Introduction
Alert when a device's network bandwidth usage climbs above a percentage of its link speed and stays there. The Network Saturation monitor fires once usage has exceeded your threshold for the full breach duration, so short bursts (a file download, a sync job kicking off) don't create noise.
Use it to catch devices saturating their link: a runaway backup, a misbehaving sync client, or a server pushing more traffic than its connection can handle.
How the Network Saturation Monitor Works
The monitor is passive. It doesn't run a speed test, and it doesn't upload or download anything. The Level agent reads the operating system's own per-interface byte counters every 60 seconds, calculates throughput from the change since the last sample, and compares that against the link speed the network adapter reports. Zero generated traffic.
Saturation is bidirectional: inbound and outbound throughput are summed, then divided by the interface's link speed. On a 1 Gbps link, 400 Mbps in plus 500 Mbps out is 90% saturation.
When saturation meets or exceeds your threshold and holds there for the full breach duration, Level creates an alert.
ℹ️ NOTE: Because sampling happens once per minute, the breach duration effectively works in 1-minute increments. A 5-minute duration means roughly 5 consecutive over-threshold samples before the alert fires.
Which Interfaces Are Measured
Every physical interface is evaluated separately, not aggregated. If any single interface saturates, the monitor fires, and the alert identifies which one.
Level automatically excludes interfaces that would produce meaningless readings: loopback, virtual and container interfaces (Docker, Podman, and similar), VPN adapters (WireGuard, Tailscale, tun/tap), VM adapters (VMware, VirtualBox, Hyper-V), WSL, and Bluetooth. Interfaces without a detectable link speed are skipped.
🖥️ PLATFORM NOTE:
Link speed comes from the OS:
Windows: WMI network adapter speed
macOS: IOKit link speed, with the current Wi-Fi transmit rate as a fallback for wireless interfaces
Linux: the kernel's reported interface speed, with wireless rates read via Wireless Extensions
ℹ️ NOTE: On Wi-Fi, the link speed is the current negotiated rate, which changes with signal quality. Saturation percentages on wireless interfaces are relative to that moving target, so expect them to be less stable than wired readings.
Configuring Network Saturation Monitor
Open the target monitor policy, then click + Add new monitor. The Add new monitor panel opens.
Name and Type
Enter a name in the Name field. The name is optional, but something like "Servers - Network Saturation" is more useful in an alert list than the default.
Set Type to Network saturation.
Severity
Set Severity to match how urgent a saturated link is in this context:
Information
Warning
Critical
Emergency
Threshold
Threshold sets the saturation percentage that must be met or exceeded to trigger the monitor. Adjust using the slider or the up/down arrows. Range is 0 to 100%.
💡 TIP: 90% is a solid starting point. A link running at 70% is busy but healthy. Sustained usage above 90% is where latency climbs and other traffic on the device starts to suffer.
Breach Duration
Breach duration sets how long saturation must stay at or above the threshold before an alert fires. Adjust using the slider or up/down arrows. Range is 0 to 120 minutes.
💡 TIP: 5 minutes filters out most legitimate heavy transfers (installer downloads, cloud sync bursts) while still catching the sustained saturation you actually care about, like a backup job running during business hours.
Remediation
Attach an automation to run when this alert fires: notify your team, capture diagnostics, or kill a known bandwidth hog.
Click in the Remediation field and select an automation.
Use the link icon to open the selected automation in a new tab, or the eye icon to preview it.
To remove the automation, click the ×.
Once attached, open the automation to assign the monitor's payload to an automation variable. The payload lists each saturated interface with its inbound throughput, outbound throughput, and link speed, so a remediation script knows exactly which adapter tripped the alert.
Notify Recipients
Two checkboxes control whether the policy's recipients get emailed:
On alert creation sends an email when the alert fires
On alert resolution sends an email when the alert resolves
Recipients are managed at the monitor policy level, in the Recipients section. These checkboxes only control whether this specific monitor sends to that list.
Auto-Resolve
The Auto-resolve alert when conditions clear toggle closes the alert automatically once saturation drops back below the threshold. Leave this on unless you want alerts to persist for manual review.
FAQ
Does this monitor generate any network traffic? No. It's fully passive. The agent reads the OS's byte counters for each interface and does the math locally. There's no speed test, no test file, and no traffic to or from Level's servers.
How does Level know what my "available bandwidth" is? It uses the link speed your network adapter reports to the OS. Keep in mind that's the local link, not your internet plan: a gigabit NIC behind a 200 Mbps ISP connection measures saturation against 1 Gbps. A device maxing out its internet plan at 200 Mbps would read as 20% saturated.
Does this measure upload, download, or both? Both, combined. Inbound and outbound throughput are summed against the link speed. 400 Mbps down plus 500 Mbps up on a gigabit link is 90%.
What if a device has multiple network adapters? Each physical interface is checked independently. If any one of them crosses the threshold for the breach duration, the alert fires, and the alert payload tells you which interface and what its inbound, outbound, and link speed numbers were. Virtual adapters (VPNs, Docker, VMs, WSL) are excluded automatically.
Will a big download or backup set this off? Only if it stays above the threshold for the full breach duration. A 2-minute burst at 100% passes silently. A backup pegging the link for 20 minutes fires the alert.
Why does my Wi-Fi device alert inconsistently? Wireless link speed is the current negotiated rate, which moves with signal quality. The same throughput can read as 60% saturation near the access point and 95% across the building. For noisy Wi-Fi environments, consider a higher threshold or longer breach duration.
Who can create and edit monitors? Technicians with access to the relevant monitor policy. Permission settings are managed in Workspace → Permissions.
What happens to open alerts if I delete the monitor? Existing alerts remain in place. Deleting a monitor doesn't close alerts it already created. Resolve those manually.