Skip to content
ZHERO Docs

ZHERO Health

Every other page here documents what ZHERO tells you about your tenant. This one documents what ZHERO tells you about itself: how much it loaded, what it left out, and how long it took.

You will want it for one question in particular, the one that has no answer anywhere else in the product: why does this policy have no findings?

Where to find it

ZHERO Health is a modal, not a tab. Open the ZHERO drawer, click the kebab menu in the header, and choose ZHERO Health. It opens over whatever you were looking at and closes without changing anything.

The policy complexity report

Some policy entities carry criteria lists so large that analysing them would cost more than the finding is worth. ZHERO measures each one as it loads, and the ones over the line are skipped: they still appear everywhere in the interface, they simply are not analysed.

This report is where that decision becomes visible.

How the decision is made

For each policy type, ZHERO knows which fields hold criteria, and counts how many entries each of those fields holds. It compares the largest single field against the threshold, never the sum of them: a rule with eight criteria fields of forty entries each is not complex, while one field with four hundred entries is.

  • A policy is skipped as soon as one field exceeds the threshold.
  • The default threshold is 256 entries in a single criteria field.
  • The threshold is set centrally and can be tuned per tenant without shipping a new extension. It is not a setting you change in the interface.
  • A malformed or unexpected field counts as empty rather than raising an error. ZHERO would rather skip one policy than abort the whole load.

What the table shows

One row per skipped entity:

ColumnWhat it tells you
Entity nameThe policy that was skipped
Entity typeWhich policy type it belongs to
Tenant typeZIA, ZPA or Experience Center
Fields over thresholdEvery criteria field above the line, largest first
Dominant fieldThe one field that drove the decision
Threshold @ evaluationThe threshold in force when this policy was measured
StatusSkipped, or analysable

When nothing trips the threshold, the panel says so explicitly and names the number: analytics is fully active on this tenant.

Recording the threshold on each row matters more than it looks. If the value is retuned, rows measured before and after carry different numbers, and the report stays readable instead of implying that a policy changed when only the rule did.

How large your tenant really is

The header of the report is a census of what ZHERO loaded, and it is the fastest answer to “why is this tenant slower than the other one”.

  • Policies (cross-type), Cloud apps and URLs (cross-source): the totals
  • Max criteria / policy: the largest single criteria field found, which tells you how close a healthy tenant is to the threshold
  • Policies skipped and Active threshold: the two numbers the report exists for
  • Tenant size (bytes): an estimate of the serialized configuration
  • Cache hits / misses: how much of the last load came from cache
  • Entities per backend, plus breakdowns per policy type, per entity type, and URLs by source

Init timings

Below the census, the last initialization is broken down phase by phase, with a small timeline alongside the durations so a single long phase is visible at a glance.

  • Init kind and repository load status, as tags
  • One row per phase, with duration, status, and whether it was a cache hit or miss
  • Slow entity fetches, listing only the entity types that took longer than the configured slow-entity threshold, which is shown next to the table

If you open the modal while an initialization is still running, the panel follows it live and updates roughly once a second until the load reaches a final state.

Template execution performance

When the last init ran analysis templates, a third table breaks them down: template ID, how many times it ran, total, average and maximum duration, the split between ok, error and skipped executions, and a flag on the ones counted as slow.

This is the table to read before reporting that “ZHERO is slow”. A single costly template running once per entity across a large tenant looks very different from a general slowdown, and the difference is one glance here.

When the report is empty

What you seeWhat it means
No tenant loaded yetNo Zscaler portal tab has been open long enough for ZHERO to initialize. Open one and wait.
No init completed yet, please waitThe first load for this tenant is still running. The report populates when it finishes.
A banner saying a fresh init is in flightA reload is under way. The figures shown are the previous ones, and they refresh on their own when it completes.
Unable to load diagnosticThe request to the extension’s background worker failed. The message names the cause.

Limits and notes

  • It reads, it never writes. Nothing here changes your tenant or your ZHERO data.
  • It describes the tenant currently loaded, not your estate. Switching tenants gives a different report.
  • The threshold is not a setting. If skipped policies are a problem for you, that is a conversation with support, not a checkbox.
  • A skipped policy is not a broken policy. It works normally in Zscaler and appears normally in ZHERO. It is only excluded from analysis.
  • The figures are from the last initialization, not live counters. Reopening the modal after a reload is what refreshes them.

FAQ

A policy of mine has no findings at all. Is it healthy? Check this report first. If the policy is in the skipped table, no template ever looked at it, and the absence of findings means nothing. If it is not there, the absence is a real result.

Can I raise the threshold so my large policies get analysed? Not from the interface. The value is set centrally and can be adjusted per tenant; support can do it without a new extension release.

Why does the same policy count as complex when it looks ordinary in the console? Because one of its criteria fields holds more entries than the console makes obvious. The dominant field column names which one, and that field is usually a URL category or group list that grew over the years.

The init took a long time. What do I do with this table? Look for a phase with a long duration and a cache miss, and for entity types in the slow-fetch table. Both point at the size of the tenant rather than at the extension, and both are useful detail in a support request.

Does opening ZHERO Health cost anything? No. It reads a snapshot the extension already produced during its last initialization.