> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Heartbeat Checking
> Periodically verify that a secret's stored password is still valid on the target system, without changing it — catch drift before it blocks access or rotation.
**Heartbeat checking** periodically verifies whether the password stored in a secret is still valid on the target system, without changing it. On the configured schedule, Syteca connects to the target and checks whether the current credentials authenticate successfully. The result is recorded and shown as a **Heartbeat status** on the **Password Management** page.
**Use this when you need to:**
* Catch a secret whose password was changed outside Syteca — by a sysadmin, a scheduled task, or a security incident — before someone tries to use it or before rotation runs into it.
* Get an early warning on invalid credentials, instead of finding out only when [remote password rotation](/docs/pam/secrets/remote-password-rotation) or a connection attempt fails.
* Monitor a large secret inventory for drift at a glance, using the Heartbeat status column and filters.
Heartbeat checking is supported for:
* Active Directory account
* Windows account
* Unix account (SSH)
* MS SQL account
Not supported for Unix account (Telnet) or Web account secret types.
Heartbeat checking can also be configured and queried through the [Syteca ACB API](/docs/api/acb/endpoints/heartbeat) — including scheduling checks via [Add secret](/docs/api/acb/endpoints/add-secret) / [Update secret](/docs/api/acb/endpoints/update-secret), reading results via [Get secret](/docs/api/acb/endpoints/get-secret), and triggering an on-demand check via the [Heartbeat endpoint](/docs/api/acb/endpoints/heartbeat). This page covers the Management Tool UI; see those pages for API and CLI details.
## Enable Heartbeat checking when adding a secret
Heartbeat checking is configured on the **Automation** tab of the **Add Secret** panel, below the Remote Password Rotation section.
On the **Password Management** page, click **Add**.
In the **Add Secret** panel, select the **Automation** tab.
Select **Scheduled Heartbeat**.
In the **Heartbeat every** field, enter the interval value and select a time unit:
| Time unit | Accepted range |
| ---------------- | ----------------------------------------------------------------- |
| Minutes | 15–90 (the +/- step buttons cycle through 15, 30, 45, 60, 75, 90) |
| Hours | 1–99 |
| Days *(default)* | 1–99 |
The field is pre-filled with `30`.
Complete the remaining tabs as required, then click **Save**.
## Configure Heartbeat checking for an existing secret
On the **Password Management** page, open the secret to configure.
In the **Edit Secret** panel, select the **Automation** tab.
Toggle **Scheduled Heartbeat** on or off. When enabled, configure the **Heartbeat every** interval as above.
The **Heartbeat every** field is disabled while **Scheduled Heartbeat** is off.
Click **Save**.
Once configured, the Automation tab also shows:
| Element | Description |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Last heartbeat** | Date and time of the most recent check (automatic or manual). Shows **Never** if no check has run yet. |
| **Run heartbeat** | Triggers an immediate check, regardless of the schedule. Requires the same permissions as Password Rotation. Only available in the **Edit Secret** panel, not **Add Secret**. |
### Manual Heartbeat check (Run heartbeat)
Clicking **Run heartbeat** checks the secret's password validity immediately. **Last heartbeat** updates, and one of these appears:
| Notification | Meaning |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------- |
| **The password is valid.** | Authentication succeeded with the current credentials. |
| **The password is invalid.** | The system connected, but the credentials were rejected. **Scheduled Heartbeat** is automatically disabled — see the note below. |
| **Password status checking failed.** | The check couldn't complete (for example, the target host was unavailable). |
If a Heartbeat check returns **Invalid**, **Scheduled Heartbeat** is automatically disabled. Automatic checks don't resume until the toggle is manually re-enabled.
## View Heartbeat status on the Password Management page
Two optional columns — **Heartbeat status** and **Last heartbeat check** — can be added to the Secrets grid, both hidden by default.
On the **Password Management** page, click **Edit Columns**.
Check **Heartbeat status** and/or **Last heartbeat check**.
The selected columns now appear in the Secrets grid.
These columns aren't shown for sub-secrets (computers for which connections are allowed, as specified in an Active Directory secret) — same behavior as the Password Rotation columns. The date and time in **Last heartbeat check** always matches **Last heartbeat** on the Automation tab for the same secret.
### Heartbeat status values
| Status | When shown | Tooltip |
| ----------- | ------------------------------------------------------------------------------------------------ | ----------------------------- |
| **None** | No check has ever run for this secret. | — |
| **Valid** | The most recent check confirmed the password is valid. | Password is valid |
| **Invalid** | The most recent check found the password invalid. Scheduled Heartbeat is automatically disabled. | Password is not valid |
| **Failed** | The most recent check couldn't complete (target unreachable, connection error, etc.). | The heartbeat check is failed |
### Filter by Heartbeat status
Two filters are available on the Password Management page:
| Filter | Behavior |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
| **Heartbeat status** | Filter by **Valid**, **Invalid**, **Failed**, or **None** — same behavior as the existing Password Rotation Status filter. |
| **Last heartbeat check** | Filter by **Within the last \** or **Between \ – \** — same behavior as the existing Last Rotation Time filter. |
## Audit Log events
Every Heartbeat configuration change and manual check is recorded in the [Audit Log](/docs/administration/audit-log):
| Event | Category | Action | Details |
| ---------------------------------------------------- | -------------- | ------------------ | -------------------------------------- |
| New secret created with Scheduled Heartbeat enabled | Secret manager | Adding secret | Heartbeat period: `` |
| New secret created with Scheduled Heartbeat disabled | Secret manager | Adding secret | Heartbeat period: None |
| Scheduled Heartbeat enabled for an existing secret | Secret manager | Editing secret | Heartbeat period: `` |
| Scheduled Heartbeat disabled for an existing secret | Secret manager | Editing secret | Heartbeat period: None |
| Run heartbeat clicked in Edit Secret | Secret manager | Heartbeat checking | Manual heartbeat run |
Filter the Audit Log's **Action** filter for Heartbeat checking events specifically.
## System Health: System State and Tasks List
Heartbeat check results and errors also appear on the [System Health page](/docs/administration/dashboards/system-health-dashboards), in both **System State** and the **Tasks List**.
### System State
| Event | Category | Severity | Details |
| -------------------------------------- | -------------- | -------- | ------------------------------------------------------- |
| Automatic check succeeded | Scheduled task | None | Periodic heartbeat check for secret '``' |
| Automatic check failed | Server error | Medium | Heartbeat for `` failed. Error: `` |
| Manual check (Run heartbeat) succeeded | Scheduled task | None | Periodic heartbeat check for secret '``' |
| Manual check (Run heartbeat) failed | Server error | Medium | Heartbeat for `` failed. Error: `` |
### Tasks List
| Event | Details | Status |
| ---------------------------------- | --------------------------------------------------------- | -------- |
| Automatic check → password valid | The password is valid in: `` | Finished |
| Automatic check → password invalid | The password is invalid in: `` | Finished |
| Automatic check → check failed | The heartbeat check failed in: `` `` | Failed |
Every Heartbeat task uses the task name **Heartbeat check**. When a task shows **Failed**, the reason appears in the **Details** column — a known reason is "The host is unavailable."
## Related
Full secret configuration reference, including the Automation tab.
Automatically change a password instead of just checking it.
Trigger and configure Heartbeat checks via the ACB API or CLI.
Full audit trail reference.