The check tells you which layer broke.

Most monitors tell you that something failed. Perstat's checks are built to tell you what: which layer, which IP family, which region saw it first. 12 check types, assertions down to regex, and an agent you install with one line.

12 check types, not 3

Everyone asks about HTTP, TCP, and DNS first. The full list a monitor can run today:

• http, with assertions on status code, keyword, or regex against the body.
• http_headers: security-header posture (the headers you keep meaning to set).
• tcp and ping for reachability, traceroute for the path.
• dns, plus dns_hygiene: SPF, DMARC, and CAA checked as configuration, not vibes.
• domain: NS, SOA, DNSSEC, and WHOIS expiry, so a lapsing domain is a warning, not a Saturday.
• ssl_cert: expiry, issuer, self-signed detection.
• smtp and imap for the mail path your password resets depend on.
• agent for hosts: CPU, memory, disk, service watch.

An http monitor carries TLS, security-header, and DNS-hygiene subchecks inline, so one monitor covers what used to take four. Redirects are followed up to 5 hops, and every hop is validated against SSRF targets before it is fetched. The check-type reference explains each type on its own page.

Results you can actually debug with

• Dual-stack, per IP. Checks run across all A and AAAA records, with per-family and per-IP results. Whether an IPv6-only failure counts as degraded or failed is your call, per monitor.
• DNS time is separated. dns_ms is reported apart from total latency, so a slow resolver does not masquerade as a slow app.
• Cause attribution. Every failure is attributed to a layer: your app, your DNS, the network in between, our resolver, or our own probe node. Each probe node runs its own recursive, validating resolver, and when the fault is on our side, the record says so.
• Cross-checks. A DNS monitor can verify its answers against another monitor’s answer set, and a divergence runs through the normal incident pipeline.

Paged for confirmed failures, not probe hiccups

An incident opens when a quorum of regions confirms the failure, and its start time is the quorum confirmation, to the second: the same boundary your SLA record uses later. Sub-quorum divergences (one region drifting, one IP family failing, one node disagreeing) land on a watchlist, a per-layer signal you read on your own schedule instead of at 3 a.m. The full paging rule, and why it lets on-call sleep, is on the SRE page; how the record holds up is on the leadership page.

The host agent respects your machine

One line installs it, from the distribution point, for Linux (x86_64, aarch64) and macOS (universal binary). On Linux it runs as a hardened systemd unit. It updates itself with ed25519-signed releases verified before swap (no root helper, fail-closed), and uninstalls cleanly, deregistering from the cockpit. It reports availability, CPU, memory, disk, and named services. It never collects command lines, environment variables, or usernames.

The API question, answered honestly

You configure monitors in the web app today, and in the native iOS app currently in TestFlight. There is no public API with scoped keys yet, and we would rather tell you that before you sign up than after. The API surface is documented in an OpenAPI document, the architecture is API-first internally, and a public, documented API with scoped keys is the stated next step. When it lands, it shows up on the changelog, dated.

Try it against something real

Ten monitors at 300-second intervals, 0 EUR, no time limit. Point one at your API, one at your domain’s DNS, one ssl_cert at the certificate you forgot about. The record it keeps is the argument for the rest.

Start monitoring free. Or take the tour, no signup. Or see pricing, every number on the page.