Skip to main content
Proactive maintenance is the single most effective way to prevent unplanned downtime. A disciplined schedule — rather than reactive break-fix cycles — keeps your servers healthy, your endpoints clean, and your 3CX phone system performing at its best. The checklist below organises every critical task by frequency so your team (or your KHCOLO managed services engineer) always knows exactly what needs attention and when.
Don’t wait for alerts to tell you something is wrong. Configuring threshold-based monitoring for CPU, RAM, and storage means you receive a warning when utilisation trends toward a problem — giving you days or weeks to act instead of minutes during an outage.

​
Daily & Weekly Tasks

These checks form the operational heartbeat of your IT environment. Run daily items every business day; complete weekly items on a fixed day each week to build consistency.
Review the following metrics every day across all production servers:
  • ✅ CPU load — flag any sustained load above 80% for investigation
  • ✅ RAM utilisation — identify memory pressure before it causes application slowdowns
  • ✅ Storage pool thresholds — alert when any volume exceeds 75% capacity to prevent write failures
  • ✅ Backup job status — confirm overnight backup jobs completed successfully with no errors
  • ✅ Replication health — verify any VM replication tasks completed without faults
Document anomalies in your incident log even if they self-resolve — patterns often precede failures.
Run the following endpoint security checks on a weekly cadence:
  • ✅ EDR / Anti-Virus scan logs — review centralised console for detected threats, quarantine actions, or definition update failures
  • ✅ Failed login attempts — audit workstation and server event logs for repeated authentication failures
  • ✅ Patch compliance status — confirm all endpoints have received the latest approved updates
  • ✅ Removable media policy — verify USB device control policies remain enforced across the fleet
  • ✅ VPN / remote access sessions — review active and recently terminated sessions for anomalies

​
Monthly Tasks

Monthly tasks address the slower-moving but equally critical layers of your environment — software currency, telephony quality, and network security posture.
Apply security patches on a consistent monthly cycle:
  • ✅ Windows security patches — deploy validated updates from Microsoft Patch Tuesday release (second Tuesday of each month)
  • ✅ Linux kernel and package updates — apply security-priority updates across all Linux servers and review changelogs for breaking changes
  • ✅ Application patches — update business-critical applications (ERP, CRM, databases) following vendor release notes
  • ✅ 3CX platform updates — apply 3CX maintenance releases and review the update log for any configuration resets
  • ✅ Test before production — validate patches in a staging environment or a representative test machine before broad rollout
Keep a patch log recording what was applied, when, and by whom. This log is essential evidence during security audits.
Your 3CX system’s call quality depends on network conditions that can drift over time:
  • ✅ MOS score review — confirm Mean Opinion Score remains above 4.0 for all active trunks
  • ✅ Jitter measurement — investigate any trunk showing jitter above 20 ms
  • ✅ Packet loss check — flag any trunk with packet loss above 1% for ISP escalation
  • ✅ Call recording storage — verify recordings are landing in the correct storage location and retention policies are enforced
  • ✅ Extension and trunk licence audit — confirm licences align with current headcount and remove unused extensions
  • ✅ Emergency number routing — test that emergency call routes complete correctly end-to-end
Review your network perimeter monthly to catch intrusion attempts early:
  • ✅ Authentication failure logs — analyse firewall and VPN logs for brute-force or credential-stuffing patterns
  • ✅ Blocked traffic summary — review top blocked source IPs and update geo-block rules where appropriate
  • ✅ Rule base review — identify and disable any firewall rules that are no longer required
  • ✅ SSL/TLS certificate expiry — check expiry dates on all public-facing certificates and renew with at least 30 days’ lead time
  • ✅ IDS/IPS alert review — triage any intrusion detection alerts generated in the past 30 days

​
Quarterly Tasks

Quarterly tasks validate the resilience layers of your infrastructure — the ones you hope never to need but must be certain will work when you do.
Untested recovery plans are assumptions, not insurance:
  • ✅ Sandbox restoration drill — restore at least one critical application VM from backup into an isolated sandbox environment and confirm it boots and operates correctly
  • ✅ Recovery time measurement — record the actual time taken from initiating restore to confirmed application availability; compare against your RTO target
  • ✅ Runbook review — update your emergency escalation directory and DRP procedures to reflect any staff, supplier, or infrastructure changes
  • ✅ Offsite backup verification — confirm your geographically isolated backup copy is current and restorable
Cambodia’s power grid variability makes UPS and generator testing non-negotiable:
  • ✅ UPS battery runtime test — perform a controlled load test to confirm actual battery runtime matches rated capacity; replace cells showing significant degradation
  • ✅ Failover generator test — run a full generator failover simulation under realistic load and confirm automatic transfer switching operates correctly
  • ✅ PDU and surge protection inspection — visually inspect power distribution units and surge protectors for signs of heat damage or overloading
  • ✅ APC / UPS firmware — check for and apply any available UPS management firmware updates
Outdated firmware on network devices is a common but avoidable security exposure:
  • ✅ Core switch firmware — review vendor release notes and apply validated firmware updates to core and distribution switches
  • ✅ Access point firmware — update all Wi-Fi access points and confirm SSID configurations remain intact post-update
  • ✅ Router / edge device firmware — apply updates to border routers and SD-WAN appliances during a scheduled maintenance window
  • ✅ Out-of-band management — confirm IPMI/iDRAC/iLO interfaces on servers are on current firmware and access is restricted to management VLANs only

​
Maintenance at a Glance