netdata/health/health.d/tcp_conn.conf

#
# ${tcp_max_connections} may be nan or -1 if the system
# supports dynamic threshold for TCP connections.
# In this case, the alarm will always be zero.
#

    alarm: tcp_connections
       on: ip.tcpsock
    class: Workload
     type: System
component: Network
       os: linux
    hosts: *
     calc: (${tcp_max_connections} > 0) ? ( ${connections} * 100 / ${tcp_max_connections} ) : 0
    units: %
    every: 10s
     warn: $this > (($status >= $WARNING ) ? ( 60 ) : ( 80 ))
     crit: $this > (($status == $CRITICAL) ? ( 80 ) : ( 90 ))
    delay: up 0 down 5m multiplier 1.5 max 1h
  summary: System TCP connections utilization
     info: IPv4 TCP connections utilization
       to: sysadmin