Most SMEs discover their IT infrastructure isn't working when someone in accounting tries to issue an invoice at 9 in the morning. Not earlier. Infrastructure monitoring isn't a toy for large-corporate IT departments — it's a much cheaper version of panicked Saturday-evening phone calls.
At one of our clients — a 28-person furniture manufacturer — the disk holding the Comarch Optima database filled up with transaction logs on Saturday afternoon. Nobody noticed. On Monday at 7:30 the phones started ringing because production was idle: no goods-issued documents, no B2B orders coming in. They lost about half a day of production, plus a handful of urgent shipments went out late. Total cost of the incident, the firefighting and the overtime: somewhere around 14 thousand zloty. An email alert about the disk crossing 80% would have cost them zero zloty a month — because we'd have set it up on a free tool they already had running on another server.
Monitoring doesn't prevent failure. It shortens the time between "something is wrong" and "someone knows something is wrong". That's usually the difference between a half-hour incident and a half-day outage.
First: disks, RAM, CPU
The list of things you must measure on the ERP server, the file server and the firewall is short. Disk usage (separately per volume — system, database, transaction logs, backups). Memory usage. Average CPU load. Uptime (sudden reboots usually mean something). And the most basic "is the box even alive" — a ping every minute.
These are things you get for free in any monitoring tool from the past 15 years. Zabbix, Prometheus, Uptime Kuma, Checkmk Raw — all of them will show you the basics after two hours of work. The SME problem is that nobody bothers to set it up. The server bought four years ago runs "until it dies" and conclusions are drawn after the fact.
- Disk usage — warning at 80%, critical at 90%.
- Free space on the database partition — its own threshold, lower than for the system disk.
- Uptime — if the server rebooted itself, someone should know about it the same day.
- Temperatures and RAID array status — the controller won't email you on its own, you have to configure it.
Backups that actually run
The most common pitfall we see: backups "exist" but nobody checks whether the last one actually ran. The 3-2-1 policy won't help you if the backup job has been failing for six months and nobody noticed, because nobody reads the Veeam logs.
Monitoring backups is literally three things: did the job start, did it finish successfully, and how long did it take (a sudden jump in time or volume is a signal — ransomware encrypting files, for example). Most backup tools have a webhook or send status emails. Pipe them to someone who reads inbox every morning, or to a simple dashboard that turns red when something didn't run.
- Every backup job has an entry in the "monitoring calendar" — you know when it runs and when it should finish.
- No success report = alarm, not silence.
- Once a quarter someone restores a random file from a backup. Without that, you don't know that backup works — you only know that the job finishes.
Services your team actually sees
The second layer of monitoring is the things people in the company notice first: ERP, email, network printers, VPN, file shares. The trick is for IT (in-house or outsourced) to know about a problem before the first user calls.
The simplest mechanism: synthetic checks. Every 2 minutes a script logs into the ERP with a test account and issues a draft document on a sandbox account. Every 5 minutes it checks whether the mail server responds on ports 25 and 993. Every minute it checks whether the corporate portal login page returns HTTP 200. Each of these "pings" costs minutes to set up and saves hours of "I can't log in" phone calls.
At a distribution client (52 people, enova365 + WMS) we introduced a synthetic WMS login test. The first four alerts caught that the SQL Server Express database was approaching its 10 GB limit — what would once have ended in a one-day warehouse outage was instead resolved on Friday evening, before anyone noticed.
Security: only sensible signals
Security monitoring is the area where it's easiest to overspend and easiest to drown in noise. If you start listening to every event Windows Defender or the firewall generates, within a week nobody will read the alert emails any more.
At SME scale, three signals are worth watching first: failed login attempts on privileged accounts (domain admin, ERP admin), new login locations on Microsoft 365 (a country other than Poland is a red flag) and antivirus status on endpoints (is it running at all and are the definitions up to date). These are the signals that genuinely save companies from phishing and ransomware. The rest — packet analysis, SIEM event correlation, threat intelligence — has its place, but only in companies with a dedicated security headcount.
Who answers the alerts and when
The best-configured monitoring delivers nothing if alerts go to a generic inbox that nobody opens. Equally — alerts sent to the whole team at 2 in the morning quickly land in a "move to folder" rule. You need ground rules, even if it's only a one-page document.
- A list of critical alerts that wake someone up at night (usually: ERP server down, firewall down, ransomware suspicion). Everything else waits until morning.
- A name and surname of the first responder — and a backup person for holidays.
- The alert channel — ideally SMS or push (Slack, Teams, a dedicated app). Email as a critical alert channel doesn't work.
- What to do when an alert repeats every 5 minutes — who acknowledges it and who escalates.
How to monitor without overpaying
A fixed bill of 800–1,500 zloty a month for a SaaS monitoring tool at a 20-person company usually doesn't make sense. You'll get the same functions from free tools if someone spends 2–3 days on configuration and then has a plan to keep them current.
For most SMEs the right stack is: Uptime Kuma for synthetic availability checks, Zabbix or Checkmk Raw on Windows/Linux servers, the built-in Veeam/Acronis reports for backup, and one or two Microsoft 365 Defender rules for suspicious logins. Total: a few hundred zloty one-off for the configuration, zero recurring license fees. The whole point is for one person — internal or an IT services provider — to own it and to know what each indicator means.
If you feel your company is "too small" to bother with this, but at the same time a half-day ERP outage would cost you what the entire infrastructure costs in a month — that is exactly the moment to start. Begin with one server and one backup job; in six months you'll have the rest.
Monitoring doesn't prevent failure. It shortens the gap between "something is wrong" and "someone knows about it" — and that usually decides the cost of the incident.