HTTP Check

The HTTP Check integration requires CXDOT Collector 1.4.0 or greater. Hypertext Transfer Protocol (HTTP) is the application protocol clients use to request resources over the web. Use the HTTP Check CXDOT Collector integration with the CXDOT Collector to collect availability, response time, and certificate expiry metrics from the HTTP and HTTPS endpoints your services depend on. The HTTP Check CXDOT Collector integration supports HTTP and HTTPS URLs.

​

Supported telemetry types

The HTTP Check CXDOT Collector integration supports these telemetry types:

​

Prerequisites

The HTTP Check CXDOT Collector integration has the following prerequisites:

• Make each URL you want to monitor reachable from the CXDOT Collector.

​

Configure

To configure the HTTP Check CXDOT Collector integration, follow these steps:

1. For URLs served by pods or Services in your Kubernetes cluster, add autodiscovery annotations that provide the URL to monitor. The integration is enabled by default, so you don’t need to add an http_check configuration block. For more information, see autodiscovery. Metrics from discovered pods arrive with that pod’s Kubernetes metadata attached. For more information, see enrichment.
2. Optional: Configure static targets to monitor URLs that autodiscovery doesn’t cover, such as an API outside your Kubernetes cluster. For example, add the following to the values.yaml file for your CXDOT Collector Helm chart:
   config:
     integrations:
       http_check:
         endpoints:
           - endpoint: https://api.example.com/healthz
             proxy_url: http://proxy.example.com:8080
           - endpoint: http://status.example.com/ready
             method: HEAD
   
   The integration instance requests only the listed URLs and disables autodiscovery for that instance. In Kubernetes mode, the cluster Collector monitors static targets. For more information, see architecture.
3. Optional: Trust a private certificate authority for static HTTPS targets. Mount the authority’s certificate with the chart’s clusterCollector.extraVolumes and clusterCollector.extraVolumeMounts values, then set tls.ca_file to the mounted path. For example, add the following to the values.yaml file for your CXDOT Collector Helm chart:
   config:
     integrations:
       http_check:
         endpoints:
           - endpoint: https://api.internal.example.com/healthz
         tls:
           ca_file: /etc/ssl/certs/internal-ca.pem
   
   The tls settings apply to every static target.
4. Optional: Configure separate integration instances to monitor both discovered and static targets. For example, add the following to the values.yaml file for your CXDOT Collector Helm chart:
   config:
     integrations:
       http_check: {}
       http_check/external:
         endpoints:
           - endpoint: https://api.example.com/healthz
   
   The http_check/external key defines a named instance for the static targets. Configuring a named instance suppresses the implicit default instance, so the empty http_check: {} entry is required to keep autodiscovery running.
5. Optional: Disable the integration to stop monitoring annotated targets. For example, add the following to the values.yaml file for your CXDOT Collector Helm chart:
   config:
     integrations:
       http_check:
         enabled: false
   

​

Validate

To validate the HTTP Check CXDOT Collector integration, follow these steps:

1. In the Live Telemetry Analyzer, add the following filters:
   • __name__=cxdot.integration.target.health
   • cxdot.integration.name=http_check
   Confirm that one time series appears for each configured URL, identified by the cxdot.integration.target attribute.
2. In Metrics Explorer, run the following query:
   {"cxdot.integration.target.health", "cxdot.integration.name"="http_check"}
   
   Confirm that each reachable URL reports 1 and each unreachable URL reports 0.
3. In Metrics Explorer, run the following query:
   {"httpcheck.duration", "cxdot.integration.name"="http_check"}
   
   Confirm that the query returns the response time in milliseconds for each reachable URL.

​

Troubleshooting

• A URL reports 0 for cxdot.integration.target.health: In Metrics Explorer, run the following query to group recent failed checks by URL and failure class:
  sum by ("cxdot.integration.target", "error.message") (count_over_time({"httpcheck.error", "cxdot.integration.name"="http_check"}[$__rate_interval]))
  
  The error.message attribute identifies whether the request timed out, failed DNS lookup, was refused, failed TLS negotiation, or failed for another reason.

For more information about diagnosing a failing integration, see Troubleshooting.

​

Configuration reference

Configure one HTTP Check integration instance with the following settings. In Helm values, place these settings under config.integrations.http_check. In a Collector configuration file, place them under cxdot.integrations.http_check.

