Skip to content

What Groundskeeper Watches

Jump to bottom
github-actions[bot] edited this page Sep 21, 2026 · 5 revisions

What Groundskeeper Watches

Every alert Groundskeeper raises comes from one connector, and every threshold a school can change is a setting on that connector's card under Connector Settings. This page lists them all, with the default each install starts on and the rule behind it, in the same words the Settings page uses.

Two things to know before reading it:

  • Silence means healthy. Groundskeeper only reports problems, so a connector that has nothing to say is a connector that found nothing wrong.
  • A rule that says "two consecutive polls" is deliberate. A server that spikes for one poll is not a problem; one that stays there is. Where a setting carries that qualifier, a single reading never raises anything.

Settings that are not numbers -- which servers to watch, which services, credentials -- are not listed here; they choose what is watched rather than when it speaks.

Connectors

Action1

Endpoint patch status, missing updates, device inventory

Setting Default The rule
How often Poll interval (minutes) 60 60 minutes recommended.

Active Directory

AD replication, FSMO roles, SYSVOL, sensitive group membership changes

Setting Default The rule
How often Poll interval (minutes) 60 60 minutes recommended.

AD Account Health

Service account password expiry and stale user accounts -- flags what SIMS sync failures are made of

Setting Default The rule
Threshold Service account warn window (days) 30 Warn when a service account password expires within this many days. Critical at 7 days.
Threshold Stale user threshold (days) 90 Flag enabled user accounts with no logon in this many days.
Threshold Stale user alert count 10 Fire a warning when the number of stale accounts exceeds this count.
Threshold Scan timeout (seconds) 300 How long the AD account scan may run before it is abandoned. Raise it on a large directory; a scan that times out reports an error rather than partial results.
How often Poll interval (minutes) 1440 1440 = once per day.

Adobe - Licence Usage

Creative Cloud / Document Cloud product profile seat consumption -- warns when a profile approaches or exceeds its purchased quota

Setting Default The rule
Threshold Warning threshold (%) 90 Warn when consumed seats reach this percentage of the configured quota. Default 90%.
Threshold Reclaim: dormant threshold (days) 90 Flag an enabled AD account with a seat as a reclaim candidate if it hasn't logged on in this many days.
How often Poll interval (minutes) 1440 1440 = once per day. Adobe's UMAPI rate limits are tight (a few requests per minute) -- daily polling is recommended, not more frequent.

Aruba Central

Access point, switch and gateway health via Aruba Central's classic API Gateway (exploratory -- see specs/ARUBA_CENTRAL_CONNECTOR.md; no Aruba tenant has been used to verify the exact API shape)

Setting Default The rule
How often Poll interval (minutes) 5 How often to check device status. 5 minutes recommended.

Cisco Meraki

Wi-Fi AP health, switch status, MT sensors

Setting Default The rule
Threshold Sensor battery warning (%) 20 Warn when a Meraki environmental sensor's battery falls below this percentage.
Threshold Length of an automatic upgrade window (minutes) 45 How long after the scheduled start a device is excused. An access point upgrades in 10-20 minutes; a switch stack takes longer. If a device is still down after this (plus the grace under Settings -> School -> Maintenance Windows), one real alert fires.
How often Poll interval (minutes) 5 How often to check device status. 5 minutes recommended.

Dell iDRAC

Server hardware health via iDRAC Redfish API -- CPU, memory, storage, PSUs

Setting Default The rule
How often Poll interval (minutes) 10 10 minutes recommended.

Devices Left On Overnight

Flags client machines running for 14+ hours -- energy saving and security hygiene

Setting Default The rule
Threshold Skip inactive AD computers (days) 30 Skip computers with no AD logon in this many days.
Threshold WMI timeout per machine (seconds) 5 Seconds to wait for each machine to respond via WMI. Machines that have not answered within four times this (minimum 20s) are counted as offline and the scan moves on -- otherwise one unreachable machine can hold up the whole run.
Threshold Maximum machines per scan 2000 Safety cap on how many machines one scan will check. If your domain has more eligible machines than this, the shortfall is reported in the feed -- results are never presented as covering the whole estate when they do not. Narrowing the AD search base above to a single school's OU is usually better than raising this.
Threshold Scan time limit (seconds) 1800 Total time the scan may take. It stops collecting shortly before this and reports what it managed, along with how many machines it did not reach -- a partial answer that says how partial it is, rather than nothing at all.
How often Overnight threshold (hours) 14 Flag devices running longer than this many hours. At 8am, 14h = machine running since 6pm yesterday.
How often Check window start (hour, 24h) 6 Only scan between these hours (24h local time). Outside this window polls are skipped silently.
How often Check window end (hour, 24h) 10 End of morning check window (exclusive). Default: scan runs 06:00-10:00.
How often Poll interval (minutes) 240 240 = every 4 hours. The actual scan only fires during the morning check window.

