Introduction
Consultez chaque alerte that's fired on a device, dig into what triggered it, and track how it was resolved. The Alertes tab in device details scopes the global alerts view down to a single device — same data, tighter context.
Alertes actives
The Actif tab lists every open alert for the device. Each row shows the alert's severity badge, what triggered it, when it started, and whether an automation ran in response.
Tableau des alertes
Chaque ligne d'alerte contient :
Gravité — the alert level set on the monitor: Information, Avertissement, Critique ou Urgence
Détails du déclencheur — le nom du moniteur et la condition qui s'est déclenchée (e.g., "CPU usage >75.0% for 10 minutes")
Alerte commencée — when the alert first opened
Automatisation exécutée — si une automatisation de correction a été liée to the monitor, its name appears here; click it to view that automation run's details
💡 CONSEIL : If an automation ran, open it from this column to see exactly what actions executed, what the output was, and whether remediation succeeded — without leaving the device context.
Charge utile d'alerte
Cliquez sur le › chevron on any row to expand the alert payload. What you see depends on the monitor type:
Moniteurs CPU show the top processes by CPU usage at the time the alert triggered
Moniteurs de mémoire show the top processes by memory consumption
Moniteurs de script show the raw output your script returned
Moniteurs du journal des événements show the matching event details, including Event ID, source, and message
The payload is captured when the alert opens and stays static as long as the alert remains open. If you resolve the alert and it later reopens, the payload updates to reflect conditions at the time it reopened.
Recherche et filtrage
Use the Recherche field to filter alerts by monitor name or trigger text. Cliquez sur Filtres pour filtrer par gravité. Cliquez sur Colonnes to show or hide the Source d'alerte column (hidden by default), which identifies which monitor policy the alert originated from.
Résolution des alertes
💡 CONSEIL : If the monitor has Résolution automatique enabled, Level closes the alert automatically once the condition clears. You don't need to manually resolve it.
To resolve a single alert, open its row menu (the ⋮ icon) and select Résoudre. To resolve multiple alerts at once, check the boxes next to the rows you want, then click Résoudre in the toolbar.
ℹ️ REMARQUE : Resolving an alert marks it as closed. If the same monitor condition is detected again within 24 hours, Level reopens the existing alert rather than creating a new one — and keeps the original start timestamp. You'll likely see the alert come back to the Actif tab instead of appearing under Résolu. After 24 hours without re-triggering, Level creates a fresh alert.
Alertes résolues
The Résolu tab shows every alert that's been closed, whether by a technician, an automation, or auto-resolve. Alertes are stored indefinitely — there's no expiration.
The resolved table adds two columns not present on the Actif tab:
Alerte résolue — when the alert was closed
Résolu by — who or what closed it: a technician's name, "Résolution automatiqued" if the monitor's auto-resolve fired, or blank if resolved via automation
The resolved tab also supports search, making it practical for reviewing a specific monitor's history. Expand any resolved alert row to see its payload, just like on the Actif tab.
💡 CONSEIL : Use the resolved tab to audit recurring issues. If the same monitor is firing and resolving repeatedly, that's a signal to investigate the root cause or adjust the monitor threshold.
Questions fréquemment posées
Why did an alert disappear from Actif but I can't find it under Résolu? Level reopens an existing alert if the same monitor fires again within 24 hours. When it reopens, it goes back to Actif — and it keeps the original start time, so the timestamps can look confusing. Check the Actif tab and look for an older start date on a current alert.
Who can resolve alerts on a device? Any technician with access to the device's group can resolve alerts. Autorisations are configured at the group level. See Workspace → Autorisations for details on how access is scoped.
What does the Automatisation exécutée column show if no automation was linked to the monitor? It shows
--. An automation only appears there if the monitor that triggered the alert had a remediation automation configured.The alert payload is blank — why? Some monitor types don't generate a payload. Connection monitors (offline alerts) and process/service monitors may show no payload beyond the trigger condition itself. Moniteurs de script only populate a payload if your script outputs text to stdout.
Why does an alert show a start time from months ago but still appears in Actif? The original start timestamp is preserved every time an alert reopens. If a monitor has been cycling — firing, auto-resolving, and firing again — the start time reflects when the alert first opened, not its most recent trigger.