[{"data":1,"prerenderedAt":235},["ShallowReactive",2],{"docs-\u002Fdocs\u002Finverted-monitoring":3},{"id":4,"title":5,"body":6,"description":227,"extension":228,"meta":229,"navigation":230,"path":231,"seo":232,"stem":233,"__hash__":234},"docs\u002Fdocs\u002F25.inverted-monitoring.md","Inverted checks",{"type":7,"value":8,"toc":216},"minimark",[9,13,22,27,60,64,82,95,99,158,166,170,190,194,197,201,204,208],[10,11,5],"h1",{"id":12},"inverted-checks",[14,15,16,17,21],"p",{},"Most monitoring answers \"is it up?\". An inverted check answers the opposite question: ",[18,19,20],"strong",{},"is this thing still safely unreachable?"," The monitor is healthy while the target is down, and alerts fire the moment it starts responding.",[23,24,26],"h2",{"id":25},"when-to-use-it","When to use it",[28,29,30,37,48,54],"ul",{},[31,32,33,36],"li",{},[18,34,35],{},"Internal services that must never face the internet"," - admin panels, Kubernetes dashboards, staging environments. If your firewall rule is dropped in a config change, an inverted check pages you before a scanner finds it.",[31,38,39,42,43,47],{},[18,40,41],{},"Database and infrastructure ports"," - Postgres, Redis, SSH on machines that shouldn't expose them. A Port (TCP) inverted check on ",[44,45,46],"code",{},"db.example.com:5432"," is a standing \"this port is closed\" assertion.",[31,49,50,53],{},[18,51,52],{},"Decommissioned endpoints"," - retired APIs and old domains should stay retired. Catch a zombie service coming back after a bad deploy or a DNS change.",[31,55,56,59],{},[18,57,58],{},"Firewall and ACL regressions"," - any place where \"reachable\" means a security control silently stopped working.",[23,61,63],{"id":62},"enabling-it","Enabling it",[65,66,67,70,76],"ol",{},[31,68,69],{},"Create (or edit) an HTTP(s), Ping, Port, or SMTP monitor",[31,71,72,73],{},"Open ",[18,74,75],{},"Advanced settings",[31,77,78,79],{},"Turn on ",[18,80,81],{},"Inverted check",[14,83,84,85,90,91,94],{},"That's it - the same intervals, regions, and alert policies apply. You can also set it via the ",[86,87,89],"a",{"href":88},"\u002Fdocs\u002Fapi\u002Fintroduction","REST API"," with ",[44,92,93],{},"\"inverted\": true"," on monitor create or update.",[23,96,98],{"id":97},"how-the-logic-flips","How the logic flips",[100,101,102,117],"table",{},[103,104,105],"thead",{},[106,107,108,112,115],"tr",{},[109,110,111],"th",{},"Target behaviour",[109,113,114],{},"Normal monitor",[109,116,81],{},[118,119,120,134,146],"tbody",{},[106,121,122,126,129],{},[123,124,125],"td",{},"Connection fails \u002F times out",[123,127,128],{},"Down - alerts fire",[123,130,131],{},[18,132,133],{},"Up - all is well",[106,135,136,139,142],{},[123,137,138],{},"Responds normally",[123,140,141],{},"Up",[123,143,144],{},[18,145,128],{},[106,147,148,151,154],{},[123,149,150],{},"Responds slowly or with an error page",[123,152,153],{},"Up or degraded",[123,155,156],{},[18,157,128],{},[14,159,160,161,165],{},"Note the last row: ",[162,163,164],"em",{},"any"," successful response counts as exposure, even a 500 error or a response slower than your degraded threshold. If the target answered at all, it's reachable - which is exactly what an inverted check exists to catch.",[23,167,169],{"id":168},"reading-the-results","Reading the results",[28,171,172,178,184],{},[31,173,174,177],{},[18,175,176],{},"Uptime %"," means \"percentage of time the target stayed unreachable\" - 100% is what you want.",[31,179,180,183],{},[18,181,182],{},"Alerts and incidents"," use the standard wording: the monitor goes \"down\" when the target becomes reachable and \"recovers\" when it stops responding. Semantically correct, just inverted.",[31,185,186,189],{},[18,187,188],{},"Response times"," are recorded only when the target responds - i.e. during incidents.",[23,191,193],{"id":192},"status-page-caution","Status page caution",[14,195,196],{},"Think twice before putting inverted checks on a public status page. Visitors read \"Operational\" as \"the service works\" - for an inverted check it means \"safely unreachable\", which can confuse anyone who doesn't know the monitor's purpose. Keep them on private status pages, or off status pages entirely.",[23,198,200],{"id":199},"what-inverted-checks-dont-replace","What inverted checks don't replace",[14,202,203],{},"An inverted check probes from Vantaj's regions on your monitor's schedule - it tells you a specific host\u002Fport answered a specific probe. It isn't a port scanner or an attack-surface management tool: it won't discover exposures you didn't think to monitor. Use it as a cheap, always-on regression test for the exposures you already know would hurt.",[23,205,207],{"id":206},"migrating-from-uptime-kuma","Migrating from Uptime Kuma?",[14,209,210,211,215],{},"Kuma's \"upside-down\" monitors import directly as inverted checks - see ",[86,212,214],{"href":213},"\u002Fdocs\u002Fimport-uptime-kuma","Import from Uptime Kuma",".",{"title":217,"searchDepth":218,"depth":218,"links":219},"",2,[220,221,222,223,224,225,226],{"id":25,"depth":218,"text":26},{"id":62,"depth":218,"text":63},{"id":97,"depth":218,"text":98},{"id":168,"depth":218,"text":169},{"id":192,"depth":218,"text":193},{"id":199,"depth":218,"text":200},{"id":206,"depth":218,"text":207},"Exposure monitoring - alert when a target that should stay down becomes reachable","md",{},true,"\u002Fdocs\u002Finverted-monitoring",{"title":5,"description":227},"docs\u002F25.inverted-monitoring","EspYnKFb6hVUIb16Txtj_q7t71Q5oIAuKkLjQnDj1DI",1783639090306]