​

Optional settings

• enabled Type: boolean. Optional. Default: true. Whether to enable this HTTP Check integration instance. If true, the Collector monitors the configured URLs. If false, it doesn’t run this integration instance.
• endpoints Type: array of object. Optional. Default: []. URLs to monitor. The Collector requests each entry on its own schedule and reports it as a separate target. A nonempty list disables automatic discovery for this integration instance, and the Collector requests only the listed URLs. If this list is empty and no annotated pods or Services exist, the integration requests no URLs.
• endpoints[].endpoint Type: string. Required. URL to request, including the http or https scheme. For example, https://api.example.com/healthz. An HTTPS URL also reports the number of seconds until its server certificate expires.
• endpoints[].method Type: string. Optional. Default: GET. HTTP method for the request.
• endpoints[].headers Type: object. Optional. Default: {}. Additional request headers as name-value pairs. Set the Host header to request a virtual host by its network address.
• endpoints[].proxy_url Type: string. Optional. Proxy URL for this endpoint, for example http://proxy.example.com:8080. When unset, the Collector uses the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables.
• collection_interval Type: duration. Optional. Default: 15s. How often the Collector requests each URL. Every collection performs an HTTP request against the target.
• timeout Type: duration. Optional. Default: 10s. Maximum time the Collector waits for each HTTP request to complete.
• tls Type: object. Optional. TLS settings for all statically configured HTTPS endpoints. Certificate verification is enabled unless insecure_skip_verify is true. Targets found from annotations use the annotation’s TLS settings.
• tls.ca_file Type: string. Optional. Path to the CA cert. For a client this verifies the server certificate. For a server this verifies client certificates. If empty uses system root CA. (optional)
• tls.ca_pem Type: string. Optional. In memory PEM encoded cert. (optional)
• tls.cert_file Type: string. Optional. Path to the TLS cert to use for TLS required connections. (optional)
• tls.cert_pem Type: string. Optional. In memory PEM encoded TLS cert to use for TLS required connections. (optional)
• tls.cipher_suites Type: array of string. Optional. CipherSuites is a list of TLS cipher suites that the TLS transport can use. If left blank, a safe default list is used. See https://go.dev/src/crypto/tls/cipher_suites.go for a list of supported cipher suites.
• tls.curve_preferences Type: array of string. Optional. contains the elliptic curves that will be used in an ECDHE handshake, in preference order Defaults to empty list and “crypto/tls” defaults are used, internally.
• tls.include_system_ca_certs_pool Type: boolean. Optional. If true, load system CA certificates pool in addition to the certificates configured in this struct.
• tls.insecure Type: boolean. Optional. In gRPC and HTTP when set to true, this is used to disable the client transport security. See https://godoc.org/google.golang.org/grpc#WithInsecure for gRPC. Please refer to https://godoc.org/crypto/tls#Config for more information. (optional, default false)
• tls.insecure_skip_verify Type: boolean. Optional. InsecureSkipVerify will enable TLS but not verify the certificate.
• tls.key_file Type: string. Optional. Path to the TLS key to use for TLS required connections. (optional)
• tls.key_pem Type: string. Optional. In memory PEM encoded TLS key to use for TLS required connections. (optional)
• tls.max_version Type: string. Optional. MaxVersion sets the maximum TLS version that is acceptable. If not set, refer to crypto/tls for defaults. (optional)
• tls.min_version Type: string. Optional. MinVersion sets the minimum TLS version that is acceptable. If not set, TLS 1.2 will be used. (optional)
• tls.reload_interval Type: duration. Optional. ReloadInterval specifies the duration after which the certificate will be reloaded If not set, it will never be reloaded (optional)
• tls.server_name_override Type: string. Optional. ServerName requested by client for virtual hosting. This sets the ServerName in the TLSConfig. Please refer to https://godoc.org/crypto/tls#Config for more information. (optional)
• tls.tpm Type: object. Optional. Trusted platform module configuration
• tls.tpm.auth Type: string. Optional. Authorization value for the trusted platform module key.
• tls.tpm.enabled Type: boolean. Optional. Whether to use a trusted platform module for the TLS private key. If true, the Collector loads the key from the configured device or socket. If false, the Collector uses the configured key file or in-memory key.
• tls.tpm.owner_auth Type: string. Optional. Owner authorization value for the trusted platform module.
• tls.tpm.path Type: string. Optional. The path to the TPM device or Unix domain socket. For instance /dev/tpm0 or /dev/tpmrm0.