Alerts you can trust, not a flood you learn to ignore

Real-time heartbeat

Every monitored device is checked every 10 seconds with a fast ARP probe — lightweight enough to run constantly without loading the network.

A missed probe isn't an alert. It's re-tried twice at two-second intervals, then escalated to a direct ICMP/TCP/SNMP check before Horotics will call a device offline. That's deliberate — three classes of false alert were specifically engineered out:

• A device that was never online is never reported as "gone offline"
• A device only comes back "online" after answering a live probe — a stale ARP cache entry is never trusted on its own
• Nothing goes offline on a single missed scan; the same multi-method confirmation runs every time

Alert levels & notifications

Every device sits at one of three levels, so you only hear about what you actually asked to hear about.

A device left "Alerting" and still down gets repeat reminders on an easing-off schedule (30s → 2min → 5min) rather than silence or a flood, alerts can be confined to an active-hours window, and any device can be snoozed individually until it recovers.

Dependency-aware alert suppression

This is the one that actually changes how an on-call night feels.

Horotics automatically builds a map of what's connected to what — which devices sit behind which switch port or access point — and uses it the moment something goes down. Without it, a dead switch looks like this:

With it, the same failure is one alert, and every affected device is still visible underneath it, not hidden:

Wired topology (high-confidence) suppresses aggressively; wireless topology suppresses only at the access-point level, because a client roaming between APs is normal behaviour, not a fault. A rollup only ever fires on a confirmed-down parent — a suppression that hides a real outage would be worse than the flood it's replacing, so that's the one failure mode the design actively guards against.

Obsess Mode

For the device that's "sort of" fine — point Horotics at it and it stops doing anything else for a while.

Choose a duration (5, 10, 20 or 40 minutes) and every other scan pauses so the full probe budget goes on that one device: latency and jitter, packet loss, per-port TCP reachability, real SNMP-counter throughput, and an iperf3 bandwidth test against the switch's own rated port speed.

A security pass runs alongside automatically — a short passive packet capture, an offline signature-engine replay, and a targeted vulnerability sweep of the device's own open ports — and every session is retained (fifty most recent per device) so a recurring fault has a real history to compare against, not just today's snapshot.

Internet diagnostics

Not just "is the WAN up" — a full picture of the line itself.

Download, upload, ping, jitter, packet loss and DNS resolution time together, with automatic best-server selection and fallback engines if the primary test server is unavailable. A continuous test mode plots all five live over time, so an intermittent line issue shows up as a pattern instead of vanishing by the time someone checks.

History that survives a reboot

Every response-time graph, every Obsess session, every alert — kept on persistent storage, not memory.

A power cycle or an update doesn't erase a device's history. Data is only ever pruned by a configurable retention window, so the trend you're trying to show a client is still there next time you open the dashboard.