaly
       on: snmp.bgp.peers.established_transitions
chart labels: neighbor=*
    class: Errors
     type: Network
component: BGP
   lookup: average -10m anomaly-bit of transitions
     calc: $this
    units: %
    every: 30s
     warn: $this > (($status >= $WARNING)  ? (5) : (20))
     crit: $this > (($status == $CRITICAL) ? (20) : (40))
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP BGP transition anomaly on peer ${label:neighbor}
     info: Rolling ML anomaly rate for established-transition counts on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}); sustained anomalies usually indicate flaps or unstable reachability
       to: sysadmin

# --- Errors: Peer-Family Established Transition Anomaly (SNMP) ---

 template: snmp_bgp_peer_family_transitions_anomaly
       on: snmp.bgp.peer_families.established_transitions
chart labels: neighbor=* address_family=* subsequent_address_family=*
    class: Errors
     type: Network
component: BGP
   lookup: average -10m anomaly-bit of transitions
     calc: $this
    units: %
    every: 30s
     warn: $this > (($status >= $WARNING)  ? (5) : (20))
     crit: $this > (($status == $CRITICAL) ? (20) : (40))
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP BGP transition anomaly on peer-family ${label:neighbor} ${label:address_family}/${label:subsequent_address_family}
     info: Rolling ML anomaly rate for established-transition counts on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) for ${label:address_family}/${label:subsequent_address_family}; sustained anomalies usually indicate flaps or unstable reachability
       to: sysadmin

# --- Errors: Update Churn Anomaly (SNMP) ---

 template: snmp_bgp_peer_updates_anomaly
       on: snmp.bgp.peers.update_traffic
chart labels: neighbor=*
    class: Errors
     type: Network
component: BGP
   lookup: average -10m anomaly-bit of received,sent
     calc: $this
    units: %
    every: 30s
     warn: $this > (($status >= $WARNING)  ? (5) : (20))
     crit: $this > (($status == $CRITICAL) ? (20) : (40))
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP BGP update anomaly on peer ${label:neighbor}
     info: Rolling ML anomaly rate for BGP UPDATE traffic on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}); sustained anomalies usually indicate route churn or unstable adjacencies
       to: sysadmin

# --- Errors: Peer-Family Update Churn Anomaly (SNMP) ---

 template: snmp_bgp_peer_family_updates_anomaly
       on: snmp.bgp.peer_families.update_traffic
chart labels: neighbor=* address_family=* subsequent_address_family=*
    class: Errors
     type: Network
component: BGP
   lookup: average -10m anomaly-bit of received,sent
     calc: $this
    units: %
    every: 30s
     warn: $this > (($status >= $WARNING)  ? (5) : (20))
     crit: $this > (($status == $CRITICAL) ? (20) : (40))
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP BGP update anomaly on peer-family ${label:neighbor} ${label:address_family}/${label:subsequent_address_family}
     info: Rolling ML anomaly rate for BGP UPDATE traffic on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) for ${label:address_family}/${label:subsequent_address_family}; sustained anomalies usually indicate route churn or unstable adjacencies
       to: sysadmin

# --- Errors: Accepted Prefix Drift (SNMP) ---

 template: snmp_bgp_peer_family_prefixes_accepted_anomaly
       on: snmp.bgp.peer_families.route_counts.current
chart labels: neighbor=* address_family=* subsequent_address_family=*
    class: Errors
     type: Network
component: BGP
   lookup: average -15m anomaly-bit of accepted
     calc: $this
    units: %
    every: 30s
     warn: $this > (($status >= $WARNING)  ? (5) : (15))
     crit: $this > (($status == $CRITICAL) ? (15) : (30))
    delay: down 10m multiplier 1.5 max 1h
  summary: SNMP BGP accepted-prefix drift on peer-family ${label:neighbor} ${label:address_family}/${label:subsequent_address_family}
     info: Rolling ML anomaly rate for accepted prefix counts on SNMP BGP peer ${label:neighbor} (AS${label:remote_as}) for ${label:address_family}/${label:subsequent_address_family}; sustained anomalies usually mean unexpected route loss or route growth after policy
       to: sysadmin
