Introduction
Catch disks that are working too hard. The Disk Active Time monitor tracks the percentage of time a device's drives are busy servicing I/O, and fires an alert when that percentage stays above your threshold for a sustained duration. A drive pinned at high active time is often the real reason a machine "feels slow" even when CPU and memory look fine.
Disk Active Time Monitor
Level samples how busy the selected drives are on covered devices. When busy time exceeds your threshold and stays there for the full breach duration, Level creates an alert.
Active time is a percentage from 0 to 100. A drive at 95% active time is spending nearly all of its time servicing reads and writes, which usually means I/O queuing, sluggish applications, and unhappy users.
ℹ️ NOTE: Active time tells you a drive is busy, not why. Pair this monitor with a remediation automation or follow up in Background Management → Processes to find what's generating the I/O.
How Readings Are Taken
Each reading is a snapshot, not a sustained average. On every evaluation, the agent takes two samples roughly 100 ms apart and computes an instantaneous busy percentage from the difference. Evaluations run on the monitor's check interval (every 60 seconds by default).
Two practical consequences:
A spike that lives entirely between two evaluations is missed.
A single reading can look spiky, since 100 ms of heavy I/O reads as a high percentage.
This is exactly why the breach duration matters. Requiring the condition to hold across multiple consecutive readings filters out one-off blips and surfaces genuinely sustained disk pressure.
🖥️ PLATFORM NOTE:
Windows: Reads the % Disk Time performance counter (PhysicalDisk set). This counter is uncapped, so on a busy multi-disk device with Any drive selected, readings can exceed 100%. A 112% reading isn't a bug; it reflects combined activity across disks.
macOS: Reads busy time from IOKit. Capped at 100%.
Linux: Reads busy milliseconds (ioTicks) from
/proc/diskstats. Capped at 100%.
Configuring Disk Active Time Monitor
Open the target monitor policy, then add or edit a Disk Active Time monitor. The monitor configuration panel opens on the right.
Name and Type
Enter a name in the Name field. Include the threshold and target in the name, like "Servers - Disk Active Time (90%)," so alerts are readable at a glance.
Set Type to Disk active time.
Severity
Set Severity to match how urgent sustained disk saturation is in this context:
Information
Warning
Critical
Emergency
💡 TIP: Disk saturation on a file server or database host deserves a higher severity than the same reading on a workstation running a backup. Use separate policies with different severities rather than one global setting.
Drives
ℹ️ NOTE: With Any drive selected on Windows, readings combine activity across all physical disks and can exceed 100%. See the platform note above.
Drives controls which drives the monitor evaluates:
Any drive — monitor every drive on the device
System disk — monitor only the device's primary system drive
💡 TIP: System disk cuts noise from drives that are expected to run hot, like backup targets and archive volumes. If users complain a machine is slow, the system disk is usually the one that matters.
Threshold
Threshold sets the busy percentage above which the alert condition is met. Adjust with the slider or the up/down arrows, from 0% to 100%.
There's no universal right number, but 80 to 90% sustained is a reasonable starting point for most environments. Healthy drives spend most of their time idle.
Breach Duration
Breach duration sets how long the active time must stay above the threshold before the alert fires, from 1 to 120 minutes.
Because each reading is a short snapshot, a 1 minute breach duration will catch brief bursts like application launches and AV scans. 5 to 10 minutes is a better floor if you only want alerts for sustained saturation.
⚠️ WARNING: Setting the threshold low and the breach duration short together produces noisy alerting on virtually any active device. Tune one before lowering the other.
Remediation
Attach an automation that runs when this alert fires. Select an automation from the dropdown, or leave it empty.
The icons next to the field: the link icon opens the selected automation, the eye icon previews it, and the X clears the selection.
Notify Recipients
Sends emails to the policy's recipients when these events occur:
On alert creation
On alert resolution
Auto-Resolve
Toggle Auto-resolve alert when conditions clear to have Level close the alert automatically once active time drops back below the threshold. Leave it off if you want alerts to stay open until a technician resolves them manually.
FAQ
What's the difference between Disk Active Time and Disk Usage? Disk Usage watches free space (capacity). Disk Active Time watches how busy the drive is (performance). A drive can be 90% empty and still be saturated with I/O, and vice versa.
My Windows device reported 112% active time. Is that a bug? No. With Any drive selected, Windows readings combine activity across all physical disks using an uncapped counter, so multi-disk devices under load can exceed 100%. macOS and Linux cap readings at 100%.
Why didn't a short disk spike trigger an alert? Two reasons. The condition has to hold for the full breach duration, and the agent samples active time on a check interval rather than continuously, so a spike that starts and ends between evaluations isn't seen at all.
The alert keeps firing during backups. How do I stop that? Either raise the breach duration past your backup window's typical burst length, switch Drives to System disk if the backup target is a secondary drive, or put affected devices in maintenance mode during the backup window.
Does the alert tell me which drive triggered it? With System disk selected, it's the primary system drive by definition. With Any drive, the alert reflects combined drive activity.
What happens to open alerts if I delete the monitor? Existing alerts remain in place. Deleting a monitor doesn't close alerts it already created. Resolve those manually.