What Groundskeeper Watches

This page is also in the Groundskeeper wiki: https://github.com/rsjsoftwareltd/groundskeeper/wiki/What-Groundskeeper-Watches

Most alerts come from a connector, and every threshold a connector uses is a setting on its card under Connector Settings. This page lists them all, with the default each install starts on and the rule behind it, in the same words the Settings page uses.

Checks on machines running the RSJ Agent (BitLocker, Defender, pending restarts, disk space and more) are not listed here. Turn them on or off, and set their thresholds, under Agent Settings -> Monitoring policy.

Two things to know before reading it:

Silence means healthy. Groundskeeper reports problems, and says when one clears. A connector with nothing to say found nothing wrong. A connector that has stopped polling is shown as Not polling on the dashboard and Not checked recently on the SLT view, so you can tell it apart from a healthy one.
A rule that says "two consecutive polls" is deliberate. A server that spikes for one poll is not a problem; one that stays there is. Where a setting carries that qualifier, a single reading never raises anything.

Settings that are not numbers -- which servers to watch, which services, credentials -- are not listed here; they choose what is watched rather than when it speaks.

Connectors #

Action1
Active Directory
AD Account Health
Adobe - Licence Usage
Aruba Central (beta)
Cisco Meraki
Dell iDRAC
Devices Left On Overnight
DNS & DHCP
Domain Security
Endpoint Reports
Exam Marking Software
FortiGate (beta)
HPE iLO (beta)
Hyper-V
Internet Health
M365 - Licence Usage
M365 - Service Health
MIS Status
Ping checks
Printers / MFDs
Public SharePoint sites (beta)
School Services
SSL Certificates
Switches (SNMP)
Synology NAS (beta)
UPS
Veeam
WatchGuard Endpoint
WatchGuard Firebox
Windows Clients
Windows Event Log
Windows Servers

Action1 #

Endpoint patch status, missing updates, device inventory

	Setting	Default	The rule
How often	Poll interval (minutes)	60	60 minutes recommended.

Active Directory #

AD replication, FSMO roles, SYSVOL, sensitive group membership changes

	Setting	Default	The rule
How often	Poll interval (minutes)	60	60 minutes recommended.

AD Account Health #

Service account password expiry and stale user accounts -- flags what SIMS sync failures are made of

	Setting	Default	The rule
Threshold	Service account warn window (days)	30	Warn when a service account password expires within this many days. Critical at 7 days.
Threshold	Stale user threshold (days)	90	Flag enabled user accounts with no logon in this many days.
Threshold	Stale user alert count	10	Fire a warning when the number of stale accounts exceeds this count.
Threshold	Scan timeout (seconds)	300	How long the AD account scan may run before it is abandoned. Raise it on a large directory; a scan that times out reports an error rather than partial results.
How often	Poll interval (minutes)	1440	1440 = once per day.

Adobe - Licence Usage #

Creative Cloud / Document Cloud product profile seat consumption -- warns when a profile approaches or exceeds its purchased quota

	Setting	Default	The rule
Threshold	Warning threshold (%)	90	Warn when consumed seats reach this percentage of the configured quota. Default 90%.
Threshold	Reclaim: dormant threshold (days)	90	Flag an enabled AD account with a seat as a reclaim candidate if it hasn't logged on in this many days.
How often	Poll interval (minutes)	1440	1440 = once per day. Adobe's UMAPI rate limits are tight (a few requests per minute) -- daily polling is recommended, not more frequent.

Aruba Central (beta) #

Access point, switch and gateway health via Aruba Central's classic API Gateway. Beta: built from Aruba's API documentation and not yet tested against a live Aruba Central account -- tell us how it goes.

	Setting	Default	The rule
How often	Poll interval (minutes)	5	How often to check device status. 5 minutes recommended.

Cisco Meraki #

Wi-Fi AP health, switch status, MT sensors

	Setting	Default	The rule
Threshold	Sensor battery warning (%)	20	Warn when a Meraki environmental sensor's battery falls below this percentage.
Threshold	Length of an automatic upgrade window (minutes)	45	How long after the scheduled start a device is excused. An access point upgrades in 10-20 minutes; a switch stack takes longer. If a device is still down after this (plus the grace under Settings -> School -> Maintenance Windows), one real alert fires.
How often	Poll interval (minutes)	5	How often to check device status. 5 minutes recommended.

Dell iDRAC #

Server hardware health via iDRAC Redfish API -- CPU, memory, storage, PSUs

	Setting	Default	The rule
How often	Poll interval (minutes)	10	10 minutes recommended.

