Constant notifications of website DOWN/UP

mendozal

Hi,

I just came across this post on Enhance’s forum:

https://community.enhance.com/d/3386-ols-flappingdown-alerts-via-prometheus

It reminded me of an issue I’ve been seeing consistently with cPFence. I frequently receive notifications indicating that a website is DOWN, followed by an UP notification roughly 3–4 minutes later. However, when I manually test the website immediately after receiving the DOWN alert, the site is responding normally and appears fully operational.

I’m trying to understand what could be causing these false positives and where I should look to diagnose the issue.

The alert emails mention checking /tmp/cPFence_MonitorPro_Alerts.log for more details, but that file only contains the last DOWN/UP event, with no additional context or explanation as to why the site was considered unavailable.

Any guidance on possible causes, relevant logs, or monitoring thresholds that could explain this behavior would be appreciated.

I'm using OLS in all servers.

cPFence

mendozal

cPFence MonitorPro simply checks websites using a request similar to the following:

curl -4 -L -o /dev/null -s -w "%{http_code}\n" \
  --referer "https://cpfence.app/" \
  -A "Mozilla/5.0 (compatible; cPFence MonitorPro; +https://cpfence.app/)" \
  --max-time 5 --connect-timeout 10 \
  "https://example.com"

If the response code is not 200, cPFence retries the check. If it still doesn’t receive a 200 response, it triggers a DOWN alert. Once a 200 response is detected again, an UP alert is sent.

Common reasons why the response may not be 200 even though the site appears to be up when checked manually include:

Temporary load or slowness, the site may not respond within the 10-second timeout window.
Cloudflare or similar protection, bot challenges or rate-limiting can block the request.
Short DNS hiccups, brief resolution failures can result in no response (000).

If you’re using Cloudflare (or a similar service), we recommend whitelisting your main cp server IPs (ipv4 and v6) and the following User-Agent:

cPFence MonitorPro

You can follow this guide:
https://my.cpfence.app/knowledgebase/96/How-to-Whitelist-MonitorPro-in-Cloudflare.html

If the issue persists and only affects one or two specific sites, you can also mark those domains to be ignored in MonitorPro to prevent repeated false-positive alerts.

https://my.cpfence.app/knowledgebase/120/How-to-Ignore-Uptime-Monitoring-for-a-Specific-Domain.html

mendozal

I'm not using Cloudflare or any other CDN in these websites. Only for DNS without proxy.

This detection happens with random sites, wordpress or no wordpress any time.

I will investigate further at a later time. Thanks for the info!

cPFence

mendozal

It’s most likely the 10-second timeout. On VPSs with tight resources, responses can occasionally exceed that limit and fail randomly.