Prometheus Blackbox Exporter

An application can publish healthy internal metrics while users still cannot reach it. Blackbox Exporter checks endpoints from its own network location using protocols such as HTTP, DNS and TCP, then exposes the outcome and timing to Prometheus. It helps answer whether a particular access path works. Choose a location and check that represent the path you care about, and alert on the probe result: successfully scraping the exporter does not mean the target endpoint passed.

Current guidance

Blackbox Exporter actively checks endpoints using configured HTTP, HTTPS, DNS, TCP, ICMP or gRPC modules. The /metrics endpoint reports the exporter itself; /probe executes a check against a target and exposes probe_success plus timing information. A successful Prometheus scrape can therefore coexist with a failed target probe, and an alert that checks only up can miss the outage you intended to detect.

Choose the probe’s location and module to represent the user path you care about. An in-cluster HTTP probe may bypass public DNS, an external load balancer or an authentication flow. Configure accepted responses, TLS expectations, address-family behavior and timeouts deliberately, and keep the probe timeout within Prometheus’s scrape budget. ICMP may require additional operating-system permissions that HTTP probes do not.

Restrict access to the probe endpoint and its egress because callers can request network targets from the exporter’s position. Test an intentional DNS failure, rejected certificate or unavailable backend and confirm that the expected alert fires and resolves. Record target identity in labels, while avoiding unbounded URL parameters. These probes complement application metrics; they do not prove every authenticated workflow or transaction is functioning.