Tune it when the defaults aren't right.
Interval, slow threshold, timeout, failure streak, redirects, SSL and domain expiry. Every knob the create form has, with a sane default on each.
Open is not the same as healthy.
A port monitor opens a TCP connection to a host and a port, and that's the whole check. No HTTP, no rules: success is "the port accepted", and the time it took is the connect time.
Most of your infrastructure doesn't speak HTTP. A database, a mail server, a Redis, a game server, an SSH daemon. None of them will answer a
GET, and all of them will tell you whether they're listening.On an HTTP check, latency is a sum with a story inside it. On a port check there's nothing to sum: no request is sent and no response is read, so the number is the TCP handshake and nothing else.
That makes it a clean signal. When connect time climbs on a port monitor, the network or the listener is the reason, because there is no third thing it could be.
Be clear with yourself about what this proves. An accepted connection means a process is bound to that port and taking connections. It does not mean the database is answering queries, or that replication is caught up.
For anything that can be wrong while still accepting connections, put an HTTP or API check in front of it and let the port monitor answer the narrower question underneath.
Name a host and a port
The host is a bare hostname or a public IP, with no scheme and no path. The port is the number you'd connect to by hand.
Everything around the check.
Alerts on the change, not every minute.
Once when it breaks, once when it recovers, to Slack, Discord, a webhook, email, or your phone. A confirmation streak holds back the blips.
A status page your users can read.
Every monitor can back a public status page with ninety days of history, on your own domain, so the question answers itself.
Every outage, written down as it happens.
A confirmed failure opens an incident and keeps the timeline, detected to resolved. The first half of the post-mortem writes itself.
Planned downtime that pages no one.
Schedule a window and the monitors it covers stop being checked, so nothing alerts, no incident opens, and the time is left out of your uptime.
Everything else you can watch.
HTTP / Website, Keyword, API, Heartbeat, Scheduler, and DNS. Every one reports up, slow, or down, on the same interval, into the same alerts.