This is only half the story really. The hardest part by far is setting up the monitoring to gather historical data, otherwise this article could be shortened to "measure it over a month and take the 90 percentile". Setting the limits is pretty easy, working them out is harder.