> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP Check

> Availability, response time, and certificate expiry metrics for the HTTP endpoints your services depend on.

The HTTP Check integration requires CXDOT Collector 1.4.0 or greater.

[Hypertext Transfer Protocol (HTTP)](https://developer.mozilla.org/en-US/docs/Web/HTTP)
is the application protocol clients use to request resources over the web. Use the
HTTP Check CXDOT Collector integration with the CXDOT Collector to collect
availability, response time, and certificate expiry metrics from the HTTP and HTTPS
endpoints your services depend on.

The HTTP Check CXDOT Collector integration supports HTTP and HTTPS URLs.

## Supported telemetry types

The HTTP Check CXDOT Collector integration supports these telemetry types:

| Type | Supported |
| :-: | :-: |
| Logs | No |
| Metrics | Yes |
| Traces | No |
| Events | No |

## Prerequisites

The HTTP Check CXDOT Collector integration has the following prerequisites:

* Make each URL you want to monitor reachable from the CXDOT Collector.

## Configure

To configure the HTTP Check CXDOT Collector integration, follow these steps:

1. For URLs served by pods or Services in your Kubernetes cluster, add
   autodiscovery annotations that provide the URL to monitor. The integration is
   enabled by default, so you don't need to add an `http_check` configuration block.
   For more information, see
   [autodiscovery](https://docs-xcor.paloaltonetworks.com/ingest/xcor/collector/discover/kubernetes).

   Metrics from discovered pods arrive with that pod's Kubernetes metadata attached.

2. Optional: Configure static targets to monitor URLs that autodiscovery doesn't
   cover, such as an API outside your Kubernetes cluster. For example, add the
   following to the `values.yaml` file for your CXDOT Collector Helm chart:

   ```yaml theme={null}
   config:
     integrations:
       http_check:
         endpoints:
           - endpoint: https://api.example.com/healthz
             proxy_url: http://proxy.example.com:8080
           - endpoint: http://status.example.com/ready
             method: HEAD
   ```

   The integration instance requests only the listed URLs and disables autodiscovery
   for that instance. In Kubernetes mode, the cluster Collector monitors static
   targets. For more information, see
   [architecture](https://docs-xcor.paloaltonetworks.com/ingest/xcor/collector/install/kubernetes/architecture).

3. Optional: Trust a private certificate authority for static HTTPS targets. Mount
   the authority's certificate with the chart's `clusterCollector.extraVolumes` and
   `clusterCollector.extraVolumeMounts` values, then set `tls.ca_file` to the
   mounted path. For example, add the following to the `values.yaml` file for your
   CXDOT Collector Helm chart:

   ```yaml theme={null}
   config:
     integrations:
       http_check:
         endpoints:
           - endpoint: https://api.internal.example.com/healthz
         tls:
           ca_file: /etc/ssl/certs/internal-ca.pem
   ```

   The `tls` settings apply to every static target.

4. Optional: Configure separate integration instances to monitor both discovered and
   static targets. For example, add the following to the `values.yaml` file for your
   CXDOT Collector Helm chart:

   ```yaml theme={null}
   config:
     integrations:
       http_check: {}
       http_check/external:
         endpoints:
           - endpoint: https://api.example.com/healthz
   ```

   The `http_check/external` key defines a named instance for the static targets.
   Configuring a named instance suppresses the implicit default instance, so the empty
   `http_check: {}` entry is required to keep autodiscovery running.

5. Optional: Disable the integration to stop monitoring annotated targets. For
   example, add the following to the `values.yaml` file for your CXDOT Collector
   Helm chart:

   ```yaml theme={null}
   config:
     integrations:
       http_check:
         enabled: false
   ```

### Validate

To validate the HTTP Check CXDOT Collector integration, follow these steps:

1. In the Live Telemetry Analyzer, add the following filters:

   * `__name__=cxdot.integration.target.health`
   * `cxdot.integration.name=http_check`

   Confirm that one time series appears for each configured URL, identified by the
   `cxdot.integration.target` attribute.

2. In Metrics Explorer, run the following query:

   ```text theme={null}
   {"cxdot.integration.target.health", "cxdot.integration.name"="http_check"}
   ```

   Confirm that each reachable URL reports `1` and each unreachable URL reports `0`.

3. In Metrics Explorer, run the following query:

   ```text theme={null}
   {"httpcheck.duration", "cxdot.integration.name"="http_check"}
   ```

   Confirm that the query returns the response time in milliseconds for each
   reachable URL.

### Troubleshooting

* A URL reports `0` for `cxdot.integration.target.health`: In Metrics Explorer, run
  the following query to group recent failed checks by URL and failure class:

  ```text theme={null}
  sum by ("cxdot.integration.target", "error.message") (count_over_time({"httpcheck.error", "cxdot.integration.name"="http_check"}[$__rate_interval]))
  ```

  The `error.message` attribute identifies whether the request timed out, failed DNS
  lookup, was refused, failed TLS negotiation, or failed for another reason.

## Configuration reference

Configure one HTTP Check integration instance with the following settings. In Helm values, place
these settings under `config.integrations.http_check`. In a Collector configuration file, place
them under `cxdot.integrations.http_check`.

### Optional settings

* **`enabled`**
  Type: `boolean`. Optional. Default: `true`.
  Whether to enable this HTTP Check integration instance. If true, the Collector monitors the
  configured URLs. If false, it doesn't run this integration instance.

