Skip to main content

Synthetics: how it works

The agent watches a website from inside the box: the local probe asks the web server for the page over loopback. That catches a broken application and a rotten certificate, and misses the one failure a visitor feels most: the box is healthy and nobody can reach it. A dead route, a firewall rule, a DNS record pointing at yesterday's address. Synthetics is the second eye, from Wakora's own vantage points on the public internet.

Which sites are probed​

Nothing is configured by hand. The candidates are the sites the agents discovered on your hosts, and each one passes a publicness gate before it is ever contacted from outside:

  1. The name must resolve on a public resolver, from the vantage point, to a public address. Private ranges, loopback, link-local and names that do not exist are internal and never probed; a split-horizon name that only exists inside your network cannot produce a false "down from everywhere".
  2. The public address must be the one the host itself answers on. A domain that points somewhere else (a CDN, another provider, a parked page) is points away and is probed only if you enrol it explicitly, because the outside view would then judge that other party.
  3. The verdict has to hold for 48 hours before the site is enrolled, so a name in the middle of a migration does not flap in and out.

Every candidate shows its verdict on the Uptime page: enrolled, pending, points away, internal, unresolved, or excluded by one of your rules. Per-workspace rules let you exclude a domain suffix outright or enrol a site the gate would have skipped.

How a probe behaves​

Every enrolled site gets a GET / every five minutes from each vantage point, with real TLS verification (the visitor's view of the certificate, not the origin's), following up to five redirects, one connection at a time per origin with pacing between requests, and a distinct user agent: Wakora-Synthetic/1.0 (+https://wakora.io/synthetics). The result per site and vantage is up or down, the HTTP status, and the response time.

Two rules of honesty are built in. A DNS failure at the vantage point reads as unknown, never as down: a resolver problem on our side must not paint your portfolio red. And a request that a WAF blocks reads as blocked, not as down; the probe addresses are fixed and published on the synthetics page of the main site so you can allow-list them instead of fighting them.

The two-view rule​

The incident that synthetics adds, site unreachable from the internet, is a correlation of the two views. It opens only when every vantage point reports the site down for five minutes and the inside view is healthy: the host sends heartbeats and its local probes of that site succeed. When the inside is down too, the host-down or site-down incident already exists and this rule stays silent. The rule arms itself on workspaces where probes flow, as a warning; raising it to critical is your decision in the rules tab.

Transaction flows​

A single page proves reachability; a flow proves the site works. A flow is up to ten HTTP steps with variables, values extracted from one response and used in the next, a shared cookie jar, and assertions on status, body content and timing: open the front page, log in with a test account, reach the checkout. It runs every few minutes from each vantage point, stops at the first failed step and names it. Credentials a flow needs are test accounts you issue for the purpose; they are stored encrypted and never shown again after saving. Each flow counts as one monitored site, and the flow failure rule ships disabled until you arm it. Flows are available on Pro and above.

What synthetics does not do​

  • It does not replace the inside view. Latency measured from a vantage point includes the internet between us and you; the local probe and APM measure the server itself.
  • It does not run a browser. Flows are HTTP requests with assertions, not rendered pages or JavaScript. Real-user rendering data comes from RUM.
  • It never probes a site the gate has not cleared or you have not enrolled, and never from more than one connection at a time per origin.