24/7 computer monitoring —
what we actually watch, and when we call you

What is in the snapshot your computer sends every 15 minutes?

A small agent runs on the machine as a scheduled task. Every 15 minutes it wakes up for a few seconds, reads the state of the system, posts it to XIT's server and exits. That is the entire footprint: no open window, no heavy background service, and the collection itself takes seconds.

A single snapshot carries, among other things:

• Storage — free space on every drive, plus the SMART status the disk reports about itself. SMART is the one warning that arrives before a drive fails rather than after.
• Memory and CPU — installed and free RAM, processor load, and the processes using the most memory and the most CPU at that moment.
• Stability — blue screens and unexpected shutdowns in the last 30 days, plus system error counts over 24 hours, 7 days and 30 days.
• Security — which antivirus is installed and whether real-time protection is on, how old the virus signatures are, how many threats were detected, firewall state across all three profiles, BitLocker, UAC, TPM, and whether Remote Desktop is exposed without NLA.
• Maintenance — how many Windows updates are pending, when the last one was actually installed, whether the OS is activated, and which certificates expire within 30 days.
• Hardware and network — machine model, battery wear against original capacity, drivers in an error state, ping in milliseconds, packet loss and WiFi signal strength.

What is not in there matters just as much. The agent collects system and configuration state, not content. It does not read files, documents, photos, email or browsing history. The full breakdown of what is and is not collected is on what the report includes.

Why does one hour of silence already raise an alert?

A monitoring system that only alerts on what it can see misses the one case that matters most: a computer that stopped talking. So silence is treated as data.

At a 15-minute interval, a healthy machine sends four snapshots an hour. One missed report is noise — a dropped connection, a machine that went to sleep. Four missed in a row is a signal. That is why 1 hour without a report marks the machine as a warning, and 24 hours marks it as critical.

There are three explanations: the computer is off, it is disconnected, or the agent itself stopped running. The third is the real reason the alert exists. An agent that dies quietly turns the whole system into theatre — the dashboard stays green because no new data arrived, not because everything is fine.

An offline warning on a laptop that is shut down at night is expected, and whoever reviews it closes it without picking up the phone. The same warning on a machine that should run around the clock is a different story. The difference is not in the number; it is in the context.

What is the difference between a threshold alert and a trend alert?

The engine produces two kinds of alerts, and they work in completely different ways.

Threshold alerts — decided from one reading

Every incoming snapshot is measured against fixed numbers. Under 20% free disk space is a warning and under 10% is critical. Over 80% memory use is a warning and over 90% is critical. The same applies to latency above 150 ms, packet loss at 5% or more (20% is critical), WiFi signal below 30%, antivirus signatures older than 72 hours, battery wear of 40% or more, and more than 60 days without a single update installed. All of these are settled by the latest report and need no history at all.

Trend alerts — impossible without history

Snapshot history is kept for 60 days, and that is what makes it possible to see things one measurement never could. The trend maths runs over the last three days, or the last 30 readings if the machine reported less often:

• Disk fill ETA — a regression on free space over time. If a drive is losing more than 0.3% per day, the system works out how many days remain until it hits 3% free. Under 60 days is a warning; under a week is critical. The alert says the disk will seize up in 11 days, not that it already has.
• Memory leak — memory use climbing more than 1.5% per day while already above 60%. A machine that starts the day at 45% and finishes at 85%, day after day, does not have too little RAM. It has software that never gives it back.
• Sustained CPU load — an average above 70% across at least five readings. A momentary spike to 100% during an update is normal; a 78% average across two days is a background process nobody asked for.
• Reboot churn — three or more restarts in seven days, counted from uptime dropping between consecutive reports.
• No restart at all — more than 30 days of continuous uptime. This is a note rather than a fault: a restart would apply the updates that are waiting and release memory.

That distinction is the entire reason to keep history. One reading can tell you a disk is at 18% free. Only a series can tell you whether it has been sitting there peacefully for two years, or fell from 60% in the last three weeks.

The full alert catalogue: 26 types across six areas

The engine knows 26 alert types. They are grouped here into the same six areas your plain-language report is organised by.

Every alert is shown with a plain-language sentence explaining what it means in practice, not just what was measured. The detail behind each group lives on the security check, the hardware check, crash analysis, the network check and updates and maintenance.

What happens after an alert fires?

The alert is computed on the server the moment the snapshot lands. From there it stops being software.

1. Only a new critical alert pushes a notification to the technician's phone. Warning-level findings stay on the dashboard and get read in rotation. That is deliberate. A notification stream nobody reads is worse than none, because the one that mattered drowns in it.
2. A person opens the machine and reads the alert in context. What else fired at the same time, what the 60-day history says, what the event log recorded around that hour. Plenty of warnings die here, correctly — one blue screen after a power cut, a driver error on an unplugged printer.
3. If it matters, we contact you. In language that says what happened, what it is likely to cost you and what can be done, rather than event IDs and bugcheck codes.
4. If there is something you can do yourself, we can push a short message to your screen. Those pop-ups are configured per alert type, with a cooldown so a flapping alert cannot spam the person at the keyboard.

The value is not the dashboard. It is that someone looks at it

You can download a free monitoring tool this afternoon and get attractive graphs. What happens next is predictable: most people open the dashboard twice in the first week and then never again. An alert about 12% free disk space is worth precisely nothing if nobody reads it for three weeks.

The less obvious half is that knowing what to ignore is most of the job. The 20%-free threshold fires on a machine that has sat at 19% for two years and is perfectly happy, and fires identically on a machine that fell from 60% to 19% in three weeks and is about to stop working. Same number, two different situations. The history separates them and a person decides what to do.

What you pay for is not the data collection. It is the attention. The tooling is what lets one technician keep track of many machines without sitting in front of each one.

What monitoring does not do

• It is not antivirus. It reports on the antivirus you already run: whether real-time protection is on, whether signatures are current, whether threats were found. It does not scan and it does not remove anything itself.
• It is not backup. A SMART alert buys you time to back up before a drive dies. It does not copy a single file anywhere.
• It does not read your content. No files, documents, photos, email or browsing history. System and configuration state only.
• It is not employee surveillance. No keystroke logging, no screenshots, no list of sites anyone visited.
• It does not change things behind your back. Updates and restarts are recommended and coordinated with you, not imposed.
• It is not a staffed round-the-clock control room. Alerts are reviewed by a human, which also means a human has to see them. We do not promise a response time we cannot keep.

What does it cost?

There are two packages, and the difference between them is exactly the argument on this page.

• $5 per month, per computer — monitoring only. The agent, the 15-minute reporting, all 26 alert types, 60 days of history and the plain-language report across six areas. You get the engine and the dashboard.
• $10 per month, per computer — monitoring plus a human technician. Everything above, plus the person who reads what fires, judges it in context and gets in touch when it is worth your attention.

One small-business computer stuck for two days — a lost file, a customer left waiting, an evening with a technician — costs more than a year of monitoring. All the system really does is move the moment you find out from after to before. Details are on the pricing page.

FAQ

Read next

• Hardware check — disk, memory, battery and SMART in depth
• Security check — antivirus, firewall, encryption and hardening
• Crash analysis — blue screens, unexpected shutdowns and system errors
• What the report includes — exactly what is collected, and what is never touched