A method for monitoring different data storage devices across a network, the method comprising: receiving data storage access requests made to different data storage devices across a network; assigning a subset of the access requests to a taxon of a taxonomy of access request characteristics; for the taxon, determining a taxon threshold for a parameter based upon the subset of the access requests; comparing the parameter of a sample of observed access requests, made to a data storage device and belonging to the taxon, to the taxon threshold; and outputting a notification regarding the data storage device based upon the comparison; where the taxon is selected from a group of taxons consisting of: population, community, activity, session, workload, application and process, wherein the population taxon comprises requests made to a same type of storage device, wherein the community taxon comprises access requests made to storage devices that are participating in a same type of activity, wherein the activity taxon comprises access requests that are executing same type of sessions, wherein the session taxon comprises access requests that are performed during same ranges of time, wherein the workload taxon comprises access requests carrying out a particular workload, wherein the application taxon comprises access requests associated with a same single application and wherein the process taxon comprises access requests associated with a particular process being carried out as part of the application. receiving data storage access requests made to different data storage devices across a network; assigning a subset of the access requests to a taxon of a taxonomy of access request characteristics; for the taxon, determining a taxon threshold for a parameter based upon the subset of the access requests; comparing the parameter of a sample of observed access requests, made to a data storage device and belonging to the taxon, to the taxon threshold; and outputting a notification regarding the data storage device based upon the comparison; where the taxon is selected from a group of taxons consisting of: population, community, activity, session, workload, application and process, wherein the population taxon comprises requests made to a same type of storage device, wherein the community taxon comprises access requests made to storage devices that are participating in a same type of activity, wherein the activity taxon comprises access requests that are executing same type of sessions, wherein the session taxon comprises access requests that are performed during same ranges of time, wherein the workload taxon comprises access requests carrying out a particular workload, wherein the application taxon comprises access requests associated with a same single application and wherein the process taxon comprises access requests associated with a particular process being carried out as part of the application. population, community, activity, session, workload, application and process, wherein the population taxon comprises requests made to a same type of storage device, wherein the community taxon comprises access requests made to storage devices that are participating in a same type of activity, wherein the activity taxon comprises access requests that are executing same type of sessions, wherein the session taxon comprises access requests that are performed during same ranges of time, wherein the workload taxon comprises access requests carrying out a particular workload, wherein the application taxon comprises access requests associated with a same single application and wherein the process taxon comprises access requests associated with a particular process being carried out as part of the application.