Check types

Choose checks for the subject you want to monitor: a service, network path, device, site, host, cluster or real browser visits. The catalog below covers the types available in Test Management. Installed agent capabilities determine which types can execute on each placement.

Combining checks

Compatibility follows the monitoring subject, not simply whether a check has a remote target. Every selected pair must be compatible.

• HTTP, API Flow and synthetic Browser can share a web test with DNS, TCP Connect, Path Health and Path MTU. SSH has its own service subject and supports those network diagnostics too.
• NTP, SNMP and each newer service type support DNS, Path Health and Path MTU companions. Unrelated services, such as Database and Email, need separate tests. TCP Connect is not a companion for every service type.
• DHCP, ARP, LLDP, WiFi and Bluetooth LE describe the local site and can combine. Host Metrics, Containers, eBPF Host and eBPF Flow describe the host and can combine with each other. Site and host subjects stay separate.
• Custom Script can extend these subjects or run alone, but cannot make two otherwise incompatible checks compatible.
• Remote Host Metrics measures a Linux target over SSH from one specific source agent. It supports SSH and compatible network diagnostics to that target; local Host Metrics and Containers describe a different host.
• Kubernetes, SNMP Discovery and Multi-agent each run as their own test. Real user has its own subject and does not combine with synthetic checks or scripts.

The wizard disables incompatible choices and explains why. SNMP can have its supported companions, but only one SNMP poll belongs in a test; add custom OIDs to that poll’s configuration.

Remote target

Path Health

Scheduled path discovery with continuous per-hop loss, RTT, and confidence scoring. The portal starts new checks with a 60s discovery interval, a 30s cycle timeout, and a requirement for TCP with full flow control.

Stable flows support route-change comparisons, while a rotating explorer samples other branches. On supported UDP and ICMP transports, discovery can overlap hop waits; TCP stays sequential within each flow. A route fingerprint and before/after events preserve topology changes alongside health history.

Path Health helps narrow down where a problem may lie. A silent router alone does not prove forwarding loss or identify the point of failure; read the downstream evidence, destination checks, and confidence alongside it.

Run it continuously against things you depend on. A traceroute run after the complaint is a snapshot of the present with nothing to compare against; the value is entirely in having the previous ten thousand.

See Path Health settings and measurement behavior for discovery defaults, hop_window, protocol limits, and interpreting gaps.

HTTP

Request timing, status, TLS certificate and assertions. Default interval 60s, timeout 15s.

The timing is broken out by phase (name resolution, TCP handshake, TLS handshake, time to first byte) which is the reason to use this rather than a simple availability probe. Those phases fail for different reasons and are fixed by different teams, and a single “response time” number makes them indistinguishable.

Certificate expiry is recorded on every pass, so it is a measurement with history rather than an alarm that surprises you once.

New HTTP checks start with editable Accept: */* and Accept-Encoding: gzip headers. Existing checks retain their saved headers. Add common header offers presets; header names and values suggest common choices while allowing custom entries. The agent calculates request length and connection headers.

Request bodies are available for POST, PUT, PATCH and DELETE. Switching to GET, HEAD or OPTIONS removes the body. Expected status accepts multiple codes; no selection accepts any 2xx. Search by code or description, or enter a custom code from 100 to 599. Browser checks and API-flow steps use the same selector.

Compressed response sizes count the bytes received. Body text assertions read the encoded body, so use Accept-Encoding: identity for text matching on servers that support uncompressed responses. Choose an Authentication secret to send a saved credential in the Secret header (Authorization by default). The secret must contain the complete header value, including Bearer when needed. See secrets and grants for agent access.

API Flow

An ordered multi-step HTTP flow with variable extraction between steps. Default interval 300s, timeout 60s.

For when the thing you need to know is whether a sequence works: authenticate, take the token, call the endpoint that needs it, check what comes back. A single request against a login page does not tell you the login works.

Each step has the same header suggestions, presets, method-aware body controls and status selector as HTTP. Changing Body encoding also sets the matching Content-Type header, which remains editable. Compression is not added by default: JSON extraction and body assertions need an uncompressed response. API flows use agent-local secrets; shared secret delivery is not supported for this type.

DNS

Query timing, answers and resolver behaviour over UDP, TCP, DoT or DoH. Default interval 60s, timeout 10s.