Devices Left On Overnight #

Flags client machines running for 14+ hours -- energy saving and security hygiene

	Setting	Default	The rule
Threshold	Overnight threshold (hours)	14	Flag devices running longer than this many hours. At 8am, 14h = machine running since 6pm yesterday.
Threshold	Skip inactive AD computers (days)	30	Skip computers with no AD logon in this many days.
Threshold	WMI timeout per machine (seconds)	5	Seconds to wait for each machine to respond via WMI. Machines that have not answered within four times this (minimum 20s) are counted as offline and the scan moves on -- otherwise one unreachable machine can hold up the whole run.
Threshold	Maximum machines per scan	2000	Safety cap on how many machines one scan will check. If your domain has more eligible machines than this, the shortfall is reported in the feed -- results are never presented as covering the whole estate when they do not. Narrowing the AD search base above to a single school's OU is usually better than raising this.
Threshold	Scan time limit (seconds)	1800	Total time the scan may take. It stops collecting shortly before this and reports what it managed, along with how many machines it did not reach -- a partial answer that says how partial it is, rather than nothing at all.
How often	Check window start (hour, 24h)	6	Only scan between these hours (24h local time). Outside this window polls are skipped silently.
How often	Check window end (hour, 24h)	10	End of morning check window (exclusive). Default: scan runs 06:00-10:00.
How often	Poll interval (minutes)	240	240 = every 4 hours. The actual scan only fires during the morning check window.

DNS & DHCP #

DHCP scope utilisation alerts and DNS resolution health checks

	Setting	Default	The rule
Threshold	Scope warning threshold (% used)	80	Warn when a DHCP scope is more than this % full.
Threshold	Scope critical threshold (% used)	95	Critical when a DHCP scope is more than this % full.
Threshold	Filling-fast warning window (minutes)	60	Warn when, at the rate seen recently, the free addresses would run out within this many minutes. Raise it to be warned earlier, lower it for fewer warnings.
Threshold	Fill-rate measured over (minutes)	60	How far back to measure the fill rate. Shorter reacts faster but is noisier; readings less than 20 minutes apart are ignored as too short to measure honestly.
Threshold	Connection timeout (seconds)	15	Seconds before treating the DHCP server as unreachable.
How often	Poll interval (minutes)	15	15 minutes recommended.

Domain Security #

SPF, DMARC, DKIM, TLS certs -- replaces NCSC Mail Check

	Setting	Default	The rule
How often	Poll interval (minutes)	1440	1440 = once per day.

Endpoint Reports #

Disk space and Windows 11 readiness scans via PowerShell

	Setting	Default	The rule
How often	Poll interval (minutes)	1440	1440 = once per day.

Exam Marking Software #

Detects teacher-side exam marking software on domain endpoints -- forewarns IT of exam season support demand

	Setting	Default	The rule
Threshold	Skip inactive AD computers (days)	30	Skip endpoints with no AD logon in this many days.
Threshold	Per-machine timeout (seconds)	10	How long to wait for each machine to answer before treating it as unreachable.
Threshold	Scan timeout (seconds)	3600	Overall budget for the whole estate scan (3600 = one hour). Raise it on a large estate; a scan that times out reports an error rather than partial results.
How often	Poll interval (minutes)	10080	10080 = once per week (recommended).

FortiGate (beta) #

Fortinet FortiGate firewalls: a unit offline, CPU and memory, and FortiGuard / FortiCare subscriptions running out -- read-only, over the FortiOS REST API. Beta: built from the API's documented replies, not yet run against a school's own units.

	Setting	Default	The rule
Threshold	Warn before a subscription expires (days)	30	Each FortiGuard and FortiCare subscription is warned about this many days before it expires, and again if it lapses.
Threshold	CPU warning (%)	90	Warn when a unit's CPU is at or above this on two polls running.
Threshold	Memory warning (%)	90	Warn when a unit's memory is at or above this on two polls running.
How often	Poll interval (minutes)	10	How often each FortiGate is read.

HPE iLO (beta) #

HPE ProLiant server hardware health through each server's iLO: failed or predicted-to-fail disk drives, degraded RAID volumes, fans, power supplies, temperatures, memory and processors, plus the firmware list on the Devices page -- read-only, over Redfish (iLO 4 firmware 2.30 or later, and iLO 5). Beta: built from HPE's documented replies, not yet run against a school's own servers.

	Setting	Default	The rule
How often	Poll interval (minutes)	10	How often each iLO is read. 10 minutes recommended.