* **`endpoints`**
  Type: `array of object`. Optional. Default: `[]`.
  URLs to monitor. The Collector requests each entry on its own schedule and reports it as a
  separate target. A nonempty list disables automatic discovery for this integration instance,
  and the Collector requests only the listed URLs. If this list is empty and no annotated pods
  or Services exist, the integration requests no URLs.

* **`endpoints[].endpoint`**
  Type: `string`. Required.
  URL to request, including the `http` or `https` scheme. For example,
  `https://api.example.com/healthz`. An HTTPS URL also reports the number of seconds until its
  server certificate expires.

* **`endpoints[].method`**
  Type: `string`. Optional. Default: `GET`.
  HTTP method for the request.

* **`endpoints[].headers`**
  Type: `object`. Optional. Default: `{}`.
  Additional request headers as name-value pairs. Set the `Host` header to request a virtual
  host by its network address.

* **`endpoints[].proxy_url`**
  Type: `string`. Optional.
  Proxy URL for this endpoint, for example `http://proxy.example.com:8080`. When unset, the
  Collector uses the `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables.

* **`collection_interval`**
  Type: `duration`. Optional. Default: `15s`.
  How often the Collector requests each URL. Every collection performs an HTTP request against
  the target.

* **`timeout`**
  Type: `duration`. Optional. Default: `10s`.
  Maximum time the Collector waits for each HTTP request to complete.

* **`tls`**
  Type: `object`. Optional.
  TLS settings for all statically configured HTTPS endpoints. Certificate verification is
  enabled unless `insecure_skip_verify` is `true`. Targets found from annotations use the
  annotation's TLS settings.

* **`tls.ca_file`**
  Type: `string`. Optional.
  Path to the CA cert. For a client this verifies the server certificate. For a server this
  verifies client certificates. If empty uses system root CA. (optional)

* **`tls.ca_pem`**
  Type: `string`. Optional.
  In memory PEM encoded cert. (optional)

* **`tls.cert_file`**
  Type: `string`. Optional.
  Path to the TLS cert to use for TLS required connections. (optional)

* **`tls.cert_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS cert to use for TLS required connections. (optional)

* **`tls.cipher_suites`**
  Type: `array of string`. Optional.
  CipherSuites is a list of TLS cipher suites that the TLS transport can use. If left blank, a
  safe default list is used. See
  [https://go.dev/src/crypto/tls/cipher\_suites.go](https://go.dev/src/crypto/tls/cipher_suites.go)
  for a list of supported cipher suites.

* **`tls.curve_preferences`**
  Type: `array of string`. Optional.
  contains the elliptic curves that will be used in an ECDHE handshake, in preference order
  Defaults to empty list and "crypto/tls" defaults are used, internally.

* **`tls.include_system_ca_certs_pool`**
  Type: `boolean`. Optional.
  If true, load system CA certificates pool in addition to the certificates configured in this
  struct.

* **`tls.insecure`**
  Type: `boolean`. Optional.
  In gRPC and HTTP when set to true, this is used to disable the client transport security. See
  [https://godoc.org/google.golang.org/grpc#WithInsecure](https://godoc.org/google.golang.org/grpc#WithInsecure)
  for gRPC. Please refer to
  [https://godoc.org/crypto/tls#Config](https://godoc.org/crypto/tls#Config) for more
  information. (optional, default false)

* **`tls.insecure_skip_verify`**
  Type: `boolean`. Optional.
  InsecureSkipVerify will enable TLS but not verify the certificate.

* **`tls.key_file`**
  Type: `string`. Optional.
  Path to the TLS key to use for TLS required connections. (optional)

* **`tls.key_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS key to use for TLS required connections. (optional)

* **`tls.max_version`**
  Type: `string`. Optional.
  MaxVersion sets the maximum TLS version that is acceptable. If not set, refer to crypto/tls
  for defaults. (optional)

* **`tls.min_version`**
  Type: `string`. Optional.
  MinVersion sets the minimum TLS version that is acceptable. If not set, TLS 1.2 will be used.
  (optional)

* **`tls.reload_interval`**
  Type: `duration`. Optional.
  ReloadInterval specifies the duration after which the certificate will be reloaded If not set,
  it will never be reloaded (optional)

* **`tls.server_name_override`**
  Type: `string`. Optional.
  ServerName requested by client for virtual hosting. This sets the ServerName in the TLSConfig.
  Please refer to [https://godoc.org/crypto/tls#Config](https://godoc.org/crypto/tls#Config) for
  more information. (optional)

* **`tls.tpm`**
  Type: `object`. Optional.
  Trusted platform module configuration

* **`tls.tpm.auth`**
  Type: `string`. Optional.
  Authorization value for the trusted platform module key.

* **`tls.tpm.enabled`**
  Type: `boolean`. Optional.
  Whether to use a trusted platform module for the TLS private key. If true, the Collector loads
  the key from the configured device or socket. If false, the Collector uses the configured key
  file or in-memory key.

* **`tls.tpm.owner_auth`**
  Type: `string`. Optional.
  Owner authorization value for the trusted platform module.

* **`tls.tpm.path`**
  Type: `string`. Optional.
  The path to the TPM device or Unix domain socket. For instance /dev/tpm0 or /dev/tpmrm0.


## Related topics

- [CXDOT Collector integrations](/ingest/xcor/integrations/collector.md)
- [TCP Check](/ingest/xcor/integrations/collector/tcp_check.md)
- [Install a Core Operator on Linux](/ingest/pipeline/v2/install/install-operator/linux.md)
- [Configure Palo Alto Networks Telemetry Pipeline using Helm](/ingest/pipeline/v2/configure/helm.md)
- [Networking](/ingest/pipeline/v2/configure/networking.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.