netdata/health/health.d/tcp_orphans.conf

#
# check
# http://blog.tsunanet.net/2011/03/out-of-socket-memory.html
#
# The kernel may penalize orphans by 2x or even 4x
# so we alarm warning at 25% and critical at 50%
#

    alarm: tcp_orphans
       on: ipv4.sockstat_tcp_sockets
    class: Errors
     type: System
component: Network
       os: linux
    hosts: *
     calc: ${orphan} * 100 / ${tcp_max_orphans}
    units: %
    every: 10s
     warn: $this > (($status >= $WARNING ) ? ( 20 ) : ( 25 ))
     crit: $this > (($status == $CRITICAL) ? ( 25 ) : ( 50 ))
    delay: up 0 down 5m multiplier 1.5 max 1h
     info: orphan IPv4 TCP sockets utilization
       to: sysadmin