Network Monitoring Checklist: What to Track and Alert On

A network monitoring checklist for a running set-up scores ten checks on dated evidence that a named person signs. The checks run from device coverage to the uptime report. Mark each check 2, 1 or 0. Then close any zero on the three gate checks first, and deal with the other zeros before the 1s.

This page reviews monitoring already in place at a firm with several sites across India or the GCC. It covers the links, routers, switches, firewalls and branch sites. A baseline is the dated record of what a site’s links and devices read when nothing is wrong. An alert threshold is the level at which a reading becomes an alert for a person to act on. The ten checks, their marks, the review window and the choice of gate checks all come from Signisys. Your firm can still adjust each one to fit its own estate.

Network Monitoring Checklist Scoring: Dates, Owners and Signatures

Every check gets one mark, resting on dated evidence. Anyone on the network team can gather that evidence, while the signer sits outside that week’s on-call rota. That way, the engineer who covered the nights does not mark their own shift.

A 2 needs evidence dated within the window that still describes the network as it stands. A 1 goes to evidence that predates the window or stops short of some sites or device classes. A 0 means the search finds nothing, or the evidence found confirms the gap.

Keep not applicable for a check whose subject is absent, such as branch links at a business with one office. The signer then records why, and the maximum shrinks by two.

The firm picks the window, and we suggest the last full quarter. When a check’s evidence is a list, choose three entries in the tool and follow each one to its source. No total counts as a pass. Instead, the sheet sets one quarter beside the next and points at gaps. The same ten checks make a network monitoring checklist for system admins to run ahead of a formal review.

Check 6, for example, shows how a mark works. A test alert from last month, answered inside the time the rota allows, earns a 2. A test from last year earns a 1. With no test on record at all, the mark is 0.

What to Track on Every Site and Link

The tables below can go straight into a network monitoring checklist template of your own. Number the checks 1 to 10 and keep those numbers fixed, which lets one quarter’s sheet sit beside the last. Checks 1 to 4 cover what the tool watches and what normal looks like at each site.

Network Monitoring Checklist Coverage: Sites, Links and Devices

Check 1 is a gate check, and it compares three lists. They are the network team’s device list, the site list kept by facilities or finance, and the tool’s polled list. Pick a site, for instance a warehouse in Coimbatore, and look for its edge router on all three. If a core device is on the device list and missing from the polled list, the check scores 0. After all, a device the tool does not poll raises no alert.

For check 2, open the tool’s history for each branch and find a reading dated inside the window. A branch that went silent two months ago with no alert scores 0 here. It also points to a gap in check 5.

Some branches run on SD-WAN, which steers a branch’s traffic across its lines under central control. At those sites, look for history on each line beneath it; history for the overlay alone earns a 1.

Normal Levels and Link Headroom on Record

For check 3, set the baseline’s date against the site’s change history. Take a baseline recorded before a link upgrade, an office move or a large new application. It describes the site as it was before that change, and it earns a 1. A baseline with no date earns a 0, since nobody can tell which version of the site it describes.

Check 4 looks for a trend across the whole window. The rate of change counts as much as the level. For example, a fairly full link that stays flat can wait longer than a half-full one climbing each month.

When marking a plant in Pune or a branch in Riyadh, start with the busiest link. If the tool holds too little history for the whole window, the check scores 1 until enough builds up.

What to Alert On, Day and Night

Checks 5 to 7 look at alerts, starting with the rule set. Then they ask whether the rules still reach a person and whether the team still acts on them.

The Alert Rule Set and Night Cover

Check 5 is a gate check. Read the rule set export beside the rota for five things. First, thresholds per device class, drawn from the baseline: a core firewall and a floor printer need different levels. Second, rules on interface errors and dropped packets as well as up or down. An interface can report up while it drops traffic. Third, urgency tiers, such as alert at once, alert within minutes and a daily summary. Fourth, an owner and an escalation contact for each device class. Fifth, a rota that names someone for nights and weekends in every country where the firm has sites.

In this network monitoring checklist, a 0 on check 5 goes ahead of every gap except other gate zeros. A rule set that exists in the tool but has no export, or no date, earns a 1.

