Monitor Types
Every kind of check you can create, grouped the way the type picker groups them, and the settings all monitors share.
To create a monitor, click New on the Monitors page and open Monitor type. The picker has a search box, so typing ssl or port finds the type quickly. Entries marked SOON cannot be selected yet.
Website & availability
| Type | What it checks |
|---|---|
| Website monitor | That your site answers over HTTP with a healthy response. See Websites & Keywords. |
| Keyword monitor | That a word or phrase appears on a page — or that it has disappeared. See Websites & Keywords. |
| Ping monitor | That a host answers ICMP ping requests. See Ping. |
| Port monitor | That a TCP or UDP port is open and accepting connections. See Ports. |
| Broken links monitor | Crawls the pages reachable from a URL and reports links that return 4xx or 5xx errors. See Broken Links. |
Security & certificates
| Type | What it checks |
|---|---|
| SSL certificate monitor | Certificate expiry, chain problems and certificate health. See SSL Certificates. |
| Domain expiry monitor | The domain's WHOIS record, for its expiry date and registrar changes. See Domains. |
| DNS records monitor | Queries DNS and alerts when records differ from the values you expect. Pick the resolver and check propagation across public resolvers. See Domains. |
| Security scan monitor | Scans a site for common problems: missing security headers, insecure cookies, mixed content, exposed files such as .env and, in a full scan, injection flaws such as reflected XSS. See Security Scans. |
| IP reputation monitor | Whether your server's IP address is listed on blacklist or spam-list providers. See IP Reputation. |
Application & APIs
| Type | What it checks |
|---|---|
| API endpoint monitor | Sends a request to a REST or GraphQL endpoint and checks the status code, response time and body. See API Checks. |
| API workflow monitor | Chains several API calls and checks the whole flow end to end. See API Checks. |
| Log monitor | Watches the logs you send to Zharp and alerts when one of your patterns appears. See Log Monitors. |
| User journey monitor | Runs a browser script that walks through a real flow — signing in, checking out, searching — and fails when a step does. See User Journeys. |
| Application monitor | Watches response time, error rate or throughput from the traces your application sends. Nothing is probed from outside. See Application Monitors. |
Infrastructure & services
| Type | What it checks |
|---|---|
| Database monitor | Connects to a database and runs a health check. See Private Databases. |
| Cron job monitor | Waits for your scheduled job to ping Zharp, and alerts when a ping is late. See Cron Jobs & Heartbeats. |
| SMTP mail monitor | Connects to your SMTP server and checks that it can accept mail. See Mail Servers. |
| IMAP mail monitor | Connects to IMAP and checks sign-in and mailbox access. See Mail Servers. |
| POP3 mail monitor | Connects to POP3 and checks sign-in and message access. See Mail Servers. |
Database engines
Database monitor is one entry for every engine. You pick the engine in the form, or paste a connection string and Zharp reads the engine from its scheme.
| Engine | Default port | Connection string starts with |
|---|---|---|
| PostgreSQL | 5432 | postgresql:// |
| MySQL / MariaDB | 3306 | mysql:// |
| MongoDB | 27017 | mongodb:// |
| Redis | 6379 | redis:// |
Set Connection to Public to connect directly over the internet, or Private to check a database through a Zharp agent installed next to it.
Custom
Custom monitor is for anything the other types do not cover. Zharp either polls an endpoint you give it (pull) or waits for you to send it data (push), and you write trigger rules — with a condition builder or a script — that decide when to raise an alert or mark the monitor down. See Custom Monitors.
Settings every monitor has
The type-specific fields sit in the first section of the form. The settings below are common to every type. Most are under Advanced settings, which is collapsed until you click it.
| Setting | Where | Values |
|---|---|---|
| Check frequency | Advanced settings | 30 seconds, 1, 2, 3, 5, 10 or 30 minutes. Default: 3 minutes. |
| Regions | Advanced settings | Europe, North America, Asia, Australia — any combination, at least one. Default: all four. |
| Pronounceable monitor name | Advanced settings | Any text. If left empty, the URL or host is used. |
| Confirmation period | Advanced settings | How long failures must last before the monitor goes down. Default: 0 (immediately). |
| Recovery period | Advanced settings | How long a down monitor must pass before it is up again and the incident closes. Default: 1 minute. |
| How should we escalate incidents? | Its own section | Notify the on-duty member (default) or Escalation policy. |
A Cron job monitor does not use Check frequency: it follows the Expected schedule in its own Cron settings. A Custom monitor in push mode does not poll, so the field is disabled.
Confirmation and recovery periods
A monitor goes down when more than half of its regions fail. With a Confirmation period, that has to keep being true for the whole period first: while it runs the monitor keeps its current status, no incident opens and nobody is alerted, and Zharp checks again as the period ends rather than waiting for the next scheduled check. A check that passes in between starts the period over.
The Recovery period works the same way in the other direction: a down monitor only goes back up, and its incident only closes, once checks have passed for that long.
A single failing region while the others pass is a partial outage: shown on the monitor page as soon as it is seen, never alerted. The confirmation period applies to the monitor going down.
Timeouts
Each check gives up after its timeout and counts as failed. Websites, keyword and API monitors use Request timeout (Max response time for API monitors); a Ping monitor uses the Timeout in ICMP settings, a Port monitor the Connection timeout in Connection settings, and the mail monitors the Timeout in their own Connection settings. Timeouts are between 1 and 60 seconds.
