A state, not a log entry
A watcher observes one defined operating state — a certificate approaching expiry, for instance. It reports when that state leaves the agreed threshold, not every single line.
Monitoring Zscaler operations
The change nobody reported.
A certificate approaches expiry, a rule gets touched, a state reads differently than yesterday. Watchdog checks defined operating states continuously, reports the deviation to a named group of recipients and keeps it in view until somebody has fixed it.
How a watcher works
Four things that make an alert usable.
A warning helps little if nobody owns it, if it can be clicked away in passing, or if it stays unclear where it came from.
The alert has an addressee
Every watcher has a group of recipients. The alert goes there instead of waiting in a view nobody currently has open.
Acknowledged means fixed, not dismissed
An acknowledgement holds until the state is healthy again. A click alone does not close the alert.
Every alert says how it knows
Each alert carries the watcher that fired, the data source, an identifier and the time of the last check.
The sequence
From threshold to closed alert.
Three steps that settle what is monitored, who hears about it and when the case is genuinely done.
Decide which operating state is monitored and from which threshold it counts as a deviation.
undefined
Once the state leaves the threshold, the alert goes to the configured recipients — with watcher, data source and check time.
undefined
The acknowledgement holds until the state is fixed. Until then the case stays visible.
undefined
Configuration Rollback
Reporting is one thing. Reverting is another.
Watchdog reports that a state has changed. The way back is Configuration Rollback: it reverts individual configuration changes granularly, even when they were made directly in Zscaler. The two do not replace one another.
- Watchdog detects and notifies.
- Configuration Rollback restores the previous state of individual changes.
- Which step follows stays a deliberate decision.
Configuration Drift Review
The single case and the whole estate are two questions.
A watcher reports one state the moment it leaves its threshold. Configuration Drift Review detects deviations between actual and intended configuration across several tenants and prioritises them. Keeping the two apart stops an acute alert from being mistaken for a structural gap.
- Watchdog answers: what just happened, and who needs to know?
- Configuration Drift Review answers: where does the estate deviate from the agreed state?
- Both paths stay documented and traceable.
Next step
Discuss what to monitor first
Bring one recurring operating situation. We will map the roles, required context and appropriate demo path.
Frequently asked questions
Watchdog in Zscaler operations.
What exactly does Watchdog monitor?
Defined operating states that are checked continuously — not the complete change history. Every watcher has a threshold, a group of recipients and a data source.
Does Watchdog replace Configuration Rollback?
No. Watchdog reports a deviation, Configuration Rollback reverts individual changes. They are separate features and complement each other.
How does it differ from Configuration Drift Review?
Watchdog reacts to a single state as soon as it leaves its threshold. Configuration Drift Review compares actual against intended configuration across several tenants and prioritises the deviations.
What happens after acknowledging?
The acknowledgement holds until the state is fixed. If the deviation persists, the case stays visible — it does not disappear with the click.