{
  "title": "conntrack_table_full",
  "description": "Linux kernel: nf_conntrack table full, dropping packets - active packet loss on this NAT/firewall host (standard, well-documented kernel message)",
  "source": "rule \"conntrack_table_full\"\nwhen\n  contains(to_string($message.message), \"nf_conntrack: table full, dropping packet\")\nthen\n  set_field(\"vendor\", \"linux-conntrack\");\n  set_field(\"event_type\", \"conntrack_table_full\");\n  set_field(\"severity_tag\", \"critical\");\nend"
}