Looking for the Right IT Solution for Your Business?
Let's discuss your requirements and design a solution that supports your business operations and future growth.
A server can be up and running while something is still going wrong.
A server is running, the monitoring dashboard is green and no alerts have been triggered. Yet users are reporting slow applications, the database is responding with delays and the overnight backup has repeatedly failed to complete. System availability and correct operation are two different things, and monitoring that only checks availability will miss these situations.
Effective monitoring also tracks performance, capacity, deviations from normal behaviour and how these develop over time. This can often reveal problems before they lead to outages or significantly disrupt services.
The scope depends on the architecture of the environment and the importance of individual services. However, the following areas should be covered in most organisations.
CPU usage, memory consumption and disk space are among the basic monitoring metrics, but individual values can be misleading.
A disk that is 70% full and has remained at that level for several months may not represent an immediate problem. But if disk usage has increased from 50% to 70% over the past two hours, capacity could be exhausted in approximately three more hours if the same rate continues.
Alongside fixed thresholds, it is therefore worth monitoring the rate of change and unusual system behaviour.
In a virtualised environment, monitoring individual virtual machines (VMs) is not enough. An overloaded physical host, insufficient memory or slow disk input/output (I/O) operations can affect multiple VMs simultaneously.
Monitoring should therefore also cover the virtualisation layer, storage and shared resources.
Historical monitoring data is valuable for capacity planning. It helps estimate when existing infrastructure may reach its limits and when additional capacity will be required.
A network does not need to become completely unavailable to cause problems. Higher latency, packet loss, overloaded network devices or an unstable VPN connection can slow applications to the point where they become difficult to use.
Network monitoring data also helps identify where to investigate the cause: on the server, within the application or in the communication between them.
A running operating system does not necessarily mean that an application is working correctly.
For critical services, it is worth monitoring response times, database connections, query execution times and request queues. The specific metrics depend on the technologies in use.
This is closely related to observability: the ability to understand what is happening inside a system by examining its operational data.
In addition to metrics and logs, more complex applications can benefit from distributed tracing, which tracks the journey of individual requests across multiple services.
When an application is slow, you need to understand the cause, not simply record that its response time has increased.
A message confirming that a backup job completed successfully is not sufficient on its own.
Depending on the backup technology, it is also useful to monitor job duration, whether backups exceed the scheduled backup window and the age of the most recent usable recovery point.
Two important parameters are relevant here:
Monitoring alone cannot verify whether data can actually be restored within the required timeframe. Regular recovery testing is necessary for that.
An expired TLS certificate can prevent users from accessing a service even when the server and application are operating correctly.
Automated alerts for approaching certificate expiry dates are a simple but highly useful preventive measure.
Depending on the environment, similar checks can be applied to other components whose expiry could affect operations.
These areas partly use the same data, but they focus on different types of problems.
Operational monitoring tracks infrastructure availability, performance, capacity and behaviour. It uses metrics, operational events and, where appropriate, system or application logs.
Security monitoring focuses on identifying potential threats. It examines login events, changes to critical files, suspicious activities and information about known vulnerabilities.
Within Platform ONE, we use Zabbix and Wazuh for these purposes.
Zabbix provides operational monitoring of servers, networks, virtualisation and other infrastructure components.
Wazuh adds a security perspective through SIEM and XDR capabilities, including security event analysis, file integrity monitoring and identification of known vulnerabilities.
The two technologies complement each other, providing information for different aspects of IT operations and security.
Modern monitoring tools can track a large number of parameters, but nobody needs an alert for every minor fluctuation.
If a system generates dozens of irrelevant alerts every day, a critical warning can easily be overlooked.
Three questions are particularly important when configuring monitoring.
Not all systems have the same level of criticality.
An outage affecting an internal test server will generally have less impact than an unavailable production database or a critical customer-facing application.
Not every service therefore needs the same monitoring coverage or response requirements.
Thresholds should reflect the actual behaviour of the system.
A brief spike in resource usage may not indicate an incident, while gradually deteriorating response times could signal an emerging problem.
Effective monitoring therefore considers operational context, historical behaviour and the importance of the individual service.
It must be clear who receives an alert, who assesses its severity and how any necessary escalation takes place.
Without a defined follow-up process, monitoring can identify a problem, but resolving it still depends on people and procedures that must be established in advance.
Automated monitoring can continuously observe infrastructure, including overnight, at weekends and on public holidays.
However, that does not mean every alert is immediately reviewed by a technician.
Automated monitoring, the availability of human support, response times and the actual resolution of an issue are separate elements of a service. Their scope and conditions are defined in the agreed service level agreement (SLA).
When choosing a provider, it is therefore important to ask not only what is monitored, but also what happens after an alert is triggered.
Platform ONE by Zeta Nova brings together IT infrastructure, operational monitoring, security monitoring and related services.
It is based on a defined mandatory core configuration that can be extended with additional services and applications according to customer requirements and the proposed technical architecture.
For example, if monitoring detects a gradual increase in disk utilisation, Zabbix can generate an alert based on configured rules before the disk reaches full capacity.
What happens next depends on the environment's configuration and the agreed scope of infrastructure management.
An important part of the overall solution is therefore not only the technology itself, but also clearly defined responsibilities and operational support arrangements.
If you are reviewing server monitoring, virtualisation monitoring or monitoring across your entire IT environment, we can help assess your existing infrastructure and explore suitable operational monitoring options.
Learn more about our IT Infrastructure Monitoring services, or contact us at info@zetanova.tech.
Let's discuss your requirements and design a solution that supports your business operations and future growth.
