CCNA Health Checking Questions

Consul kills a script check that does not return before its timeout and marks it critical, so a 40-second script under the default 10-second timeout will be terminated and reported as failing. Setting timeout to a value above the observed worst-case runtime lets the script finish and report its real status, stopping the flap without touching the script or the host.

For a TTL check, the ttl field specifies the duration after which the check becomes critical if no successful update is received. Setting it to 1m ensures that if the application does not renew the TTL within one minute, Consul marks the check critical, exactly matching the requirement.

deregister_critical_service_after specifies the duration a service may remain critical before Consul automatically removes it from the catalog. Setting it to 24h satisfies the requirement, unlike checks or timeouts that only affect health status without deregistering the service.

The TCP check attempts a connection to the specified address. If the database is bound only to a specific IP (e.g., 127.0.0.1 vs ::1) or the agent lacks permissions, the connection fails. The scenario says the database is accepting connections, but not necessarily on the exact address the check uses. This is the most likely cause.

The deregister_critical_service_after field specifies a duration after which a service in a critical state is automatically deregistered from the catalog. Setting it to 10m meets the requirement of removing the instance after 10 minutes of critical health. This is the exact field designed for this scenario and is valid in service check definitions.

Consul's health check states are passing, warning, and critical. A passing status means the check's defined script, HTTP, or TCP probe returned success within its interval, confirming the service instance is healthy and should remain in the load-balancing rotation.

Consul treats a check whose HTTP request does not complete within the timeout field as a failure and sets the status to critical. The endpoint answering slowly with HTTP 200 does not override the timeout; the request is abandoned and the check goes critical until a subsequent probe completes inside the timeout window.

The grpc check type implements the standard gRPC health checking protocol against the given address. The agent calls the health service and treats a SERVING response as passing. This avoids writing custom probe logic and matches the requirement to use the protocol the service already exposes on port 50051.

Setting expose to true publishes the service-specific check's status through Consul's HTTP health endpoint, allowing external tooling to query it. Without it, the check runs but its result stays internal to the agent, so only the API interface reveals the state.

In a non-containerised, multi-process architecture, each process runs independently, so Consul cannot infer health from a single aggregate check. Defining one check per service ensures each process is monitored separately, satisfying the requirement to detect individual process failures.

The alias check directly inherits the status of the aliased check. Since the aliased check is in a warning state, the alias check will also report warning. This allows services to depend on the health of other services without duplicating check logic. The alias check does not modify the status in any way.

Consul aggregates all health checks attached to a service; if any single check reports critical, the service's overall status becomes critical. This aggregation means one failing check is sufficient to mark the whole service unhealthy, regardless of the other checks passing.

A service's aggregate health is the worst state among all its checks, so adding a script check that fails on the registering node drags the service to critical even though the alias check still passes. Because DNS only returns healthy instances by default, the gateway drops out of resolution. Removing or fixing the failing script check restores the service to passing.

For script health checks, Consul interprets the exit code: 0 means passing, 1 means warning, and any other non-zero code means critical. However, in Consul 1.15, the behavior is that exit code 1 is actually treated as critical for script checks. This is because the script check does not differentiate between warning and critical; any non-zero exit code results in a critical status. Therefore, the service will be marked critical.

A TTL check is marked critical when the TTL expires without an update. Setting ttl = "30s" means the service remains passing as long as the application sends a heartbeat at least every 30 seconds. This matches the requirement to mark the service unhealthy after 30 seconds without a heartbeat, and no external script or HTTP endpoint is needed.

By default, an HTTP check in Consul considers any response code in the 2xx range as passing. If no explicit status codes are configured, the check uses this default behavior. Therefore, simply defining an HTTP check with a URL and interval will treat 2xx responses as healthy. This directly satisfies the requirement without additional configuration.

A TCP check opens a connection to the target host and port and reports success only if the socket is accepted. Pointing it at each server's Serf LAN port (8301) from the client agent directly tests the gossip path that matters, so a server that answers HTTP on 8500 but has a blocked or broken 8301 port is correctly marked critical.

The ttl field is mandatory for a TTL check. It tells Consul how long to wait for the next report before marking the check critical. Without a TTL value, Consul cannot determine when the check has expired, so the check cannot function as intended for the batch worker.

The Consul health check HTTP API returns an Output field containing the textual result produced by the check script or HTTP probe. This satisfies the stem's requirement by surfacing diagnostic detail alongside status, letting operators see why a check reported passing, warning, or critical.

For script health checks, Consul interprets exit code 0 as passing and any non-zero exit code as critical. This binary behavior is standard for script checks in Consul 1.15. The engineer's script returning 1 correctly results in a critical status when unhealthy.

Health checks execute on the Consul agent running on each node, not centrally on the servers. This satisfies the stem's requirement that checks are agent-local: the agent owns the check definition, performs the probe, and reports status to the servers via the catalog. Server-side execution would not scale to thousands of nodes.

