We set up cross-monitoring between two services: each one watches the other. One of them exposes HTTP endpoints, so checking it is easy. The other exposes nothing by design (less surface, less risk) and for that side we picked the only thing that seemed possible: a ping.
A ping tells you the host is on. It doesn't tell you the service is doing its job.
We tested our provider's rescue mode with no real emergency, just to confirm it worked. The service came up on a different operating system, with none of its tasks running, its disk not even mounted. The ping kept answering that everything was fine, for the whole test window. It had been saying that for days, because it couldn't say anything else.
The criterion we adopted: a probe has to verify that the service is working, not that the host responds. It applies to every probe, present or future. The design question is not what is easy to measure, but what evidence could only exist if the service were actually doing its job.
The ping stayed: for the one thing it does answer, it is cheap. On top of it we added the check that was missing, without exposing anything new. The service we couldn't probe is itself a watcher: every few minutes it calls the other one to check on it, and those calls were always written down on the receiving end. That entry is now the probe. If the last one is less than twenty minutes old, the service is working.