Sites web, certificats et tests

1. In the address, paste the full URL of the page to monitor.

2. Prefer a light page such as "/health" or "/status" over the home page.

3. If the page needs a login, choose a credential: username and password (basic) or a token (Bearer).

4. Optionally require a keyword in the page or a value in a JSON response, in the options.

À savoir. Never write a password or a token in the options: use the credential field, which is encrypted.

1. In the address, write the host and the port separated by a colon: "nas.home.lan:22", or "[fd00::1]:445" for IPv6.

2. Or leave the port out of the address and fill in the "Port" option.

À savoir. An open port does not prove the application works: for a web service, use the "Website or web API" type.

1. In the address, write the host and the UDP port: "192.168.1.20:5060". The port is required.

2. To check that the service really answers, fill in "Datagram to send" and "Expected reply".

3. Without an expected reply, the check only fails when the host answers that the port is closed.

À savoir. UDP has no connection: without an expected reply, a firewall that silently drops the datagrams looks healthy.

1. In the address, write the name to resolve, without "http://": "www.example.com".

2. Pick another record type in the options if you do not want an IPv4 address (A record).

3. To monitor your own DNS server, enter its IP address in "DNS server to query".

4. To detect hijacking, list the addresses the answer must contain in "Expected values".

À savoir. Give the DNS server by its IP address, not by a name.

1. In the address, write the host name or IP address: "192.168.1.1" or "router.home.lan".

2. Lower "Tolerated loss" in the options to be warned before the loss is total.

À savoir. In Docker, keep the sysctls lines of the shipped docker-compose.yml, or the check cannot send pings.

1. In the address, write the host and the port of the encrypted service: "mail.example.com:993" (443 if omitted).

2. If you reach the service by its IP address, enter the certificate's name in "Server name (SNI)".

3. For a certificate from your own authority, tick "Accept an unverifiable certificate".

À savoir. For a website, the "Website or web API" type already reads the certificate: use this type for services that do not speak HTTP.

1. In the address, write the server's name or IP address: "pool.ntp.org" or "192.168.1.1".

2. Lower "Tolerated offset" in the options to be warned earlier than 100 ms.

À savoir. Keep the DumbMonit host itself in sync: its own drift is added to the measured offset.

1. In the address, write the host name or IP address, with the port if it is not 22: "server.home.lan:2222".

2. To be warned when the server's identity changes, read its fingerprint with ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub.

3. Paste that fingerprint (SHA256:...) in "Expected host key", or tick "Alert when the host key changes" to record it without choosing one.

À savoir. The check never logs in and does not verify the server's signature: it reads the key the server shows, like ssh-keyscan.

1. Check that the server registers the standard health service (grpc.health.v1.Health): most gRPC frameworks have a one-line helper for it.

2. In DumbMonit, enter the server with its port, for example grpc.home.lan:50051.

3. Tick Encrypted connection (TLS) for a server that requires it; the port then defaults to 443.

4. Optional: name a Service, to check its own health instead of the whole server's.

À savoir. The check only sees what the health service reports: a server that always answers SERVING proves nothing about the methods behind it.

1. In DumbMonit, paste the full endpoint, for example wss://home.example.com/api/websocket (wss is assumed without a scheme).

2. Optional: fill in Expected content with a fragment of the first frame the server sends by itself.

3. Optional: if the endpoint says nothing until spoken to, put a message in Frame to send, and what the answer must contain in Expected content.

À savoir. The check hangs up within a second: a connection that a firewall or proxy cuts after thirty seconds looks healthy here.

1. In the address, write a short label for the job, unique among your heartbeats: "nightly-backup".

2. Set the expected interval to the job's schedule ("24h" for a nightly job), or give a cron expression and a time zone, then save the monitor.

3. Copy the URL shown on the monitor page and call it at the end of the job.

   curl -fsS -m 10 --retry 3 https://monit.example.com/api/push/<token>

4. To time the job, call .../start before it, then .../success or .../fail after it, with its output as the request body. Send an exit code as ?exit_code=2 or as .../2.

5. To report a failure at once, append ?status=down&msg=... to the URL.

À savoir. Call the URL at the end of the job, after the part that matters: a call at the top would report a success even when the job fails.

1. Enter the registered domain, for example "example.com", not a name under it such as www.example.com.

2. For an extension the IANA does not list, such as .ch, set "RDAP server" to the registry's address.

   https://rdap.nic.ch/

À savoir. A domain in clientHold or serverHold is taken out of the DNS: every site and mailbox under it stops.

1. Enter a provider name (cloudflare, github, atlassian, aws, discord, npm…; the full list is in the guide), or the address of a Statuspage page or RSS/Atom feed.

2. To watch one part of the provider only, enter its name under Component, for example "Workers" or "EC2".

3. Choose what makes the monitor fail: any degradation, a partial outage or worse, or a major outage only.

À savoir. The monitor reads what the provider chooses to publish, often minutes after the fact: it complements your own checks and never replaces them.

1. In the address, paste the page to check, usually the home page.

2. Optionally fill in "Expected text" with a phrase the page must always show.

3. To add many sites at once, import a CSV file from the monitor list.

À savoir. Only what the server sends is read: for a page drawn by JavaScript, set "Blank page below" to 0.

1. In the address, paste the page to watch, with http:// or https://.

2. To follow a whole site or section, set "Scope" to "site".

3. List lines that change at every visit (a clock, a counter) in "Ignore lines", as regular expressions.

4. For a screenshot of each version, follow the "Screenshots" section of this page.

À savoir. Only the text the server sends is compared: pages drawn by JavaScript or behind a login are not followed.