Where to find it: in the Hub (your MSP workspace at app.theonestack.com), open RMM, then use the RMM sidebar or page links below:
- RMM → Global → Alert Triage: app.theonestack.com/rmm/alerts
- RMM → Policies → Monitoring Rules: app.theonestack.com/rmm/policies/monitoring
Overview
Monitoring Alerts let technicians define thresholds for device health metrics and receive notifications when those thresholds are crossed. You can monitor CPU, RAM, disk, and running services, and route alerts to the right person or ticketing system.
How Alerts Work
After each agent heartbeat, the system evaluates your alert rules against the incoming CPU, RAM, disk, network, and process values. If a value crosses a threshold, an alert is created. Two kinds of rules exist: built-in threshold monitors (pre-configured for common conditions like high CPU or low disk) and custom alert rules (rules you create for specific conditions).
Setting Up a Monitor
- Go to Alerts and click Alert Rules.
- Click New Rule.
- Choose the metric to watch: CPU percent, RAM percent, disk free percent, a specific Windows service, or another supported condition.
- Set the threshold — for example, "CPU above 90%" or "disk free below 10%".
- Set the duration — how long the condition must persist before the alert fires (for example, "sustained for 5 minutes" avoids false positives from brief spikes).
- Choose the devices or groups this rule applies to.
- Set the severity: Critical, High, Medium, or Low.
- Configure notification routing — choose which channels receive the alert (email, SMS, PSA ticketing).
- Save the rule.
Alert Templates
If you want to apply the same set of rules to many clients, create an Alert Template and assign it to clients or device groups. Changes to the template propagate to all assignments.
Acknowledging and Resolving Alerts
When an alert fires, it appears on the Alerts page and on the device detail.
- Click Acknowledge to mark that you have seen the alert and are working on it. This stops repeat notifications.
- Click Resolve when the issue is fixed. Resolved alerts are archived but not deleted.
Suppressing Alerts During Maintenance
If you have planned downtime, use a Maintenance Window to suppress alerts for the affected devices rather than deleting rules. See Maintenance Windows.
Alert Tuning
If a rule is generating too many alerts, go to Alert Tuning. The system highlights high-volume rules and suggests adjusted thresholds or suppression settings. Apply the suggestion or edit the rule directly.
Frequently Asked Questions
I set a rule but no alerts are firing even though the metric is high.
Check that the rule is enabled and scoped to the correct devices. If you set a duration requirement, the condition must persist for that full duration. Also confirm the device is online and heartbeating.
Can I route Critical alerts to a different person than Low alerts?
Yes. Each alert rule has its own notification routing. Set Critical rules to notify your on-call engineer and Low rules to create a low-priority ticket.
How do I monitor whether a specific Windows service is running?
Create a custom alert rule and choose "Service stopped" as the condition. Enter the exact service name as it appears in Windows Services.
What happens if the same condition fires twice before I acknowledge the first alert?
The system deduplicates — a second alert for the same device and condition does not create a second record while the first is still open.