DNS & DHCP

DHCP scope utilisation alerts and DNS resolution health checks

Setting Default The rule
Threshold Scope warning threshold (% used) 80 Warn when a DHCP scope is more than this % full.
Threshold Scope critical threshold (% used) 95 Critical when a DHCP scope is more than this % full.
Threshold Filling-fast warning window (minutes) 60 Warn when, at the rate seen recently, the free addresses would run out within this many minutes. Raise it to be warned earlier, lower it for fewer warnings.
Threshold Fill-rate measured over (minutes) 60 How far back to measure the fill rate. Shorter reacts faster but is noisier; readings less than 20 minutes apart are ignored as too short to measure honestly.
Threshold Connection timeout (seconds) 15 Seconds before treating the DHCP server as unreachable.
How often Poll interval (minutes) 15 15 minutes recommended.

Domain Security

SPF, DMARC, DKIM, TLS certs -- replaces NCSC Mail Check

Setting Default The rule
How often Poll interval (minutes) 1440 1440 = once per day.

Endpoint Reports

Disk space and Windows 11 readiness scans via PowerShell

Setting Default The rule
How often Poll interval (minutes) 1440 1440 = once per day.

Exam Marking Software

Detects teacher-side exam marking software on domain endpoints -- forewarns IT of exam season support demand

Setting Default The rule
Threshold Skip inactive AD computers (days) 30 Skip endpoints with no AD logon in this many days.
Threshold Per-machine timeout (seconds) 10 How long to wait for each machine to answer before treating it as unreachable.
Threshold Scan timeout (seconds) 3600 Overall budget for the whole estate scan (3600 = one hour). Raise it on a large estate; a scan that times out reports an error rather than partial results.
How often Poll interval (minutes) 10080 10080 = once per week (recommended).

Hyper-V

VM state monitoring, replication health, VM count changes on Hyper-V hosts -- plus failover cluster node/storage checks when a cluster name is set

Setting Default The rule
Threshold Cluster storage warning (% free) 10 Warn when a Cluster Shared Volume drops below this percentage free. Only used when a cluster name is set.
Threshold Connection timeout (seconds) 15 Seconds before treating a host as unreachable.
How often Poll interval (minutes) 5 5 minutes recommended.

Internet Health

Outbound connectivity checks via HTTPS on port 443

Setting Default The rule
Threshold Timeout (seconds) 10 Alert if any endpoint takes longer than this.
How often Poll interval (minutes) 5 5 minutes recommended.

M365 - Licence Usage

Licence seat consumption -- warns when approaching or over purchased limit

Setting Default The rule
Threshold Warning threshold (%) 95 Warn when consumed seats reach this percentage of purchased seats. Default 95%.
How often Poll interval (minutes) 60 60 minutes recommended.

M365 - Service Health

M365 service incidents and advisories via Microsoft Graph

Setting Default The rule
How often Poll interval (minutes) 15 15 minutes recommended.

MIS Status

Live status for Arbor (SIMS, Bromcom and SEEMiS have no readable public status page)

Setting Default The rule
How often Poll interval (minutes) 10 10 minutes recommended.

Printers / MFDs

Toner/ink levels, paper trays and error state for network printers via SNMP v2c

Setting Default The rule
Threshold Toner/ink warning threshold (%) 20 Warn when toner or ink drops below this percentage.
Threshold Toner/ink critical threshold (%) 10 Critical alert when toner or ink drops below this percentage.
How often Poll interval (minutes) 60 60 minutes recommended -- toner levels change slowly.

Public SharePoint sites

Flags Teams / Microsoft 365 groups (and their SharePoint sites) shared PUBLIC, via Microsoft Graph -- read-only, it never changes sharing. Exploratory: verified against the Graph docs, not yet against a live tenant.

Setting Default The rule
How often Poll interval (minutes) 1440 A group's public/private status is slow-moving; daily (1440) is plenty.

School Services

Uptime checks for common school cloud services: ParentPay, Wonde, RM Unify, Arbor and more

Setting Default The rule
Threshold Timeout (seconds) 15 Treat a service as down if it doesn't respond within this many seconds.
How often Poll interval (minutes) 10 How often to check each service.

SSL Certificates

TLS certificate expiry monitoring -- alerts before certs expire

Setting Default The rule
Threshold Warn when expiring within (days) 30 Create a warning event when a certificate expires within this many days.
Threshold Critical when expiring within (days) 7 Escalate to critical when a certificate expires within this many days.
How often Poll interval (minutes) 1440 1440 = once per day.

