Insights / Article / Managed IT services and infrastructure support
ArticleWhat good IT monitoring looks like
Monitoring should warn you before users notice a problem. That means watching the services people rely on, alerting sparingly and learning from every incident.
Ask an IT team how they found out about their last significant outage, and the honest answer is often the same: a user rang the service desk. The monitoring tools were running, dashboards were green and alerts were flowing into an inbox, yet the first sign of trouble came from someone who could not do their job.
Monitoring should warn you before users notice a problem. When it works, many issues are resolved before anyone outside IT is aware of them, and the ones that do affect users are diagnosed faster because the evidence is already there. When it does not work, it produces noise, false reassurance and a team that has learned to ignore its own alerts.
Watch what matters
Most monitoring starts with infrastructure: processor load, memory, disk space and network traffic on each server and device. These measures are necessary, but they are not sufficient. A server can look perfectly healthy while the application on it is failing, and users do not experience servers. They experience services.
Monitor the services users rely on, not just servers. Start from the business and work down.
- List the services that matter most: order entry, finance, email, the customer portal, warehouse scanning, remote access.
- For each, define what working looks like from a user’s point of view: can someone log in, search, save a record and complete a transaction in reasonable time?
- Set up checks that test those things directly, for example synthetic transactions that log in and perform a simple action every few minutes.
- Map each service to the infrastructure beneath it, so when a check fails you know which components to examine first.
- Add the infrastructure measures that commonly predict trouble, such as disks filling, certificates nearing expiry and backups failing.
Do not forget the dependencies outside your walls. Internet connections, cloud services, payment gateways and supplier integrations can all stop a business process, and they often fail in ways your internal checks will not see.
Keep the checks simple at first. A handful of well-chosen user-level checks on the most important services will tell you more than hundreds of infrastructure measures that nobody looks at. You can add depth later, once the team trusts what it sees.
Alert sensibly
Too many alerts are ignored. This is the most common failure of monitoring, and it is entirely human. When the phone buzzes forty times a day with warnings that turn out not to matter, people stop reading them. Then the one alert that does matter is lost in the noise.
Tune alerts to actionable events. An alert should mean that someone needs to do something, now or soon. Everything else belongs in a report or a dashboard.
- For every alert, ask: what would the person receiving it do? If the answer is nothing, remove it or turn it into a report.
- Use thresholds that reflect real risk, such as a disk forecast to fill within two days rather than a disk at 80 per cent.
- Group related alerts, so one network failure produces one notification, not fifty.
- Route each alert to the person or team who can act on it, with a clear escalation if it is not acknowledged.
- Separate urgent alerts, which wake someone up, from warnings that can wait until the morning.
Review alerts monthly
Once a month, look at which alerts fired, which led to action and which were ignored. Adjust or remove the noisy ones. Over a few months, the volume falls and trust in the remaining alerts rises.
An example of tuning
Consider a typical managed IT team supporting a manufacturer across three sites. Initially it receives hundreds of alerts a week, mostly brief processor spikes during overnight backups and warnings from printers. After two monthly reviews, the team suppresses alerts during known backup windows, moves printer warnings to a weekly report and adds a synthetic check on the production scheduling system. Alert volume falls sharply, and the next time the scheduling system slows down, the team knows within minutes rather than hearing from the shop floor an hour later.
Learn from incidents
Monitoring tells you that something has gone wrong. Learning from it stops the same thing going wrong again. Review causes and fix repeat problems permanently.
- After any significant incident, hold a short review: what happened, how it was detected, how long it took to restore and what caused it.
- Focus on causes and conditions, not on blaming individuals; people share more when reviews feel safe.
- Ask whether monitoring could have warned earlier, and add the check if so.
- Track recurring incidents and assign an owner to fix the underlying cause, with a target date.
- Report repeat problems and their status in the monthly service review.
Over time, this habit changes the character of IT support. Instead of resolving the same disk-space alert every few weeks, the team adds storage or fixes the log that fills it. Instead of restarting the same service every Monday, they find out why it fails. Each permanent fix frees time for the next one.
How to tell if your monitoring is working
A few simple questions give a clear picture. What proportion of significant incidents were detected by monitoring before a user reported them? How many alerts fire each week, and how many lead to action? How long does it take to identify the cause once an incident starts? Are the same problems recurring month after month?
It helps to track these measures over time rather than once. A simple monthly note of how many incidents monitoring caught first, alongside the alert count, shows whether the changes you make are working. Share it in the service review, so the business sees monitoring as something that protects their work rather than an IT concern.
If users are still the main source of warnings, or alerts are routinely ignored, the monitoring needs attention, however sophisticated the tools may be.
Where to start
Pick your three most important business services and set up a user-level check for each. Then spend an hour reviewing last month’s alerts and remove the ones nobody acted on. Those two steps alone usually make monitoring quieter and more useful within a few weeks.
Source: Intelliversal analysis.