Recording the answer and not only the timing is what separates slow from wrong. A resolver returning a stale record quickly looks perfectly healthy on a latency graph, and is one of the more painful outages to diagnose without this.

Pointed at a named resolver, the check needs an explicit address family. Pointed at the platform’s own resolver it must not have one, because the family of packets the agent never sends is meaningless.

TCP Connect

Connect timing to a host and port. Default interval 30s, timeout 10s.

The cheapest way to answer “is the port open and how long does it take”, useful for services with no meaningful protocol-level check and as a fast tripwire alongside heavier checks.

SSH

Handshake phases, host-key verification, and optional command execution. Default interval 60s, timeout 15s.

The host-key check is the interesting part: a key that changes when nobody rebuilt the host is worth knowing about immediately. Skipping host-key verification requires a flag on the agent binary and cannot be turned on from the portal, see grants.

Path MTU

Path MTU discovery and black-hole detection. Default interval 300s, timeout 60s.

MTU black holes produce one of the worst failure signatures in networking: small packets work, so everything looks up, while anything substantial hangs. Ping succeeds and the file transfer stalls forever. This check finds that condition deliberately rather than leaving you to infer it.

NTP

Offset, round-trip delay and stratum against one time server. Default interval 300s, timeout 3s.

Clock drift breaks certificate validation, Kerberos and every log correlation you will attempt during an incident. It is cheap to measure and expensive to discover late.

Browser

Real-browser page load timing and web vitals. Default interval 300s, timeout 60s.

Loads the page in an actual browser, so you measure what a person experiences rather than what an HTTP request experiences, render-blocking resources, third-party scripts and client-side work all count. This requires the browser plugin on the agent host, which the agent download wizard can set up for you: choose “Use local browser” to drive whatever Chrome, Chromium, or Edge is already installed, or “Auto-download Chromium” to fetch and cache a pinned build the first time no local browser is found.

Service protocols

These checks have dedicated configuration in the service checks guide:

• Database (database_check): PostgreSQL, MySQL, SQL Server, Oracle, MongoDB and Redis connection/authentication plus optional bounded read assertions.
• SIP (sip_check): OPTIONS, registration and synthetic call setup/teardown.
• Throughput (throughput_check): rate- and byte-bounded HTTP/TCP/UDP goodput against an authenticated RouteSpear responder.
• RTP / voice transport (rtp_check): bidirectional synthetic loss, jitter, duplication and reordering; no speech recording or MOS estimate.
• gRPC health (grpc_check): standard health RPC requiring SERVING.
• WebSocket (websocket_check): handshake and ping/pong or exact text reply.
• Email (email_check): SMTP, IMAP or synthetic delivery round trip.
• LDAP / Active Directory (ldap_check): bind and optional bounded search.
• RADIUS (radius_check): authenticated PAP request over RadSec TLS or UDP.
• MQTT (mqtt_check): broker connectivity or publish/subscribe round trip.
• File services (file_check): SFTP/SMB metadata, bounded read or temporary-file write/read verification.

Local site and host

These need no target. They measure the network the agent is plugged into, which is often where the problem actually is.

DHCP

Discover and offer, and optionally a full lease, on the agent’s local link. Default interval 300s, timeout 15s.

An exhausted or misconfigured DHCP scope presents to a help desk as “the laptops in that office cannot get on the network”, usually on the busiest morning of the term or the quarter. This measures it before anyone rings.

The full-lease mode takes a real address out of the pool on every execution and releases it immediately, so it requires an explicit grant on the agent.

ARP Scan

Pings configured subnets and reads the operating system’s neighbour table to find responding hosts, new and departed devices, and gateway MAC changes. Default interval 300s, timeout 15s.

The gateway MAC change is the one to care about. It means the default gateway is now a different physical device than it was, which is either a failover you should know about or something considerably worse.

LLDP Listen

Passively listens for LLDP announcements on one local interface to learn the identity of the directly-connected switch. Linux only. Default interval 300s.

This answers “which switch port is this actually plugged into”, which is otherwise a question involving a cable, a torch and somebody in a comms room. It is an event source rather than a scheduled poll, so its schedule fields are not used for anything.

