How checks work
A check is an automated test that an octoja agent runs on a device at regular intervals. Each check monitors a specific condition — disk space, service ...
A check is an automated test that an octoja agent runs on a device at regular intervals. Each check monitors a specific condition — disk space, service state, network reachability, backup status — and reports the result back to the platform. A few checks, such as Device online, are evaluated on the server side instead of by the agent.
How checks work
Check types come from check repositories and are listed in the Check Library under Configuration → Check Library. When you add a check to a device or to a config package, the agent downloads the check definition and begins running it on the configured schedule.
The library is filled from three kinds of repository: the built-in official repository octoja maintains, your own custom checks, and any community repositories you connect by URL to bring in extra checks. See Connect a Community Check Repository and the Check Repository Reference for details.
In a check's preview you can try its input options, for example enabling a switch to reveal dependent fields. This is only a preview: it neither assigns a check nor saves an existing configuration. You can also use result-text templates to present custom-check output in notifications and cases.
Available check types
octoja ships a catalogue of built-in check types across four categories. Alongside the generic Antivirus Status check, there are dedicated checks for specific antivirus vendors, UniFi SNMP device checks, and a System Updates check. The full set is listed below.
Hardware
Network
Security
Services
To create a dedicated least-privilege account for the Microsoft SQL Server, MySQL/MariaDB and PostgreSQL checks, see Set up the database monitoring account.
Check outcomes
Check history and retention
Check-result history is kept for 30 days by default. Older historical results are automatically deleted; the latest result for each check remains available.
If you need a longer retention period for your octoja instance, contact octoja support. Additional costs may apply because longer retention increases storage use and backup sizes.
Windows System File Integrity (SFC)
The Windows System File Integrity check belongs to the Services category and runs only sfc /verifyonly. It requires Windows and administrator rights on the device. There are no check-specific input options. The default interval is one week (10,080 minutes), and each scan has a 20-minute time limit. Avoid a short interval for this check.
Unlike Filesystem Integrity, this check verifies Windows system files, not the NTFS dirty bit or the physical health of a drive. A critical result therefore does not prove a disk failure. The check does not show a list of affected files or analyze CBS.log.
Repair with sfc /scannow is not part of this check. If needed, run it as a separate, deliberately initiated automation, then repeat the check to assess the resulting state.
Config packages
Rather than configuring checks one device at a time, you can use config packages to assign settings to groups of devices based on rules. Besides checks, a package can carry software deployments, automations, agent settings, and maintenance windows.
For individual checks, see the detailed guides for Comet backups, missing disks, HP warranty, DATEV and Securepoint UTMs.
Further check guides:
Alerts
You attach an alert configuration to a check so octoja notifies you when it keeps failing. A configuration holds one or more channels, and each channel decides on its own when to fire and where to send: a mobile notification, an email, a webhook, Microsoft Teams, woasi, a case in octoja, or a ticket in a connected helpdesk or PSA system such as Zammad, TANSS, Autotask, or Jira. Because every channel carries its own threshold, one configuration can escalate — a push notification early, a case once the problem persists.
A channel fires only when the check fails a set share of a window of recent results (by default, half of the last ten), so a single blip stays quiet. That window can count results or cover a stretch of time in minutes or hours. Each channel also has a minimum severity, Warning by default, so a channel can be raised to react to Critical results only. Alert configurations are assigned to the check inside a config package, and an individual device can override the alarm configuration or have its alarms turned off while the check keeps running. Warning and Critical results are always surfaced on the device's Checks tab as well. See Set up alerts for a check.
Was this helpful?
Still need help? Ask the team