---
title: gRPC monitors
description: Check a gRPC endpoint via the standard health protocol, or just prove it speaks gRPC.
sidebar:
  label: gRPC
---

{/* Source of truth: packages/shared/src/monitors.ts — grpcConfigSchema
    (GRPC monitor type). */}

A gRPC monitor connects to a host and port and, by default, calls the standard
[gRPC Health Checking Protocol](https://grpc.io/docs/guides/health-checking/)
(`grpc.health.v1.Health/Check`). The monitor is `UP` only when the server
answers `SERVING`.

## Configuration

| Setting | Allowed values | Required |
| --- | --- | --- |
| `host` | hostname or IP, up to 255 characters | yes |
| `port` | 1–65535 | yes |
| `checkMode` | `health` (default) or `connectivity` | no |
| `serviceName` | service to ask the health service about; empty means overall server health | no |
| `plaintext` | `true` to connect without TLS — default is `false` (TLS on) | no |
| `skipTlsVerification` | `true` to accept self-signed or mismatched certificates | no |

## Health mode

The default. Glowo issues one `Health/Check` RPC per check:

- `SERVING` → `UP`
- `NOT_SERVING` → `DOWN` — the server is reachable but declares itself unhealthy
- an unknown `serviceName` → `DOWN` with `GRPC_HEALTH_UNKNOWN_SERVICE`
- a server that does not implement the health service → `DOWN` with
  `GRPC_HEALTH_UNIMPLEMENTED`

That last case is deliberate: the monitor never silently falls back to a
connectivity check. If a deploy removed the health service, "UP" would quietly
stop meaning "the app says it is healthy" — exactly the drift a monitor exists
to catch. If your server does not expose `grpc.health.v1`, switch the monitor
to connectivity mode instead.

Leave `serviceName` empty to ask about the server as a whole; set it (for
example `payments.v1.PaymentService`) to track one service's own status.

## Connectivity mode

For servers without the health service. Glowo drives the connection to ready —
TCP connect, TLS handshake, HTTP/2 setup — and stops there. No RPC is made, so
nothing needs to be implemented server-side. `UP` means "this endpoint speaks
gRPC", not "the application is healthy".

## TLS

TLS is on by default, and certificate expiry and issuer are captured on every
check, so the monitor's certificate card and expiry warnings work exactly as
they do for HTTPS monitors. Set `plaintext: true` for servers listening
without TLS (common inside private networks), or `skipTlsVerification: true`
to monitor an endpoint with a self-signed certificate — expiry is still
captured either way TLS is used.

## Timeouts

The shared `timeout` covers the whole check: connection, TLS handshake, and —
in health mode — the RPC round trip.