Skip to content
StatusCheck Docs
Join the waitlist

Monitors

TCP, DNS, ICMP & SSL monitors

Network-level checks for ports, name resolution, reachability, and certificates.

Not everything speaks HTTP. These four monitor types verify the layers underneath.

TCP

Section titled “TCP”

A TCP monitor opens a connection to host:port from each region and records how long the connect took. A successful connect means the port is open and something is listening; nothing is sent after the handshake.

Options: hostname or IP, port (required), timeout.

Failure reasons: Connection refused (the host answered but nothing is listening), Timeout (nothing answered, usually a firewall or a dead host), Name not resolved.

Use TCP monitors for databases, message brokers, SMTP/IMAP servers, SSH, and any service where “the port is open” is the meaningful signal.

DNS

Section titled “DNS”

A DNS monitor queries a record for a name and, optionally, asserts on the answer. It catches expired domains, botched migrations, and hijacked records: the outages that make every other monitor fail at once.

Options:

  • Record type: A (default), AAAA, CNAME, MX, NS, TXT, SRV, PTR.
  • Resolver: by default each region uses its own system resolver, which is what most of your users experience. Set a specific resolver (for example 1.1.1.1 or your authoritative nameserver) to check what the source of truth says instead.
  • Expected answer: an assertion on the answers returned. For A and AAAA records the expected set is matched regardless of order; for other record types the check passes if any answer contains the expected string.

Failure reasons: Name not resolved, DNS mismatch (answers didn’t match Expected answer), Timeout.

The resolution time is recorded for every check, so you can spot a slow authoritative server before it becomes a problem.

ICMP (ping)

Section titled “ICMP (ping)”

An ICMP monitor sends echo requests to a host and records packet loss and round-trip time (minimum, average, maximum).

Options: hostname or IP, number of packets per check (default 3, maximum 20), timeout, and a maximum acceptable packet loss percentage.

Failure reasons: Timeout (no replies at all), Packet loss exceeded (some replies, but loss over your threshold), Name not resolved.

Ping is the right tool for servers, routers, and links. It is the wrong tool for web applications: a host can answer pings perfectly while the application on it is down. Prefer HTTP monitors for anything that serves users.

SSL

Section titled “SSL”

An SSL monitor completes a TLS handshake with host:port (port 443 by default) and inspects the certificate it receives. Unlike HTTP monitors, which only note the expiry date, an SSL monitor checks the whole certificate story.

A check passes only if the certificate is trusted by a standard root store, not expired, matches the hostname, and the server presented a complete chain. Each check also records the issuer, subject alternative names, validity dates, days until expiry, TLS version, signature algorithm, and SHA-256 fingerprint.

Options: hostname, port, and expiry warning threshold in days (default 30).

Problems reported: expired, self-signed, incomplete chain, hostname mismatch, untrusted. A certificate without a Common Name is noted but does not fail the check, because SAN-only certificates are valid.

When a certificate enters its expiry warning window the monitor turns Degraded and StatusCheck sends a warning to the monitor’s channels. It turns Down the moment the certificate expires. Renewing the certificate clears both automatically on the next check.