> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Health checks

> Readiness probes, liveness probes, synthetic monitoring

Health check logs come from readiness probes, liveness probes, load balancers, and synthetic monitors. They represent infrastructure availability checks, not user traffic.

Successful health checks confirm a known service state. Failed health checks can have diagnostic value and are not part of the default drop pattern.

## Signals

* Request paths such as `/health`, `/ready`, `/live`, `/ping`, or `/healthz`.
* Probe user agents such as `kube-probe` or `ELB-HealthChecker`.
* Successful status codes such as `200`.
* Repeated requests at a fixed interval.
* Requests generated by infrastructure rather than end users.

## Example

<Tabs>
  <Tab title="Before">
    ```json theme={null}
    {
      "@timestamp": "2024-01-15T10:30:00Z",
      "service.name": "checkout-api",
      "http.method": "GET",
      "http.target": "/health",
      "http.status_code": 200,
      "http.user_agent": "kube-probe/1.28"
    }
    ```
  </Tab>

  <Tab title="After">
    Dropped.
  </Tab>
</Tabs>

Tero generates a scoped policy for each service where this pattern exists:

```yaml theme={null}
id: drop-health-checks-checkout-api
name: Drop health check logs from checkout-api
description: Drop Kubernetes probe requests to health endpoints.
log:
  match:
    - resource_attribute: service.name
      exact: checkout-api
    - log_attribute: http.target
      regex: "^/(health|ready|live|ping)"
    - log_attribute: http.status_code
      exact: "200"
  keep: none
```

## Recommended enforcement

<Card title="Enforce at edge" icon="server" href="/policies/enforcement/edge" horizontal>
  Drop successful health check logs before they reach your provider.
</Card>

Use edge enforcement: infrastructure systems like Kubernetes, load balancers, and synthetic monitors generate these logs.

## Detection notes

* Tero identifies health check logs by request path, user agent, and status code.
* Tero drops successful probes and keeps failed ones; they can show when a service became unhealthy.
* Scope path matching to health endpoints so the policy doesn't drop normal user traffic.