Introduction
Alert when a device's memory usage climbs above a threshold and stays there. Like the CPU Usage monitor, breach duration filters out normal spikes so alerts reflect a genuine, sustained condition.
How the Memory Usage Monitor Works
Level tracks RAM utilization on covered devices. When usage exceeds your threshold and holds there for the full breach duration, Level creates an alert.
Memory pressure that resolves in seconds (garbage collection, a burst of activity) won't trigger anything. Sustained high usage — the kind that leads to slowdowns, swap thrashing, or service crashes — will.
Configuring Memory Usage Monitor
Open the target monitor policy, then add or edit a Memory Usage monitor. The Edit monitor panel opens on the right.
Name and Type
Enter a name in the Name field. "Servers - High Memory" is more scannable in an alert list than "Memory Monitor."
Set Type to Memory usage.
Severity
Set Severity based on how critical sustained high memory is in this context:
Information
Warning
Critical
Emergency
Threshold
Threshold sets the RAM utilization percentage that must be exceeded to trigger the monitor. Adjust using the slider or up/down arrows. Range is 0–100%.
Breach Duration
Breach duration sets how long memory must stay above the threshold before an alert fires. Adjust using the slider or up/down arrows. Range is 0–120 minutes.
💡 TIP: Memory usage tends to be stickier than CPU — it doesn't naturally spike and drop the same way. A shorter breach duration (2–5 minutes) is often appropriate here compared to CPU monitors.
Auto-Resolve
Auto-resolve alert if it is no longer applicable (enabled by default) closes the alert when memory usage drops back below the threshold. Leave this on unless you want alerts to persist for manual review.
Remediation
Attach one or more automations to run when this monitor fires — restart a memory-leaking service, clear a cache, or page your team.
Click in the Remediation field and select an automation.
To add more, click + Add another remediation.
To remove one, click the × next to it.
Once attached, open the automation from the link icon to assign the monitor's payload to an automation variable.
ℹ️ NOTE: Remediations run when the alert is created, not when it resolves.
Notifications
Send notifications on alert creation — policy recipients get an email when the alert fires
Send notifications on alert resolution — policy recipients get an email when the alert resolves
Recipients are managed at the monitor policy level, in the Recipients section.
ℹ️ NOTE: If no recipients are added to the policy, notification emails won't send regardless of these toggle states.
Saving the Monitor
Click Update monitor to save changes, or Add monitor if adding a new one.
FAQ
Who can create and edit monitors? Technicians with access to the relevant monitor policy. Permission settings are managed in Workspace → Permissions.
My memory alert keeps firing and auto-resolving repeatedly on the same device. What's going on? The device likely has a process with a memory leak that's being cleared periodically (by a scheduled task, service restart, or GC cycle) but keeps growing back. Use Background Management → Processes to identify the culprit. Consider attaching a remediation that restarts the offending service, or adjust the breach duration to catch sustained episodes rather than repeated short ones.
What's the difference between threshold and breach duration? Threshold is the percentage that must be exceeded. Breach duration is how long it must stay exceeded. Both conditions must be met before an alert fires.
Can I set different memory thresholds for different device groups? Yes — create separate monitor policies per device group and configure thresholds independently.
What happens to open memory alerts if I delete the monitor? Existing alerts remain in place. Deleting a monitor doesn't close alerts it already created — resolve those manually.