Introduction
Alert when a device's disk read and write activity climbs above a throughput threshold and stays there. The Disk Throughput monitor measures the combined read + write rate in MB/s, so you can catch sustained heavy I/O: a runaway backup job, a misbehaving database, or a process hammering the disk.
Like the CPU and Memory monitors, breach duration filters out brief bursts so alerts reflect a genuine, sustained condition.
How the Disk Throughput Monitor Works
Level samples disk throughput on covered devices roughly once per minute. Each check measures the current combined read and write rate across the selected drives. When that rate exceeds your threshold for the full breach duration, Level creates an alert.
ℹ️ NOTE: Each reading is a brief snapshot of the current transfer rate, not an average over the whole minute. A single check can land on a momentary spike, which is why a breach duration above the minimum is recommended. The duration requires consecutive checks over the threshold before alerting.
The alert payload includes the current total throughput, your threshold, and the read/write breakdown, so you can see at a glance whether the load is read-heavy or write-heavy.
🖥️ PLATFORM NOTE:
Windows: Reads PhysicalDisk performance counters. "Any drive" uses the combined total across all physical disks.
macOS: Reads disk I/O statistics from the kernel (IOKit). "Any drive" aggregates all disks.
Linux: Reads
/proc/diskstats. "Any drive" sums all physical disks; loop, RAM, and partition devices are excluded.
Configuring Disk Throughput Monitor
Open the target monitor policy, then add or edit a Disk Throughput monitor.
Name and Type
Enter a name in the Name field. "Servers - High Disk Throughput" reads better in an alert list than just "Disk Throughput," and keeps it distinct from an IOPS monitor in the same policy.
Set Type to Disk throughput.
Severity
Set Severity to match how urgent sustained heavy disk I/O is in this context:
Information
Warning
Critical
Emergency
💡 TIP: Heavy throughput isn't always a problem. Backups, AV scans, and large file transfers are legitimate I/O. Warning is a sensible default; reserve Critical for storage-sensitive servers where saturation directly degrades a workload.
Drives
Drives controls which drives the monitor evaluates:
Any drive — monitor every drive on the device. Throughput is the combined total across all physical disks.
System disk — monitor only the device's primary system drive.
💡 TIP: Use System disk when you only care about OS drive contention. On multi-disk machines, Any drive aggregates across all disks, so one busy data drive can push the combined total over your threshold even if every individual disk is fine.
Threshold
Threshold sets the combined read + write rate, in MB/s, that must be exceeded to trigger the monitor. Adjust using the up/down arrows or type a value directly.
Sustainable throughput varies enormously by hardware, so there's no single right number. Reasonable starting points:
Workstations with spinning disks: 100 MB/s. Mechanical drives saturate around 100-150 MB/s, so sustained throughput in this range means the disk is pinned.
Workstations with SATA SSDs: 300-400 MB/s. SATA tops out around 550 MB/s; sustained traffic near that ceiling is unusual outside of large transfers.
NVMe workstations and servers: 1,000 MB/s or higher. NVMe sustains multiple GB/s, so set the threshold based on what's abnormal for the workload rather than what the drive can do.
Backup targets, file servers, database hosts: baseline first. These legitimately run heavy I/O. Watch a typical busy period, then set the threshold above your observed peak.
💡 TIP: Create separate monitor policies for hardware classes that differ this much. One threshold can't serve a spinning-disk workstation and an NVMe database server at the same time.
Breach Duration
Breach duration sets how long throughput must stay above the threshold before an alert fires. Adjust using the slider or up/down arrows. Range is 1-120 minutes.
💡 TIP: Because each check is an instantaneous snapshot, a 1 minute duration can alert on a single brief burst. 5-10 minutes is a better starting point: long enough to ignore a file copy, short enough to catch a stuck process.
Remediation
Attach one or more automations to run when this monitor fires: capture a process list for later review, restart a known-problem service, or notify your team.
Click in the Remediation field and select an automation.
To add more, click + Add another remediation.
To remove one, click the × next to it.
Once attached, open the automation from the link icon to assign the monitor's payload to an automation variable if you want to pass alert context (current rate, read/write breakdown) into the automation's logic.
Notify Recipients
Sends emails to the policy's recipients when these events occur:
On alert creation — recipients get an email when the alert fires
On alert resolution — recipients get an email when the alert resolves
Recipients are managed at the monitor policy level, in the Recipients section.
Auto-Resolve
Auto-resolve alert when conditions clear closes the alert automatically when throughput drops back below the threshold. Leave this on unless you want alerts to persist for manual review. Disk I/O bursts resolve on their own constantly, so without auto-resolve you'll accumulate stale alerts fast.
FAQ
What's the difference between Disk Throughput and Disk Usage? Disk Usage measures free space (how full the drive is). Disk Throughput measures activity (how fast data is being read and written right now). A nearly empty drive can still saturate on throughput, and a nearly full drive can sit idle.
What's the difference between Disk Throughput and Disk IOPS? Throughput measures data volume (MB/s). IOPS counts individual read/write operations per second, regardless of size. A database doing thousands of small random reads can max out IOPS at low throughput; a backup streaming large files can hit high throughput with few operations. Monitor throughput for bandwidth saturation, IOPS for operation-heavy workloads.
Does the threshold apply to reads and writes separately? No. The monitor evaluates the combined read + write total against the threshold. The alert payload shows the read and write rates separately so you can tell which side is driving the load.
My alert fired during a backup window. How do I stop that? Either raise the breach duration past your typical backup runtime, or put backup-window devices on a separate policy with a higher threshold. Enabling maintenance mode during scheduled backup windows also suppresses monitor alerts.
Why did the alert fire when my drive can handle way more than the threshold? The threshold doesn't know what your hardware can handle; it's just a number you set. If the alert isn't meaningful, raise the threshold to match what's abnormal for that hardware class.
Does this monitor work on all platforms? Yes. Windows, macOS, and Linux are all supported.
What happens to open throughput alerts if I delete the monitor? Existing alerts remain in place. Deleting a monitor doesn't close alerts it already created. Resolve those manually.