Beacons

A plain script on a box in your network that runs the same checks from inside: private hosts, office lines and internal certificates watched, with nothing to install but one line.

Start free See pricing

Included on every plan.

PlansFreeProBusiness

What Beacons catches
What breaks	hostnag
A host goes downwebsite, API, VPN, mail, gateway	Yes
A certificate expiresdays-before thresholds, daily inside the last window	Yes
An ISP link dropsthe public address from several locations, by ping or a TCP port, confirmed by a ping from an internal device	Yesexternal and internal
hostnag: external and internal

On the board

The Beacons board, the install line, and a private host on its location board checked by two boxes.

Athens office boxes

03Pages through Athens office

ReportingLinux

athens-fw-01

fw-01.athens.lan

Heard2 min ago62.38.112.9

version 34 checks

ReportingmacOS

athens-nas

nas.athens.lan

Heard4 min ago62.38.112.9

version 33 checks

SilentWindows

athens-print

PRINT-SRV

Heard38 min ago62.38.112.9

version 31 check

The install line

curl -fsSL https://hostnag.com/beacon.sh | sudo bash -s -- install <token from the beacon page>

Read it first at hostnag.com/beacon.sh; it fetches what to check, never code, and runs from your own scheduler every minute. Windows runs beacon.ps1 the same way.

Intranet wiki, checked by two beacons

Locations

2 beacons, internal only

athens-fw-01beacon

9msHTTP 200

athens-nasbeacon

14msHTTP 200

How it works

01
Add a beacon group and a beacon
On the Beacons page: a group is an office, a plant or a rack and alerts as one of your zones; a beacon is one box in it. 1 beacon on Free, 5 on Pro, 20 on Business.
02
Run the one line on the box
It fetches beacon.sh (Linux, macOS) or beacon.ps1 (Windows), writes a small config and schedules itself every minute under your own scheduler: a systemd timer or cron, launchd, or a hidden Task Scheduler task. You can read every line before you run it.
03
Pick the beacon under Checked by
Any website, port, DNS, ping or certificate check can be run by a beacon instead of, or as well as, our own places; a private address is accepted for a check beacons alone run. A link, a status report or a certificate report can be fed by one too.
04
hostnag judges what the box saw
The beacon posts its readings, never a page body or a certificate you did not ask for; hostnag applies the same keyword, JSON, DNS and certificate rules as a live check, and the box is one more cell on the location board. A box that goes quiet is reported as silent, never as your host being down.

What you'll be told

What you get told

[Critical] https://www.example.com/ is down
Down from 2 of 3 locations (US East, Frankfurt). Last error: unexpected_status: 503.
HTTP
[Warning] Inbound blocked on Office
The site is online (an internal device is pinging) but port 443 is filtered on the way in. Check the firewall or the ISP's CGNAT.
Link

Sample alerts, rendered by the same code that writes your email and Slack messages.

Settings

Beacons: 1 on Free, 5 on Pro, 20 on Business
Platforms: Linux and macOS (bash 3.2 or later), Windows (PowerShell 5.1 or 7)
Checks from inside: HTTP, TCP port, DNS, ping, TLS certificate
Feeds: a link's internal ping, a status report, a certificate report
Check-in: every 1, 5, 15 or 60 minutes, plus a grace period; silence past it is Silent
Fencing: allow lines in its config: only hosts you list may be checked from the box
Removal: beacon.sh uninstall removes the schedule, the script, the config and the state

Questions

Is it installed software?

It is a plain script you can read in full, scheduled by your own cron, launchd or Task Scheduler. hostnag ships no service, no binary and nothing that updates itself; the script is told what to check and is never handed code.

What does it send?

Readings: a status code, a latency, an answer, a certificate's dates and fingerprint, an error word. The first 256 KB of a body only when a keyword or JSON rule needs it. Nothing else leaves the box.

What if the box itself goes down?

The beacon is reported as Silent after its cadence plus grace, through the zone's policy or one of its own, and every check it alone ran reads as not checkable rather than down. Two beacons in a group are failover: any one of them counts.

Can I fence what it may reach?

Yes. Add allow lines (an IP, a CIDR or a name suffix) to its config on the box; a served check whose host matches none is refused there and reported as not allowed.

Uptime monitoringWebsites, APIs and anything that answers on a port, checked every minute from up to five places, with a failure confirmed before anyone is paged.Link monitoringAn office or ISP connection watched from both ends, so a filtered port and a dead line never read the same.Certificate monitoringEvery certificate hostnag can reach is watched for expiry and a swapped chain; the ones it cannot reach get a URL to report to instead.