Grid Advisor

Running a network monitoring deployment well means constantly asking the same questions: is anything collecting data nobody looks at? Is a detection so noisy it’s drowning out the alerts that matter? Are you about to run out of storage? Grid Advisor asks those questions for you, on an ongoing basis, and answers them with specific, quantified recommendations instead of a vague health score.

Each recommendation tells you exactly what to change, why, and — where it can be measured — what you get for making the change, like “cuts ingest by 1,200 samples/sec” or “reclaims 4.2 GB/month.” Most recommendations apply in a single click, right from the same page.

Where to find it

Open Configure → Grid Advisor. It’s an administrator surface — you need the same access as System Configuration to see it.

The Grid Advisor hub gives you an overview of every advisor, grouped into categories, plus a running count of how many advisors are live versus still being built. Click a category to see the advisors in it, or click straight into an advisor from its card.

Reading a recommendation

Every advisor’s page follows the same shape: a handful of summary numbers at the top, then a list of recommendations, then a full findings table underneath so you can see everything the advisor looked at — not just what it flagged.

Each recommendation carries a few consistent signals:

Signal	What it tells you
Confidence	How sure Grid Advisor is that this is a genuinely good change — High, Medium, or Low.
Data-loss risk	Whether applying it could cost you something you might want later — No data-loss risk, Low, Medium, or High. Disabling a collector that’s producing nothing right now still carries a small risk, for example, because it forecloses data you might have wanted going forward.
Projected impact	The measurable payoff, when one exists — a rate of samples reclaimed, a storage figure, or both.
Review only	Some recommendations can’t be applied automatically because the fix is a judgment call — adding redundancy to your network, editing a detection’s rule text, reassigning a collector’s networks. These deep-link straight to the right settings page instead of offering a one-click apply.

Where a one-click apply exists, you can apply a single recommendation or, when several similar ones are queued up, apply all of them at once.

Each advisor’s report shows when it was last computed and a Refresh button. Reports are recomputed on a schedule in the background, so a page usually loads instantly from a recent result — click Refresh any time you want Grid Advisor to look again right now, for example right after you’ve made a change you want reflected immediately.

The advisors

Grid Advisor is organized into categories. Here’s what’s live today:

Cost & Efficiency

Spend less on storage and ingest without losing the signal that matters.

• Metrics Resolution — looks at how often every metric is being polled and finds counters that are sampled faster than they need to be. Slow-changing values (like total interface counters) can usually be tiered down to a slower interval with no data-loss risk, while fast-moving throughput charts are left alone. Applying a recommendation re-points the affected collectors at the new interval right away.
• Log Volume & Cost — ranks your log sources by how much volume they’ve sent over the last 30 days, flags the noisiest low-severity sources, and shows how much data is being held longer than your retention review mark. Every finding here is for you to review — Grid Advisor never shortens retention on its own, since that means deleting data. Recommendations deep-link to your Log Storage settings.
• Retention & Storage — shows how close your hot and cold log storage are to quota right now, and — when there’s enough history to measure a trend — projects roughly how many days until you’d fill up at your current growth rate. Also review-only, deep-linking to Log Storage settings.

Coverage & Quality

Make sure the right things are monitored — and nothing is collected for no reason.

• Data Health — finds collectors that are enabled but producing zero samples, and collectors whose data isn’t wired into any chart anyone would actually see. The dead ones (collecting nothing, shown nowhere) can be disabled with one click; the merely-orphaned ones (still writing data, just not charted anywhere visible) are shown for review, since something might still be reading that data another way.
• Monitoring Coverage & Gaps — surfaces what you’re not watching yet: managed devices with no class or no monitoring pack assigned, telemetry your collectors have seen but that hasn’t been mapped to anything meaningful yet, and hosts your network discovery has found that aren’t managed devices. Every finding deep-links to the place you’d go to fix it — Devices, the Telemetry Pipeline admin page, or Services.
• Service Monitoring — finds services your discovery has found running on devices you already manage that have no active check watching them. When the service is well-known enough (or was found on a specific port) to configure automatically, you get a one-click Apply that creates the monitor outright; everything else deep-links to the Services page with the reason it couldn’t be created for you automatically.

Reliability & Capacity

Keep the fabric healthy and get ahead of the next outage.

• Collector Capacity & Health — flags collectors that are offline while still owning devices (so those devices are effectively dark), collectors carrying a lot more devices than the rest of your fleet, and an uneven overall distribution of devices across collectors. Every finding is review-only and deep-links to Collectors or Collector Profiles, since rebalancing device ownership is a decision you make there.
• Topology & Resilience — reads your network graph for single points of failure (a device whose failure would split your network) and single-homed devices (only one path in), the same analysis behind Network Insights. Findings deep-link to the affected device or to Graph Explorer so you can see exactly where redundancy is missing.

Signal & Response

Tune what alerts you so the important events aren’t buried.

• Detection Tuning — classifies your detections as noisy, flapping, or never-firing, based on how many events and devices they’ve triggered recently. Most of these are for you to review (the real fix is usually editing the rule or adding a case rule to group related events), but a noisy, non-built-in detection can be disabled directly from the page.
• Notification Health — checks whether your notification endpoints are actually delivering, and whether every alerting detection has somewhere to notify. A failing endpoint can be disabled with one click; everything else (a detection that notifies nowhere, an endpoint nothing uses) is shown for review. This page never shows endpoint secrets — just names, types, and delivery counts.

More advisors, including a Security category, are on the way — the hub shows you which ones are live versus still being designed.

The Savings Ledger

Every time you apply a recommendation from any advisor, it’s recorded in the Savings Ledger (Grid Advisor → Savings Ledger): what changed, which advisor suggested it, who applied it, when, and the projected payoff at the time you applied it. It’s a running tally you can check back on to see the cumulative effect of everything Grid Advisor has helped you tune — the ledger is a record only; it doesn’t undo an applied change for you.

Where to go next

• Explore your metrics directly with Metric Explorer.
• Understand what’s actually being polled in Monitoring & Metrics.
• Review your detections in Detections and where alerts go in Notifications.
• See how logs are stored and retained in Logs & Log Search.