Hyper-V #

VM state monitoring, replication health, VM count changes on Hyper-V hosts -- plus failover cluster node/storage checks when a cluster name is set

	Setting	Default	The rule
Threshold	Cluster storage warning (% free)	10	Warn when a Cluster Shared Volume drops below this percentage free. Only used when a cluster name is set.
Threshold	Connection timeout (seconds)	15	Seconds before treating a host as unreachable.
How often	Poll interval (minutes)	5	5 minutes recommended.

Internet Health #

Outbound connectivity checks via HTTPS on port 443

	Setting	Default	The rule
Threshold	Timeout (seconds)	10	Alert if any endpoint takes longer than this.
How often	Poll interval (minutes)	5	5 minutes recommended.

M365 - Licence Usage #

Licence seat consumption -- warns when approaching or over purchased limit

	Setting	Default	The rule
Threshold	Warning threshold (%)	95	Warn when consumed seats reach this percentage of purchased seats. Default 95%.
How often	Poll interval (minutes)	60	60 minutes recommended.

M365 - Service Health #

M365 service incidents and advisories via Microsoft Graph

	Setting	Default	The rule
How often	Poll interval (minutes)	15	15 minutes recommended.

MIS Status #

Live status for Arbor (SIMS, Bromcom and SEEMiS have no readable public status page)

	Setting	Default	The rule
How often	Poll interval (minutes)	10	10 minutes recommended.

Ping checks #

Pings devices on your network -- door controllers, cameras, switches -- and alerts when one stops answering

	Setting	Default	The rule
How often	Poll interval (minutes)	5	How often to ping each device. Each check sends 3 pings.

Printers / MFDs #

Toner/ink levels, paper trays and error state for network printers via SNMP v2c

	Setting	Default	The rule
Threshold	Toner/ink warning threshold (%)	20	Warn when toner or ink drops below this percentage.
Threshold	Toner/ink critical threshold (%)	10	Critical alert when toner or ink drops below this percentage.
How often	Poll interval (minutes)	60	60 minutes recommended -- toner levels change slowly.

Public SharePoint sites (beta) #

Flags Teams / Microsoft 365 groups (and their SharePoint sites) shared PUBLIC, via Microsoft Graph -- read-only, it never changes sharing. Beta: verified against the Graph docs, not yet against a live tenant.

	Setting	Default	The rule
How often	Poll interval (minutes)	1440	A group's public/private status is slow-moving; daily (1440) is plenty.

School Services #

Uptime checks for common school cloud services: ParentPay, Wonde, RM Unify, Arbor and more

	Setting	Default	The rule
Threshold	Timeout (seconds)	15	Treat a service as down if it doesn't respond within this many seconds.
How often	Poll interval (minutes)	10	How often to check each service.

SSL Certificates #

TLS certificate expiry monitoring -- alerts before certs expire

	Setting	Default	The rule
Threshold	Warn when expiring within (days)	30	Create a warning event when a certificate expires within this many days.
Threshold	Critical when expiring within (days)	7	Escalate to critical when a certificate expires within this many days.
How often	Poll interval (minutes)	1440	1440 = once per day.

Switches (SNMP) #

Port status, uplink vs device-port classification, interface errors and uptime for any managed switch via SNMP v2c -- tested on HP ProCurve and Aruba

	Setting	Default	The rule
Threshold	Interface error threshold (per poll)	100	Warn when an interface accumulates more than this many errors between polls.
Threshold	Alert unreachable after (consecutive failed polls)	2	How many polls in a row a switch must fail to answer SNMP before it is alerted as unreachable. SNMP runs over UDP, so a single lost packet is normal -- each poll already retries before it counts as a failure, and this waits for that many failed polls (2 recommended) so one blip never emails you. Set to 1 to alert on the first failed poll.
How often	Poll interval (minutes)	5	5 minutes recommended.

Synology NAS (beta) #

Synology NAS units: a storage pool or volume degraded or filling, a disk with a health warning, a DSM update waiting, and whether Hyper Backup and Active Backup for Business last worked -- read-only, over DSM's web API. Beta: built from documented and open-source reply shapes, not yet run against a school's own units.

	Setting	Default	The rule
Threshold	Warn when a backup has not succeeded for (days)	2	Each Hyper Backup and Active Backup for Business task is warned about if its last run failed, or if it has not succeeded in this many days.
Threshold	Volume full warning (%)	85	Warn when a volume is at or above this full.
How often	Poll interval (minutes)	15	How often each NAS is read.

