A 1C server rarely fails out of the blue — it usually sends warning signs for weeks that nobody reads. Here are five metrics that will warn you about a problem in advance.
1. Free disk space
Why it matters: when the disk fills up, 1C stops writing data, and the database can get corrupted. Space gets eaten by event logs, temp files and backups.
Threshold: warning at 80 % usage, alert at 90 %. What to do: clean up logs and temp files on a schedule, move old backups to separate storage, and if growth is steady, expand the disk (on a VPS this is done without reinstalling).
2. RAM
Why it matters: every 1C session and the SQL server consume memory; when it runs short, the system starts using disk instead of memory, everything “slows down,” and then it crashes.
Threshold: consistently above 85 % during business hours. What to do: cap SQL Server memory, add RAM, check for “hung” sessions.
3. Database health
Why it matters: for client-server databases — whether the SQL service is running, whether the transaction log is growing, whether routine maintenance (reindexing, statistics updates) completes. For file-based databases — whether the database exceeds the table size limit.
Threshold: the service is unavailable or the transaction log is larger than the database itself. What to do: set up maintenance jobs and the recovery model, and keep an eye on size.
4. Backups
Why it matters: a backup that silently stopped running is discovered at the moment you need it. Threshold: no successful backup in the last 24 hours (or 6 hours for “hot” databases), or a suspiciously small backup size. What to do: check not just that backups exist but that they restore — with a test restore once a month.
5. RDP access and failed logins
Why it matters: a 1C terminal server is a prime target for password brute-forcing. Hundreds of failed login attempts per hour mean an attack; a successful guess means ransomware in your database.
Threshold: more than 20 failed attempts from a single address within 10 minutes. What to do: block the address, put RDP behind a VPN or a gateway with two-factor authentication, and enable account lockout after a series of failures.
How to set this up
Our server monitoring covers all five metrics: an agent collects disk, memory and process data, dedicated checks watch backups and login logs, and alerts go to Telegram. On the plan with priority incident response, the engineer cleans up the disk, restarts the service or blocks the attacking address themselves — before accounting grinds to a halt.
Need help with the task from this article?
We’ll pick a configuration, calculate the cost and help with the move.