WiFi Scan

Active scan of every visible access point’s BSSID, SSID, signal strength and channel. Default interval 60s, timeout 10s.

Two uses. It shows what the wireless environment looks like from where the users are, coverage gaps, channel overlap, a neighbouring network sitting on top of yours. It also feeds positioning, so agents can be placed on floor plans. See wireless and access points and floor plans and positioning.

Bluetooth LE Scan

Passive listen for Bluetooth LE advertisements, recording identifiable beacons’ signal strength and counting every advertiser heard. Linux and Windows only. Default interval 60s, timeout 10s.

The beacon signal sharpens positioning. The raw count of advertisers is a proxy for 2.4 GHz congestion, which is a common and under-diagnosed cause of wireless complaints in dense environments.

eBPF Flow

Passively aggregates this host’s TCP behaviour per remote peer inside the kernel (retransmits, resets, failed connects and smoothed RTT) without sending any traffic at all. Linux only, and needs CAP_BPF plus CAP_PERFMON. Default interval 60s, timeout 10s.

This measures the traffic the host is really sending rather than synthetic probes, which makes it the answer to the standing objection that probe traffic is not representative. If real connections to one peer are retransmitting, this sees it, whether or not you thought to configure a test for that peer. See passive network flows for peer and process investigation, kernel drops, queue delay, and collection limits.

Host Metrics

Samples this host’s CPU, memory, filesystems, interface I/O and top processes. Linux, Windows and macOS, with no extra privilege. Default interval 60s, timeout 10s.

This is the host-health counterpart to Path Health: when a check starts timing out, these numbers say whether the agent host itself is the reason (CPU saturated, a disk full, RAM reclaiming) rather than the network it was asked to measure. Samples include per-disk, per-interface and per-process detail. Host-wide metrics and typed process/interface sources are available to queries, dashboard series and health rules. Configure Processes to monitor with exact executable names when you need coverage beyond the changing top-process list; missing or incomplete coverage must not be read as a stopped service.

See host and kernel diagnostics for resource investigation and process coverage. Command lines are not collected. Process names, CPU and RSS are enough to see what is on fire, and command lines routinely carry secrets.

Remote Host Metrics

Collects a remote Linux host’s CPU, memory, filesystems, interfaces, processes, disk I/O, uptime and selected service states over verified SSH. Choose it under Host / workloads. No Python or persistent collector is installed on the target; collection uses standard shell tools and /proc and /sys.

Select exactly one source agent, a password or private-key secret, and the server’s host-key fingerprint. The remote host appears as its own machine in Infrastructure. Default interval 60s, timeout 10s; minimum interval 30s, maximum timeout 30s. See Remote Host Metrics for setup, secret grants, available measurements and troubleshooting.

eBPF Host

Linux kernel measurements of scheduler run-queue latency, block I/O latency, softirq hold time, process churn and OOM kills. Like eBPF Flow, it needs CAP_BPF and CAP_PERFMON. Default interval 60s, timeout 10s. It complements Host Metrics with latency distributions rather than only periodic snapshots. See host and kernel diagnostics.

Containers

Per-container CPU, memory and I/O, plus restarts and OOM information where the source supplies them. Default interval 60s, timeout 10s. Linux reads cgroups directly and obtains identities from reachable container runtimes or kubelet; a containerized agent needs the host cgroup filesystem mounted to see other containers. Windows and macOS use Docker Engine, without restart/OOM counters. Counter-derived rates need two samples; an initial missing rate is not zero. See containers and Kubernetes for setup, workload grouping, platform differences, and troubleshooting.

Device and standalone subjects

SNMP

Polls a device for the standard MIB-II and host-resources set plus up to 50 operator-defined OIDs. Default interval 60s, timeout 5s.

Interface counters, errors, discards, CPU and memory from network devices. Compare these observations with Path Health to investigate whether interface pressure coincides with an affected path. Preserve device identity and poll times: a discard counter alone does not establish loss for a particular probe flow.

See network devices and SNMP for discovery, interfaces, bridge tables, hardware and device-specific sections, and how to compare device counters with path evidence.

SNMP Discovery

Sweeps configured IPv4 subnets for devices answering SNMP with the configured credential, and keeps one SNMP check per responding device in sync automatically as devices appear and disappear. Default interval 300s, timeout 15s.