The Last Test Alert and the Noise Review

The UK National Cyber Security Centre has published logging and monitoring guidance (2021). It suggests raising an alert when a test event that should arrive at set intervals goes missing. Check 6, a gate check, carries that idea over to alerts. It asks for the record of the last test sent down the route. A test with no named answerer scores 0, whatever its date. Then compare that record with the firm’s incident response plan, the written steps for handling an incident. Both should name the same person.

Check 7 reads the minutes of the last meeting where the team went through ignored and false alerts. Minutes that changed no rule still earn a 2, provided they show which alerts the team examined. If the team holds no such meeting, mark 0.

Network Monitoring Checklist Records for Changes, Logs and Uptime

Checks 8 to 10 cover the records a team turns to during a fault and after it.

Change History and Configuration Backups

Pick three configuration changes from the devices’ own history inside the window and find each one in the change log. If one is missing, the check drops to 1. If none of the three appears, mark 0.

Then look at backups by device class: routers, firewalls, core switches and wireless controllers. Each class also needs a last backup date inside the window. A backup with no restore test on record earns a 1, however recent, since nobody has seen it work. The content of firewall rules stays with the network security audit.

One Log Store and the Uptime Report

The same NCSC page suggests deciding which logs to pull into one place for analysis across data sets. It also puts the retention period for important logs at 6 months or longer. If the logs feed a SIEM, a system that collects and correlates security logs, its retention setting is the evidence. Check 9 is also where this network monitoring checklist and a security audit read the same record.

CERT-In’s 28 April 2022 directions covering logs and clock sync apply to the organizations they name, body corporate included. Those organizations must keep logs of all their ICT systems for a rolling 180 days, stored within India. The directions also tie system clocks to NIC or NPL time servers, or to servers traceable to them.

For check 10, find the last report and the people it went to. A report that reached no one outside IT earns a 1.

What the Score Says About Your Monitoring

Total the marks, then divide by the maximum that remains once not-applicable checks are set aside. The share helps when you track one marking against the next. Where each zero sits, though, decides what to do first.

Three Network Monitoring Checklist Zeros to Close First

Any 0 on gate check 1, 5 or 6 goes ahead of every other gap, whatever the total share says.

A 0 on check 1 means part of the network sits outside the tool, and nothing there raises an alert. On check 5, a zero means the rules, the tiers or the night cover are missing. Finally, a 0 on check 6 means nobody knows whether an alert still reaches a person.

When zeros turn up in several sections, the monitoring needs rebuilding across those areas. In that case, follow the build order for each site. Then score the sheet again once a full window has passed.

A Worked Example From an Invented Firm

This firm is made up for the arithmetic: one office in Sharjah, no branches.

With check 2 out, the maximum falls from 20 to 18. The marks add to 12, a share of 67%. However, the 0 on check 6 is a gate zero. Nobody can show when a test alert last went out or who answered it.

The first job is a test alert sent and answered on record, with the date and the person’s name. That moves check 6 to a 2 on the next pass of the network monitoring checklist. After that come the four 1s: an old baseline and a capacity trend nobody initialed. The other two are a noise review last held two quarters ago and a log store with no written retention period.

Events That Call for a Fresh Review

Mark the sheet again after any of these:

• a new monitoring tool, or a major upgrade to the current one;
• a new site, or a site that closes;
• a change of rota owner or escalation contact;
• an alert that someone missed, or an outage users reported first.

If nothing on that list happens, one full marking per window is enough. File each finished sheet, and the next marking then has a share to compare against.

Limits of a Network Monitoring Checklist Review

This review reads the evidence. Judging the network’s design and finding faults are jobs for other work, and several subjects sit outside the sheet:

• Cloud workloads: see readings for cloud-hosted applications.
• Link contracts and failover: see scoring each office link and its contract.
• Causes behind a failed check: see why a network can look up and still let users down.
• Choosing between types of monitoring tool is a separate decision.
• Wi-Fi coverage sits outside the sheet.

Bring in a specialist when the sheet shows several gate zeros. The same applies when nobody owns the rota, or when logs from some devices reach no store.

Our infrastructure and networking team carries out this kind of review. It sits within Signisys’s work on networking across all your sites. What the offer covers is set out on an outside review of your monitoring. Signisys earns from this work, and you should read the page with that in mind. Even so, the sheet itself runs on your own evidence and one signer. If the sheet has zeros, our network team can go through the evidence with your staff. We can also act as the second signer before you plan any work. No charge, with a fixed scope.

Network Monitoring Checklist FAQ