Uptime

Your clouds already have uptime checks: Route 53 health checks, CloudWatch Synthetics canaries, Google Cloud Monitoring uptime checks and Application Insights availability tests. AssetHermit reads them asmonitors, beside the endpoints they watch, with no new setup and no traffic of ours to your endpoints. It's included in the Starter, Team and Enterprise plans.

Monitors

Each sync collects your checks as assets. Every 5 minutes, AssetHermit reads their results with the access your asset source already has, and follows each cloud's own verdict on whether the target is down.

A monitor with no result for 30 minutes (or three of its own intervals, if longer) shows as unknown, never as up. A disabled check shows as paused. Each monitor shows its last 24 hours, its uptime over 30 days and its outages.

Reading CloudWatch metrics isn't free: AWS bills GetMetricData per metric read, to your account. Each AWS monitor reads two metrics every 5 minutes, about 17,000 a month, which is about $0.17 a month per monitor at AWS's list price of $0.01 per 1,000 metrics. Google Cloud and Azure bill their reads past free units your billing account gets each month. Each asset source's Uptime tab shows what its reads cost a month, so you know before the bill does.

Which endpoints are watched

The Uptime page's Coverage tab lists your public endpoints: internet-facing load balancers, CloudFront distributions, API Gateway APIs, Cloud Run services open to the internet, external forwarding rules, App Service apps with public access, and Front Door and CDN endpoints. Each answers to its own names and to the Route 53 and Cloud DNS records that point at it. An endpoint is watched when a monitor's target names one of them, or when it's the origin of a watched CloudFront distribution or Front Door, and unwatched otherwise.

In search, $monitored:false finds the unwatched endpoints and $monitored:true the watched ones, so $monitored:false $environment:production lists production endpoints nobody watches.

Each unwatched endpoint is also a low-severity finding, "Public endpoint has no uptime check", with a guide to the commands that create a check in its cloud. If you watch your endpoints with another tool, accept the findings with a finding exception.

Outages

An outage lasts from the first result that says down to the first that says up. Its page shows what happened in the 6 hours before it: changes to the endpoint and the resources around it, with who made them and whether by hand, provider health events in its region, usage anomalies and findings opened.

An outage raises the Endpoint down alert, which resolves itself when the endpoint answers again. It's critical, so it reaches workspace admins by email at once, without waiting to be batched, and goes to the Slack channels you route the Uptime category to. When a monitor's results can't be read, admins get an alert saying why. See Notifications.

Probes of our own

Where your clouds have no check, AssetHermit can check an endpoint itself, from probes in Stockholm, Dublin and N. Virginia. A workspace admin creates a probe monitor from the Uptime page, an unwatched endpoint or an asset's Uptime tab:

• Kinds: HTTP(S), TCP port, TLS certificate and DNS name. An HTTP check sends GET or HEAD, follows one redirect within the same domain, checks the status and, if you give one, a keyword in the first 64 KB of the body.
• From two or three locations, every 5 or 15 minutes. An outage needs failures from the number of locations you choose (two by default); when one location fails alone, another is asked at once.
• Slow and certificates: a monitor with a latency threshold turns slow after 3 slow checks in a row, and you're told 14 days before a certificate expires.
• Only what's yours. A probe reaches a host that's one of your workspace's public endpoints or addresses, or that proves it's yours with a DNS TXT record, _assethermit-uptime.<host>, holding the value the form gives you. Ownership is checked again every day; a monitor whose target stops being yours pauses. Probes never reach private addresses.
• Nothing secret. Probes send no credentials, cookies or headers of yours, identify themselves as AssetHermit-Uptime/1 (+https://assethermit.com/docs/uptime), and keep no response: only whether each check passed, why not and how fast, kept 7 days.
• Fixed addresses. Each probe location sends from one address, listed below, on the Uptime page and on your workspace's Network card, so you can allow them.
• Up to 10 probe monitors per workspace while in beta; ask for more from the Uptime page.