UPS #

Battery capacity, runtime, load and on-battery detection for APC and Eaton UPS units via SNMP v2c

	Setting	Default	The rule
Threshold	Battery warning threshold (%)	40	Warn when battery capacity falls below this percentage.
Threshold	Battery critical threshold (%)	20	Critical alert when battery capacity falls below this percentage.
Threshold	Runtime warning threshold (minutes)	10	Warn when estimated battery runtime falls below this many minutes.
Threshold	Load warning threshold (%)	80	Warn when UPS output load exceeds this percentage of capacity.
Threshold	Alert unreachable after (consecutive failed polls)	2	How many polls in a row a UPS must fail to answer SNMP before it is alerted as unreachable. SNMP runs over UDP, so a single lost packet is normal -- each poll already retries, and this waits for that many failed polls (2 recommended) so one blip never emails you. Set to 1 to alert on the first failed poll.
How often	Poll interval (minutes)	5	5 minutes recommended.

Veeam #

Backup job status, failures, warnings -- supports Veeam B&R 12 and 13

	Setting	Default	The rule
How often	Poll interval (minutes)	30	30 minutes recommended.

WatchGuard Endpoint #

AV/EDR coverage, unprotected endpoints, and security event activity

	Setting	Default	The rule
Threshold	Coverage warning threshold (%)	95	Warn when AV coverage drops below this percentage of enrolled endpoints. Above this, a few unprotected machines (rebuilds, new starters) are not reported -- set it higher, e.g. 99, if you want tighter cover.
Threshold	Coverage critical threshold (%)	80	Raise a CRITICAL alert when coverage drops below this percentage -- a systemic failure such as the agent having stopped deploying, rather than a few machines.
Threshold	Warn when an endpoint has not connected for (days)	30	Warn when endpoints listed in WatchGuard have not contacted it for this many days: retired computers still listed, or machines that are off or broken. Set to 0 to switch this off.
How often	Poll interval (minutes)	60	60 minutes recommended.

WatchGuard Firebox #

Firewall reachability and BOVPN tunnel status via SNMPv3

	Setting	Default	The rule
Threshold	SNMP port	161	SNMP UDP port. Default is 161.
Threshold	SNMP timeout (seconds)	5	Seconds to wait for an SNMP response before treating the Firebox as unreachable.
How often	Poll interval (minutes)	5	5 minutes recommended.

Windows Clients #

Endpoint health for Windows 10/11 PCs -- BitLocker, pending reboots, AV, updates, disk

	Setting	Default	The rule
Threshold	Skip inactive AD computers (days)	30	Skip endpoints with no AD logon in this many days.
Threshold	Warn if pending reboot older than (days)	7	Critical alert when a pending reboot has been outstanding for this many days (KCSIE compliance).
Threshold	Warn if no update installed in (days)	30	Warn when no Windows Update has been installed in this many days.
Threshold	Disk warning threshold -- C: (% used)	90	Warn when C: is more than this percentage full.
Threshold	Scan timeout (seconds)	1800	Overall budget for the domain-wide client scan (1800 = 30 minutes). Raise it on a large estate -- on roughly 2000 clients the default can be tight.
How often	Poll interval (minutes)	1440	1440 = once per day.

Windows Event Log #

Security events: account lockouts, failed logons, group changes

	Setting	Default	The rule
Threshold	Lookback window (minutes)	60	How far back each poll looks. Should match poll interval.
Threshold	Failed logon burst threshold	10	Warn if a single account exceeds this many failed logons in the lookback window.
How often	Poll interval (minutes)	60	60 minutes recommended.

Windows Servers #

CPU, RAM, disk, services and uptime for Windows Server infrastructure

	Setting	Default	The rule
Threshold	Skip inactive AD computers (days)	90	Skip computers with no AD logon in this many days. Set to 0 to include all.
Threshold	CPU warning threshold (%)	85	Alert if CPU stays above this % for two consecutive polls.
Threshold	RAM warning threshold (%)	90	Alert if RAM stays above this % for two consecutive polls, so a one-off burst is not reported. The warning clears once RAM is five points below this line, so a server hovering at it is one warning, not a new one every hour. CPU clears the same way.
Threshold	Alert unreachable after (consecutive failed polls)	2	A server must miss this many polls in a row before it is reported unreachable. 2 (the default, ten minutes at the usual interval) lets a reboot for Windows Update pass in silence -- the Devices page still shows it as unreachable meanwhile. Set 1 to be told on the first missed poll.
Threshold	Disk warning threshold (% used)	90	Warn when any fixed drive is more than this % full.
Threshold	Disk critical threshold (% used)	95	Critical alert when any fixed drive is more than this % full.
How often	Automatic re-discovery schedule	Daily	How often Groundskeeper automatically re-queries AD for new or removed servers.
How often	Poll interval (minutes)	5	5 minutes recommended for servers.

Last updated: 2026-10-21 (v0.193.1)