Monitors
Configure monitoring policies to track device health and detect issues automatically. Set up built-in and script monitors, route alerts, and review monitoring history.
26 articles
Getting Started with MonitorsCreate and manage monitoring rules that watch your devices and trigger alerts when thresholds are exceeded.
Resources
Core compute pressure: CPU and memory usage against a threshold.
CPU Usage MonitorAlert when CPU usage on a device exceeds a defined threshold for a sustained period.
Memory Usage MonitorAlert when RAM usage on a device exceeds a defined threshold for a sustained period.
Disk
Storage health and performance: capacity, throughput, IOPS, latency, queue depth, and SMART status.
Disk Usage MonitorAlert when available disk space on a device drops below a defined threshold.
Disk Encryption StatusAlert when a device's primary partition isn't encrypted. The Encryption Status monitor checks BitLocker on Windows, FileVault on macOS, and LUKS on Linux with no configuration needed.
Disk Throughput MonitorAlert when combined disk read and write throughput exceeds a MB/s threshold for a sustained duration. Covers drive selection, thresholds, breach duration, and remediation.
Disk IOPS MonitorAlert when a drive's read and write operations per second exceed a threshold for a sustained period. Configure drive scope, IOPS threshold, breach duration, remediations, and notifications.
Disk Latency MonitorAlert when read and write latency on a device's drives climbs above a threshold and stays there. Covers drive targeting, thresholds, breach duration, remediation, and notifications.
Disk Queue Length MonitorAlert when a disk's queue of pending I/O operations stays above a threshold. Covers configuration, how Level reads queue depth on Windows, macOS, and Linux, and threshold guidance.
Disk Active Time MonitorAlert when a device's drives stay busy above a percentage threshold for a sustained period. Covers configuration, per-OS data sources, and how readings are sampled.
Disk SMART Status MonitorDetect failing drives before they die. The SMART Status monitor watches every drive's SMART self-assessment on Windows, macOS, and Linux and alerts the moment any drive reports a failing status.
Network
Connectivity and link behavior: device reachability, ping, and bandwidth saturation.
Connection MonitorAlert when a device goes offline or comes back online, with configurable breach duration and auto-remediation.
Network Ping MonitorAlert when ping latency to a host stays above your threshold. Learn how the Network Ping monitor samples latency, what each setting controls, and how to tune thresholds and breach…
Network Saturation MonitorAlert when a device's bandwidth usage stays above a set percentage of its link speed for a sustained duration. Passive measurement, no test traffic. Configure threshold, breach duration, severity, and…
Network Abnormal UploadAlert when a device's upload bandwidth exceeds a threshold for a sustained duration. Useful for catching data exfiltration, runaway backups, and other unexpected outbound traffic.
Security
Risk and posture signals: encryption state, antivirus, failed logins, account changes, and abnormal outbound traffic.
User MonitorAlert when a device's local user accounts drift from your expected list. Catch rogue or unauthorized accounts the moment they appear, or get notified when a required service account goes…
Failed Login MonitorAlert on repeated failed login attempts on Windows, macOS, and Linux. Set a threshold and time window, scope to all users or admins only, and attach remediations like locking the…
Antivirus MonitorGet alerted when antivirus protection on a Windows workstation is disabled, running stale definitions, or has real-time protection turned off. Reads Windows Security Center, so it works with most AV…
System
OS and process-level state: applications, processes, services, event logs, and uptime.
Application MonitorGet alerted when required software goes missing or unauthorized software shows up.
Process MonitorAlert when a specific process starts running or stops running on a device.
Service MonitorAlert when a specific service stops or starts, with the option to automatically restart it.
Event Log MonitorAlert when specific Windows Event IDs appear a defined number of times within a set time window.
Uptime MonitorAlert when a device's uptime passes a day threshold you set, so machines stuck on pending patches or slow memory leaks don't go unrebooted.
Custom
Create custom monitors that run PowerShell, Bash, or Python scripts to evaluate device health.
Run Script MonitorMonitor any device condition by running a script and evaluating its output against a threshold or string match.
Script Monitor ExamplesWorked examples showing complete scripts and monitor configurations for common use cases.
Monitoring systemd Unit Files on LinuxWhy Linux systemd unit files trigger false 'Down' alerts in service monitors and how to monitor them accurately using a script monitor.