Monitoring & alerting
Track endpoint health metrics and receive alerts when thresholds are breached.
Overview
Monitoring & alerting provides real-time and historical visibility into the health of every managed endpoint. The agent continuously collects metrics — CPU usage, memory, disk space, network throughput, service status, event-log entries, and more — and sends them to the server for evaluation against your alert rules.
When a metric breaches a threshold you define, Xcellerate RMM fires an alert. Alerts can notify you by email, push notification, webhook, or PSA ticket — and they auto-resolve when the metric returns to normal.
Key concepts
- Monitor — a check that collects a specific metric (e.g. CPU usage, free disk space, service status). Monitors run on the agent at a configurable interval.
- Alert rule — a condition that fires an alert when a monitor value crosses a threshold (e.g. "CPU > 90 % for 5 minutes"). Rules can have severity levels: info, warning, critical.
- Alert channel — the delivery method for notifications: email, Slack, Microsoft Teams, webhook, or PSA integration.
- Monitoring policy — a collection of monitors and alert rules assigned to a group. Like other policies, monitoring policies cascade through the group hierarchy.
- Auto-resolve — when the breached metric returns to within the threshold, the alert is automatically closed and a "resolved" notification is sent.
- Maintenance mode — temporarily suppresses alerts for an endpoint or group during planned maintenance.
Step-by-step walkthrough
Review the monitoring dashboard
Go to Monitoring → Dashboard. The overview shows active alerts grouped by severity, a health map of all endpoints, and trend charts for key metrics.
Create an alert rule
Navigate to Monitoring → Alert rules → New rule. Choose a monitor type (e.g. disk free space), set the threshold (e.g. < 10 %), choose severity (warning or critical), and configure the evaluation window (e.g. "sustained for 5 minutes").
Configure alert channels
Go to Monitoring → Alert channels → New channel. Select the delivery method (email, Slack, webhook, etc.), enter the destination (email address, webhook URL), and optionally filter by severity or group.
Assign a monitoring policy
Open the target group, go to the Policy tab, and select your monitoring policy under the Monitoring section. Save. All endpoints in the group now inherit these monitors and rules.
Investigate an alert
Click any active alert to see details: the endpoint, metric value over time, when the threshold was breached, and the current status. From here you can acknowledge, snooze, or escalate the alert.
Built-in monitors
Xcellerate RMM ships with a set of pre-configured monitors you can enable out of the box:
- CPU usage — average and peak processor utilisation.
- Memory usage — total, used, and available RAM.
- Disk space — free space percentage per volume.
- Service status — whether a specific Windows service or Linux daemon is running.
- Event log — matches specific event IDs or keywords in the Windows Event Log or syslog.
- Network throughput — bytes in/out per interface.
- Endpoint online/offline — fires when an agent stops checking in for a configurable period.
Tips & best practices
- Start with a few high-impact rules (disk space, offline endpoints, critical service status) and expand as you learn your environment's baseline.
- Use the sustained for evaluation window to avoid false positives from brief spikes.
- Set different severity levels for different thresholds (e.g. warning at 15 % free disk, critical at 5 %).
- Route critical alerts to a fast channel (push notification or Slack) and info/warning to email digests.
- Enable maintenance mode before planned reboots or patching to suppress expected alerts.
- Review and tune alert rules monthly — noisy alerts train your team to ignore notifications.