Discovery interval controls how often the subnets are scanned. Device polling interval controls how often the automatically created SNMP checks poll each device (default and minimum 1 minute). Set both in the discovery settings. Changing device polling updates existing discovered checks as well as new ones on the next sync with a fresh sweep, preserving their history.

Agents with immediate-start support run a newly loaded discovery or device check as soon as scheduler capacity permits, then use its configured interval. A device appears in Infrastructure after discovery sync, its first SNMP poll, and inventory processing; these stages can still take a few minutes.

Use this rather than enumerating devices by hand. Hand-maintained inventories are wrong within a quarter, and the device nobody added to the list is reliably the one that fails.

Kubernetes

Cluster-wide pod phases, workload replicas, unschedulable pods, restarts and node conditions from the Kubernetes API. Default interval 60s, timeout 15s. Requires the Kubernetes plugin and read-only cluster permissions. Assign exactly one collector agent to avoid reporting the same cluster facts twice. Keep this separate from node-local Containers and Host Metrics checks.

Multi-agent mesh

Path health between two to five of your agents, in every direction. Default interval 60s, timeout 30s. See multi-agent mesh.

User Browser Sessions

Endpoint browser sessions, page timings and resource waterfalls for configured domains. This event source requires the native connector and browser extension; it does not generate visits or run on a polling schedule. See User Browser Sessions for installation, domain patterns and collection boundaries.

Custom

Custom Script

Runs a command on the agent and parses metrics from its output. Default interval 60s, timeout 30s.

Choose inline JavaScript using the bundled engine, inline Python/Node.js/Bash/ PowerShell using an installed interpreter, or an operator-signed bundle already on the host. Inline source and a bundle cannot be supplied together. Each mode requires its corresponding local execution grant. Script arguments are configuration; use agent-local credential references for secrets. Shared tenant secret delivery does not support scripts.

This is the escape hatch, and it is a real one: whatever you can script reports through the same pipeline into the same store, with the same retention, dashboards and trust qualifiers as everything else. There is no second-class custom-metrics system bolted on the side.

Script execution requires a grant on the agent binary. A served configuration cannot enable it, which is what stops a compromised control plane turning your fleet into a remote execution service.

Log signals

Local log sources can produce Log Beacon signals and bounded numeric extractions through log_watch. Configure them under Configure → Log ingest rules. These rules create the log checks; log_watch is not selected as a standalone test type. SSH log rules collect incident evidence only. Raw text is uploaded only as bounded incident excerpts. See log ingest rules.

Checks that need a grant

Some capabilities are decided on the agent host by whoever administers it, and cannot be switched on from the portal:

Capability	Why it is agent-local
Skipping TLS verification	Turns a check that validates trust into one that does not
Skipping SSH host-key verification	Same, for host identity
DHCP full lease	Consumes a real address from the pool on every run
Browser plugin	Runs a full browser on the host
Script execution	Runs arbitrary commands on the host

This is a deliberate boundary rather than an inconvenience. The control plane can ask an agent to measure things; it cannot ask it to do anything else. See the CLI reference for the flags.

Platform availability

Not every check runs everywhere. eBPF Flow and LLDP Listen are Linux only, Bluetooth LE Scan is Linux and Windows, and WiFi Scan depends on the host’s wireless stack. Host Metrics runs on Linux, Windows and macOS. The agent grades its own abilities and reports what it cannot do, with the reason, see capabilities.

Next

• Multi-agent mesh
• Reading results
• The trust model

Configure complex checks deliberately

API Flow

Build the flow in execution order. Verify each request’s method and target, then check that extracted variables are available before a later step uses them. Keep authentication values out of labels and test names.

Custom scripts

Choose the language and delivery mode first. The editor scrolls within its own area; the wizard’s navigation and actions remain outside the form body. Review output formatting and agent capabilities before enabling the check.

Use the Custom Script SDK reference for exact imports, metric helpers, JSON arguments, run context and credential references. Ask Spear beside the script editor opens coding assistance for the current draft.

SNMP and mesh

For SNMP, confirm the protocol version and credential fields before adding custom OIDs. For mesh, identify every member and verify its address family and any required address override. These standalone check groups have different placement requirements from remote-target checks.

Return to creating a test for compatibility and placement rules.