Ping and port settings
A Ping monitor's ICMP settings and a Port monitor's Connection settings apply in every region:
| Setting | Default | What the check does |
|---|---|---|
| Packet count | 4 packets | Echo requests sent per check (1 to 10). The check passes when at least one is answered; the packet loss is shown on the monitor page. |
| TTL (Time to Live) | 64 hops | The packets' time to live (1 to 255). A host further away than this many hops doesn't answer, and the check fails. |
| Packet size | 56 bytes | The ICMP payload per packet (16 to 1,472 bytes). |
| Retry attempts | 2 retries | When a connection attempt fails, try again up to this many times, a second apart, before the check fails. A monitor saved without the setting doesn't retry. |
| Expect data on connect | No | Yes: the port only counts as up once the server sends something, such as an SMTP or SSH banner, before the timeout. For UDP, a reply is required. |
| Verify TLS handshake | Auto-detect | Complete a TLS handshake after connecting: Auto-detect does it on well-known TLS ports (443, 465, 636, 853, 990, 993, 995, 5061, 8443 and others), Always on any port, Never not at all. A failed handshake fails the check; an untrusted certificate doesn't. TCP only. |
Testing before you save
A test run — Run Script for a workflow, or the API's POST /api/v1/monitors/test-connection — builds its check from the form exactly as the scheduled check will, so every setting above counts — a user journey's test run included, which uses its browser settings. A test crawl of a broken-links monitor is limited to one level and 30 seconds, and a security scan to 30 seconds, so the answer comes back in time.
Notify the on-duty member
The person on shift in your primary on-call schedule is alerted, once. With no schedule, or nobody on shift, the monitor's “is DOWN” alert is all that goes out. Under How should we notify the on-duty member? choose any of:
- E-mail — ticked by default.
- Push notification
- Slack alert — posts to a Slack connection, which you pick under Send Slack alerts through.
Call and SMS are shown but cannot be selected yet. Under If the on-duty member doesn't acknowledge the incident:
| Option | What happens |
|---|---|
| Do nothing | Nothing more happens after the first alert. This is the default. |
| Escalate to the team | If nobody acknowledges within 5 minutes, everyone in the workspace is alerted the same way. |
| Repeat the notification | The on-duty member is alerted again every 5 minutes until someone acknowledges, up to 6 times. |
Escalation policy
Pick an existing policy from the list, or choose + Create new policy to build one in place; it is saved when you create the monitor. See Escalation & On-call.
Maintenance
The Maintenance section of the form sets a recurring quiet period for this monitor alone: pick the start and end time under Maintenance window between, the timezone they are in, and the days it applies to (Monday to Friday by default). The window starts at that time on each selected day; if the end time is earlier than the start, it runs past midnight and ends the next morning. Leave both times the same to have no window. Saving the monitor replaces its window, and the window keeps following local time in its timezone when clocks change.
For a one-off window, or one that covers several monitors, schedule it from Maintenance in the sidebar and add the monitors under Affected services — see Core Concepts. Those windows are kept when you edit a monitor. While any window covering the monitor is in progress, the monitor shows Maintenance and no incidents or alerts are raised.
Metadata
Under Metadata you can attach key/value pairs to the monitor. They are copied onto its incidents, used by metadata rules in escalation policies, and can be inserted into alert messages as placeholders such as {server_region}. Editing the monitor keeps them.
What an edit keeps
Saving the form changes only the settings it shows. Tags, a muted alert, the time stats were reset, settings written through the API and the state the checks keep for themselves stay as they were. A field you clear in the form is removed from the monitor.
Editing a paused monitor
Saving the form keeps the monitor as it was: a paused monitor stays paused and a running one keeps running. Use Pause or Resume on the monitor page to change that.
From the monitor page
The … menu at the top of a monitor's page has these actions as well as edit, pause and delete:
| Action | What it does |
|---|---|
| Add / Remove tags | Labels the monitor. Tags show under its name and you can filter the monitor list by them. |
| Add to status page | Tick the status pages that should show the monitor; unticking removes it. On a page laid out in sections it is added to the last section. |
| Clone monitor | Creates a copy named <name> (copy) with the same settings, alerting, regions, group, tags and maintenance window, and opens it for editing. A cron or push monitor's copy gets its own ping URL. Check history is not copied. |
| Move to Group | Moves the monitor into one of your groups, or out of all of them with No group. |
| Reset stats | After you confirm, clears the monitor's check history, response times and uptime figures so they start again from now. Past incidents stay in the incident list but no longer count towards its uptime and downtime. |
Deeper guides
Status codes, keywords, headers and authentication.
apiSingle endpoints and multi-step workflows.
verified_userExpiry warnings and certificate problems.
domainRegistration expiry and registrar changes.
schedulePing URLs, schedules and grace periods.
databasePostgreSQL, MySQL, MongoDB and Redis, public or through the agent.
searchAlert on patterns in the logs you stream to Zharp.
routeBrowser scripts that walk through a real flow.
speedResponse time, error rate and throughput from your traces.
network_pingICMP reachability, latency and packet loss.
lanTCP and UDP ports, banners and TLS handshakes.
mailSMTP, IMAP and POP3.
link_offCrawl a site for links that fail.
securityHeaders, exposed files and injection probes.
blockBlacklist and spam-list listings for your IPs.
tunePull or push data and write your own trigger rules.