# Internal services

Run checks from an agent inside your private network.

HTTP, TCP, DNS, and ping checks can run from an [agent](https://docs.kogut.dev/agent/installing/) that
reaches a private target. Update the agent before assigning ping checks or HTTP request
headers to it.

## Add a check in the panel

1. Open the service's page and click **Add check**.
2. Enter the private target and choose the agent's host under **Run from**.
3. Save. The agent receives the check without a restart.

For a discovered target, use **Monitor** on the host's page; see
[Discovery](https://docs.kogut.dev/agent/discovery/).

## Add a check in `kogut.toml`

1. List the agent's host in a service's `hosts`.
2. Set the check's `from` to that host's name in kogut, not necessarily its OS hostname.

```toml title="kogut.toml"
[[service]]
name = "postgres"
hosts = ["db-1"]

[[check]]
name = "Postgres port"
service = "postgres"
tcp = "127.0.0.1:5432"
from = "db-1"
```

The file is rejected if no service lists the `from` host. See the
[check reference](https://docs.kogut.dev/reference/configuration/#check) and [Recipes](https://docs.kogut.dev/monitoring/recipes/).

## Choose where to probe

- The target's own host and `127.0.0.1` test whether the service answers locally.
- Another host in the private network tests the path other services use.
- Each check runs from one place, so public and private access need separate checks.

For a container's published port, run the agent with `network_mode: host` and use the
host port, such as `127.0.0.1:8080` ([Docker](https://docs.kogut.dev/agent/docker/)).

## Handle an offline agent

If the agent sends nothing for two minutes, its checks become unknown, not down, and the
silence opens a host incident. After a server restart, agents have two minutes to
reconnect, and send buffered results with their original timestamps. The public
[status page](https://docs.kogut.dev/status-page/) does not show internal targets.