Data, retention and alerting
CNA collects metrics, not logs or traces: measurements of how services perform, from the desk, the server, the user's device and the cloud. You set the thresholds; the alert rules build themselves.
What is collected
| Source | Measurement | How often |
|---|---|---|
| Office sensors | Applications: response for up to 12 apps per sensor, plus DNS lookup time | Every 2 minutes |
| Network path: latency and loss at every hop on the way to each app | With each app test | |
| Wi-Fi experience: signal, quality, rate and the access point in use | Every 15 seconds | |
| Radio scan: the 24 strongest access points nearby | Every 15–20 minutes | |
| Speed tests | On demand; they switch themselves off when done | |
| Cloud WAN probes | Latency, loss and availability of each site's circuits, one or two per site | Every minute; every 2 minutes in trace mode, where a circuit blocks ping |
| Server and VM agent | CPU, memory, disk and network on Linux and Windows | Every 20–30 seconds |
| Critical processes: whether each named process is running | Alerts the moment a named process disappears | |
| Endpoint availability, and days left before each certificate expires | Endpoints every 30 seconds; certificate expiry checked for alerting every 15 minutes | |
| Docker container metrics. AWS, Azure, VMware, Hyper-V and Google Cloud Platform hosts are recognised. | Every 20 seconds (Linux) | |
| End-user device agent | The device's CPU, memory, disk and Wi-Fi, from the user's own Windows device, while it is switched on | CPU, memory and disk every 20–30 seconds, as the server agent; Wi-Fi every 15 seconds and a scan every 15–20 minutes, as the office sensors |
CNA sits alongside your logging and APM tools rather than replacing them.
For which sensor measures what, see the sensor comparison.
Retention
| Data | Kept for |
|---|---|
| Metrics | 90 days by default. Longer retention is available at additional cost. |
| Wi-Fi radio scans | 24 hours |
| Configuration audit trail | One year |
All of it is held in the Cloud Unit dedicated to you. See Architecture.
What CNA alerts on
Thresholds are set in simple portal forms. The alert rules build themselves, and regenerate when you change a threshold.
| Alert | Scope | Threshold |
|---|---|---|
| App response | Per application | Set by you |
| Per-site apps | Per site, on the average of up to three apps | Set by you, in seconds |
| DNS | Per site, against the DNS server configured or issued by DHCP | Set by you, in milliseconds |
| WAN latency and loss | Per circuit, up to two per site | Latency set by you; packet loss fixed at 10% |
| Wi-Fi signal | Per site and floor | Set by you, in dBm |
| Sensor offline | Groups of sensors, raised as one alert | Offline |
| CPU, memory, disk | Per server | Set by you |
| Missing processes | Per named process | The process disappears |
| Certificate expiry | Per endpoint | Set by you, in days before expiry |
Alerts are thresholds you set. CNA does not do automatic anomaly detection.
How quickly
A sustained problem raises an alert in about 10–15 minutes, day or night. This is an estimate from the default alert settings: rules are evaluated every two minutes and must stay in breach for ten. Both can be tuned for you.
Keeping the noise down
- Per-site alerts can fire on the average of up to three apps, so one wobbling app doesn't page anyone. Choose apps with similar response times.
- Offline sensors are grouped into one alert.
- A problem must persist before it alerts, so a single slow test does not.
Where alerts go
| Option | What you get |
|---|---|
| Standard | Email groups, 6 by default. Each group has its own recipients, sends either one combined email or one per recipient, and can optionally send a notice when the alert is resolved. Messages are branded. |
| Tailored to you | Teams, Slack, webhooks, PagerDuty, ServiceNow and enterprise reporting options such as scheduled PDF reports. Severity levels, maintenance-window muting and routing rules are part of this tailored build, scoped with you. |
Defaults and limits
| Item | Default |
|---|---|
| Sites | 12 |
| Apps per sensor | 12 |
| Network profiles | 25 |
| Email groups | 6 |
Each can be raised on request.
Configuration audit trail
Every configuration change made in the portal is recorded: who changed what and when, with the old and new values. The trail is kept for a year. Admin and configuration dashboards are restricted to nominated senior staff.
Floor-map colour bands
On the live floor maps, each sensor is coloured by Wi-Fi signal strength. A time slider replays signal changes.
| Colour | Signal |
|---|---|
| Green | Above −67 dBm |
| Amber | −68 to −75 dBm |
| Red | Below −75 dBm |
See floor maps for an example.