Introduction
Alert when a drive starts responding slowly. The Disk Latency monitor tracks total read and write latency on a device's drives and creates an alert when latency breaches your threshold for a sustained duration.
Slow disks are one of the most common causes of "my computer is slow" tickets, and they're easy to miss because the drive still works. This monitor catches the degradation before it turns into a failure or a flood of complaints.
How the Disk Latency Monitor Works
The Level agent samples disk activity counters on the device and calculates total read and write latency for each monitored drive. When latency exceeds your threshold and stays there for the full breach duration, Level creates an alert.
The breach duration requirement filters out momentary slowness. A drive that briefly stalls during a burst of writes won't trigger anything. A drive that sustains high latency for several minutes is signaling a real problem: a failing disk, a saturated storage controller, or a workload the hardware can't keep up with.
ℹ️ NOTE: The monitor reads the operating system's own disk counters. It's passive and generates no disk traffic of its own, so it won't contribute to the load it's measuring.
🖥️ PLATFORM NOTE:
Windows: Latency is read from native performance counters.
macOS: Latency is read via IOKit disk statistics.
Linux: Latency is read from kernel block device statistics.
Configuring Disk Latency Monitor
Open the target monitor policy, then click + Add new monitor (or click an existing Disk Latency monitor to edit it). The monitor configuration panel opens.
Name and Type
Enter a name in the Name field. "Servers - Disk Latency" or "Workstations - Slow Disk" reads better in an alert list than "Disk Latency."
Set Type to Disk latency.
Severity
Set Severity to match how urgent slow storage is in this context:
Information
Warning
Critical
Emergency
💡 TIP: Warning is a sensible default for workstations. For servers hosting databases or file shares, where storage latency directly degrades every dependent service, consider Critical.
Drives
Drives controls which drives the monitor evaluates:
Any drive: Monitor every drive on the device.
System disk: Monitor only the device's primary system drive.
💡 TIP: System disk is useful when secondary drives have expected heavy I/O, like backup targets or scratch volumes, and you only care about the drive the OS lives on.
Threshold
Threshold sets the latency value, in milliseconds, above which the monitor starts counting a breach. Adjust using the field or the up/down arrows.
For mixed environments, 50 ms is a sensible starting point, paired with a 5 minute breach duration. Tune from there based on what actually fires.
💡 TIP: Healthy SSDs typically sit in single-digit milliseconds. Spinning disks run higher, often 10 to 20 ms under load. A threshold around 50 ms catches genuinely degraded storage on most hardware without alerting on normal HDD behavior. Tune per device class: what's alarming for an NVMe server is routine for an old laptop's hard drive.
Breach Duration
Breach duration sets how long latency must stay above the threshold before an alert is created. Adjust using the field or the slider. Range is 1 to 120 minutes.
💡 TIP: 5 to 10 minutes is a reasonable starting point. Backups, AV scans, and large file copies all produce short latency spikes that aren't worth an alert. If you're getting noise during nightly maintenance windows, lengthen the breach duration before raising the threshold.
Remediation
Remediation runs automations when this alert fires. Attach an automation that gathers diagnostics, restarts an I/O-heavy service, or notifies your team.
Click Select an automation and choose one.
Use the link icon to open the selected automation, or the × to clear it.
Notify Recipients
Notify recipients sends emails to the policy's recipients when these events occur:
On alert creation
On alert resolution
Recipients are managed at the monitor policy level, in the policy's Recipients section.
Auto-Resolve
Auto-resolve alert when conditions clear closes the alert automatically once latency drops back below the threshold. Leave it off if you want alerts to persist until a technician reviews and resolves them manually.
⚠️ WARNING: If you resolve a latency alert manually while the drive is still slow, Level won't immediately recreate it. A new alert fires only when the condition clears and then breaches again. Resolve manually only after you've confirmed the underlying issue is handled.
Reading Latency Alerts
When the monitor fires, the alert payload captures the latency readings that triggered it. The payload stays live and synced while the alert is open, then freezes at resolution to preserve the last bad state.
To triage alerts across all devices, use the Alerts global view. For a single device, open the device and check its Alerts tab.
💡 TIP: Sustained latency on one specific device usually means hardware. Pair this monitor with the SMART Health monitor in the same policy: if both fire on the same device, you're likely looking at a dying drive, and it's time to plan a replacement rather than chase software causes.
FAQ
What exactly is being measured? Total read and write latency on the selected drives, sampled from the operating system's own disk counters. It reflects how long disk operations are actually taking, regardless of what's causing the slowdown.
How is this different from the Disk Usage monitor? Disk Usage watches free space. Disk Latency watches responsiveness. A drive can be nearly empty and still be painfully slow, and a full drive can still respond quickly. Most environments want both monitors in the same policy.
My alert fires every night during backups. How do I stop that? Lengthen the breach duration so the alert only fires when high latency outlasts the backup window, or raise the threshold for that device group. If backups run on a secondary drive, switching the monitor to System disk also works.
Does the monitor slow down the disk it's watching? No. It reads counters the OS already maintains and generates no disk traffic of its own.
Can I set different thresholds for servers and workstations? Yes. Create separate monitor policies per device class and configure each with its own threshold and breach duration.
What happens to open alerts if I delete the monitor? Existing alerts remain in place. Deleting a monitor doesn't close alerts it already created, so resolve those manually.