Switches (SNMP)

Port status, uplink vs device-port classification, interface errors and uptime for any managed switch via SNMP v2c -- tested on HP ProCurve and Aruba

Setting Default The rule
Threshold Interface error threshold (per poll) 100 Warn when an interface accumulates more than this many errors between polls.
Threshold Alert unreachable after (consecutive failed polls) 2 How many polls in a row a switch must fail to answer SNMP before it is alerted as unreachable. SNMP runs over UDP, so a single lost packet is normal -- each poll already retries before it counts as a failure, and this waits for that many failed polls (2 recommended) so one blip never emails you. Set to 1 to alert on the first failed poll.
How often Poll interval (minutes) 5 5 minutes recommended.

UPS

Battery capacity, runtime, load and on-battery detection for APC and Eaton UPS units via SNMP v2c

Setting Default The rule
Threshold Battery warning threshold (%) 40 Warn when battery capacity falls below this percentage.
Threshold Battery critical threshold (%) 20 Critical alert when battery capacity falls below this percentage.
Threshold Runtime warning threshold (minutes) 10 Warn when estimated battery runtime falls below this many minutes.
Threshold Load warning threshold (%) 80 Warn when UPS output load exceeds this percentage of capacity.
Threshold Alert unreachable after (consecutive failed polls) 2 How many polls in a row a UPS must fail to answer SNMP before it is alerted as unreachable. SNMP runs over UDP, so a single lost packet is normal -- each poll already retries, and this waits for that many failed polls (2 recommended) so one blip never emails you. Set to 1 to alert on the first failed poll.
How often Poll interval (minutes) 5 5 minutes recommended.

Veeam

Backup job status, failures, warnings -- supports Veeam B&R 12 and 13

Setting Default The rule
How often Poll interval (minutes) 30 30 minutes recommended.

WatchGuard Endpoint

AV/EDR coverage, unprotected endpoints, and security event activity

Setting Default The rule
Threshold Coverage warning threshold (%) 95 Warn when AV coverage drops below this percentage of enrolled endpoints. Above this, a few unprotected machines (rebuilds, new starters) are not reported -- set it higher, e.g. 99, if you want tighter cover.
Threshold Coverage critical threshold (%) 80 Raise a CRITICAL alert when coverage drops below this percentage -- a systemic failure such as the agent having stopped deploying, rather than a few machines.
How often Poll interval (minutes) 60 60 minutes recommended.

WatchGuard Firebox

Firewall reachability and BOVPN tunnel status via SNMPv3

Setting Default The rule
Threshold SNMP port 161 SNMP UDP port. Default is 161.
Threshold SNMP timeout (seconds) 5 Seconds to wait for an SNMP response before treating the Firebox as unreachable.
How often Poll interval (minutes) 5 5 minutes recommended.

Windows Clients

Endpoint health for Windows 10/11 PCs -- BitLocker, pending reboots, AV, updates, disk

Setting Default The rule
Threshold Skip inactive AD computers (days) 30 Skip endpoints with no AD logon in this many days.
Threshold Warn if pending reboot older than (days) 7 Critical alert when a pending reboot has been outstanding for this many days (KCSIE compliance).
Threshold Warn if no update installed in (days) 30 Warn when no Windows Update has been installed in this many days.
Threshold Disk warning threshold -- C: (% used) 90 Warn when C: is more than this percentage full.
Threshold Scan timeout (seconds) 1800 Overall budget for the domain-wide client scan (1800 = 30 minutes). Raise it on a large estate -- on roughly 2000 clients the default can be tight.
How often Poll interval (minutes) 1440 1440 = once per day.

Windows Event Log

Security events: account lockouts, failed logons, group changes

Setting Default The rule
Threshold Lookback window (minutes) 60 How far back each poll looks. Should match poll interval.
Threshold Failed logon burst threshold 10 Warn if a single account exceeds this many failed logons in the lookback window.
How often Poll interval (minutes) 60 60 minutes recommended.

Windows Servers

CPU, RAM, disk, services and uptime for Windows Server infrastructure

Setting Default The rule
Threshold Skip inactive AD computers (days) 90 Skip computers with no AD logon in this many days. Set to 0 to include all.
Threshold CPU warning threshold (%) 85 Alert if CPU stays above this % for two consecutive polls.
Threshold RAM warning threshold (%) 90 Alert if RAM stays above this % for two consecutive polls, so a one-off burst is not reported.
Threshold Disk warning threshold (% used) 90 Warn when any fixed drive is more than this % full.
Threshold Disk critical threshold (% used) 95 Critical alert when any fixed drive is more than this % full.
How often Automatic re-discovery schedule Daily How often Groundskeeper automatically re-queries AD for new or removed servers.
How often Poll interval (minutes) 5 5 minutes recommended for servers.

Last updated: 2026-09-21 (v0.180.20)

Groundskeeper

Clone this wiki locally