The `deregister_critical_service_after` field specifies a duration after which a service that remains in a critical state is automatically deregistered from the Consul catalog. After 10 minutes of continuous critical status, Consul will remove the service registration. This helps prevent stale entries for failed services. The service must be re-registered to become available again.

The deregister_critical_service_after timer is reset when the check leaves the critical state. Since the check returned to passing after 20 minutes, well before the 30-minute threshold, the service is not deregistered. The timer only triggers deregistration if the check stays critical continuously for the configured duration.

For HTTP checks, Consul marks the check critical when the monitored endpoint returns any HTTP status other than 200, or when the connection fails or times out. A 500 response therefore immediately puts the check into the critical state, which removes the service from healthy DNS results and from the passing portion of the catalog.

Consul's HTTP health check treats any response in the 2xx range as passing, marking the service healthy. Other ranges (3xx redirects, 4xx client errors, 5xx server errors) are interpreted as failing or warning states, so 2xx is the only range that satisfies the passing-state requirement.

The Consul UI displays each service's health check status, output and last-updated timestamp, letting you identify which check is failing and why. This directly satisfies the troubleshooting scenario by exposing the check's current state without command-line inspection.

The tcp check type opens a TCP connection to the specified address and port and considers the check passing if the connection is established. It sends no application-level data, which matches the requirement exactly. The interval schedules repeated connection attempts, and the check fails when the socket cannot be opened.

By specifying a trusted CA certificate with ca_file or ca_path, Consul can verify the server's certificate against that CA. This resolves the certificate error while maintaining proper TLS verification. This is the secure and correct approach when the service uses a certificate signed by a private or internal CA.

TTL health checks require the service to periodically report its status using the /v1/agent/check/pass endpoint or equivalent. If no update is received within the configured TTL, Consul marks the check critical automatically. This is the intended behavior to detect unresponsive services, and it explains the observed transition in the scenario.

When a script check exceeds its `timeout`, the agent reports the check as critical and moves on, running the script again when the next `interval` elapses. This gives operators the unhealthy signal they asked for while keeping the check loop on schedule, though the still-running process from the previous attempt is not forcibly stopped.

A TTL check expects a heartbeat within its TTL window. Once 30 seconds elapse without one, Consul marks the check critical, so the service status changes immediately at that expiry rather than after a further grace period.

A successful TCP handshake confirms the target port is open and accepting connections, which is the sole pass criterion for Consul's TCP health check. Unlike HTTP checks, no status code or payload is evaluated, so the SYN-ACK response itself satisfies the check's passing condition.

The deregister_critical_service_after field specifies a duration after which a service in critical state is automatically deregistered. Since the check has been critical for 15 minutes, which exceeds the 10-minute threshold, Consul will remove the service from the catalog. This prevents stale unhealthy services from lingering.

The /v1/health/checks/<service> endpoint returns each check's status plus its Output field, which carries the exact error text the check script produced. That message pinpoints why the check is failing, unlike the aggregated node or service health endpoints.

A TTL check uses the ttl field to define how long Consul waits for a check-in before marking the check critical, and the status field seeds the initial state so the new registration begins as passing. This matches the requirement of a 30-minute window and a non-critical initial state for the batch job.

The timeout field defines how long Consul waits for the check to complete before considering it failed. Increasing the timeout allows the check to tolerate a slow endpoint by giving it more time to respond. This is the correct field to address the slow endpoint requirement in the scenario.

Consul 1.15 supports the args field for script checks, which accepts an array of the command and its arguments. Using args avoids shell interpretation and is the recommended approach. The interval of 15s sets the polling frequency, and a zero exit code from the script results in a passing status.

The deregister_critical_service_after field on a check tells the local Consul agent to remove the associated service instance from the catalog once the check has stayed critical for the specified duration, such as "10m". Placing the check inside the service block ties the deregistration to that service, so no external watcher or script is needed.

Every active check, including a gRPC health check, needs an interval to tell the agent how often to run the probe. Omitting it leaves the check without a schedule, so Consul cannot periodically invoke the gRPC health service, making this field required alongside the protocol-specific address.

A warning status means the service's health check is passing but a configured threshold, such as a degraded check or failing node, is breached. The service remains registered and serving traffic, yet its performance or partial availability falls short of the passing criteria.

The TCP check type is purpose-built for verifying that a TCP port is open and accepting connections. It requires only the address and port, plus an interval, and does not depend on external binaries or HTTP endpoints. This directly satisfies the requirement for the legacy Java application that listens on 8443 but cannot expose HTTP.

When a check is nested in a service block and has no explicit ID, Consul generates an ID tied to the service. The check is removed when the service is deregistered, and because it is declared in the agent's configuration directory, it is re-registered automatically whenever the agent starts, satisfying both requirements.

