Here’s my alert to detect when average port usage is greater than 80% of the interface maximum speed:
I use macros.port_usage_perc to do most of the work - it choses the highest value between in and out then works out what percentage of the interface speed it is, so I’m checking for >= 80.
I have a couple of “workarounds” in my conditions for issues. The ports.ifSpeed test is to cause the rule to ignore ports with link speeds of <50Mbps (10Mbps) as most of our PC’s switch from gigabit to 10Mbps when they go into wake on lan standby, this can sometimes trigger bandwidth alerts because the previous 5 minutes worth of data throughput may be more than 8Mbps and LibreNMS now thinks the port is only a 10Mbps port so is overloaded…
Checking ports.ifInOctets_prev and ports.ifOutOctets_prev is greater than zero avoids false alerts when SNMP data is incompletely captured and some traffic counters return zeros instead of real values. These bad polling sessions also show up as large spikes on traffic graphs, but this test at least avoids alerting on it.
While I’m testing for percentage utilisation if you want to test for absolute traffic values you should use ifInOctets_rate and ifOutOctets_rate - this is the rate calculated with polling interval taken into account. (Eg not just the byte delta without information about how far apart the polling periods were)