The dns check type is built into the Consul agent and resolves the supplied name (or the service name if omitted) using the host's resolver or an explicit address. Because the check runs inside the agent process, no extra binary is needed. The team must still supply a reachable resolver, since the check cannot succeed if every DNS destination is blocked.

Script checks run an executable or script as a local process on the Consul agent host, whereas HTTP checks issue network requests to a specified URL. The processing distinction is local process execution versus remote HTTP request handling.

A TCP check only attempts to open a connection to the configured host and port. If the TCP handshake succeeds, the check is passing regardless of whether the application accepts or processes data on that connection. In this scenario the port is still open, so Consul reports passing even though the process is hung.

TTL checks are passive: the service must periodically PUT its status to Consul's agent endpoint, so health depends on the application actively pushing updates. Without that push, Consul marks the check critical after the TTL expires, satisfying the stem's requirement for a push-based mechanism.

Agent configuration files let you declare checks in the agent's own configuration, applying them to the node rather than a single service. This satisfies the question's requirement for defining checks, covering node-level and service-level checks.

This correctly configures a TCP health check that attempts to open a connection to localhost on port 9200 every 10 seconds. If the connection succeeds, the check is passing; if it fails, the service is marked critical. This is the appropriate check type for verifying that a service is listening on a specific TCP port without requiring HTTP or a script.

The http check is defined declaratively in HCL with fields such as http, method, header, and tls_skip_verify. The agent performs the request itself using its internal HTTP client, so no external interpreter or binary is needed on the node. This makes it ideal for fleets where installing curl or a scripting runtime is undesirable, and it returns rich status based on the response code.

The notes field carries a human-readable description attached to a health check, displayed in the Consul UI and API output to explain the check's purpose. It has no effect on check status evaluation or service registration behaviour.

Consul's HTTP API exposes agent check endpoints, so a PUT to /v1/agent/check/pass/checkID marks the named TTL check as passing and resets its timer. This is the documented manual method for pushing a TTL check update without waiting for the service to report.

HTTP PUT to `/agent/check/pass/<check_id>` lets the agent mark a TTL check passing, resetting its expiry timer. This satisfies the stem's requirement to update a TTL health check, since TTL checks are updated by external processes reporting status via the agent's HTTP API rather than by Consul polling a service.

Raising the agent's log verbosity to debug makes Consul emit detailed health-check execution output, including script invocations and timing, which reveals where a hanging check stalls. The -log-level=debug flag therefore exposes the check's internal behaviour in the agent logs.

The HTTP check's 'header' object accepts a map of header names to arrays of values, which Consul sends with each probe request. Defining it in the check block lets you assert that the specified header reaches the endpoint, satisfying the verification requirement.

Blocks check traffic.

Consul's native health checks cannot reference another service's status, so dependency-aware health must be scripted. A script check queries the dependency's health endpoint or Consul API and returns the appropriate exit code, letting the registered service report unhealthy when its dependency fails.

The check field attaches a health check definition to the service, specifying the script, interval and status thresholds Consul uses to determine whether that service instance is healthy and should remain in DNS or catalog results.

Consul treats a service with no registered health checks as healthy by default, so its status is reported as passing. No check can fail, meaning the service remains in the catalog and receives traffic until checks are defined.

The service block can advertise the database's genuine address and port independently of the check, and an http check may target any URL the agent can reach, including a loopback exporter. This keeps service discovery accurate while gating catalog health on the exporter. It is the cleanest way to monitor an unmanaged dependency through a sidecar signal without exposing the exporter as a service.

An HTTP check transitions to critical when its request exceeds the configured timeout, since Consul cannot confirm the endpoint is healthy. The timeout constraint in the stem is satisfied because no successful response is received within the allowed interval, marking the service unhealthy.

When a TTL check is not updated within its TTL, Consul marks it critical. By default, DNS queries and the health API return only passing instances, so the service is effectively removed from the healthy set until an update is sent. This behaviour is the primary reason TTL checks require a reliable heartbeat mechanism from the service or its supervisor.

Consul's HTTP check marks the service critical for any HTTP response code outside the 2xx range, including 500. Since the endpoint returns 500 when the database connection fails, Consul reports critical. This correctly signals that the service is running but unhealthy and should not receive traffic.

A service's aggregate health includes the status of the node on which it runs. If a node-level check such as the built-in serfHealth check is critical, the node is unhealthy and every service on that node is reported as unhealthy in catalog queries, even if the service's own check is passing.

A TTL check inverts the model: the application must periodically call Consul's HTTP pass endpoint to reset the timer, and Consul marks it critical if the heartbeat lapses. This suits legacy apps lacking HTTP or TCP endpoints, since they signal health themselves.

The tls_skip_verify field is a boolean on HTTP checks that instructs the Consul agent to skip TLS certificate verification for that specific check. Setting it to true allows the check to succeed against a service using a self-signed or otherwise untrusted certificate without altering global agent TLS settings. This is the correct targeted approach for the scenario.