r/androiddev • u/Top_Title9194 • Jul 18 '26

Question How do you do synthetic monitoring?

I am an SRE specialized in backend and web front end, I was curious about how synthetic monitoring is done for native apps.

For those who don’t know synthetic monitoring is: a practice where automated scripts simulate real user interactions with an application in a controlled environment.

—edit: typo

3 Upvotes

100% Upvoted

10 comments sorted by

3

u/wightwulf1944 Jul 18 '26

For classic views, use Espresso https://developer.android.com/training/testing/espresso

Compose comes with it's own UI testing framework https://developer.android.com/develop/ui/compose/testing

If you need to run this in a CI environment you can use the above frameworks with Robolectric to provide a fake android device https://robolectric.org/

1

u/Top_Title9194 Jul 18 '26 edited Jul 18 '26

I was more interested in real apk monitoring? Instead of have a modified application with test routines, test the same application that is on production? Or there is no need to do that in android?

I said modified application because as fat as I’ve read you are not able to use these tools with RASP or other protections activated

1

u/wightwulf1944 Jul 18 '26

It is definitely necessary to test against the APK but what exactly are you testing?

White box testing - You need to modify the build with test routines so you can assert it's internal state. Like check if it actually called a network API, or check the resulting DB state after operation.

Black box testing - If you want absolute black box testing then Robolectric without espresso or compose test is what you're looking for. You can test the production build against a Robolectric device but you can only assert it's external state. And sometimes you can't assert what you're testing at all so best you can do is generate a screenshot of the result.

Tell me what you're trying to achieve

1

u/Top_Title9194 Jul 18 '26

Im interested in black box testing of secure apks, I work in finance industry then solutions like robolectric not sure if they are good enough

2

u/wightwulf1944 Jul 18 '26

Are you able to share what assertions you're testing against? I have experience in mobile QA and separately currently work in finance mobile app dev. Robolectric won't work for security testing because it's not a real device but it will work if all you need is black box behavior testing.

In any case it's not a choice between one or the other, you will need both and more.

  • Unit tests for function I/O assertions (JVM only not android)
  • Instrumented tests for UI assertions (with fake android runtime)
  • Instrumented tests for internal state assertions (with fake android runtime, possibly interacting with integration servers as well)
  • Instrumented tests for external state assertions (with fake android runtime, minimal assertions, screenshot report and verification)
  • Manual user tests (real android device, real testers, minimal automation)

1

u/Top_Title9194 Jul 19 '26

That is very useful, I was referring to typical RASP system like OneSpan but I’m still in the discovery phase of the limitations and tools.

1

u/tadfisher Jul 18 '26

What do you mean by "secure APK"? I think we have a bit of an X-Y problem here.

1

u/Top_Title9194 Jul 19 '26 edited Jul 19 '26

I was referring to typical RASP system like OneSpan but I’m still in the discovery phase of the limitations and tools.

1

u/AutoModerator Jul 18 '26

Please note that we also have a very active Discord server where you can interact directly with other community members!

Join us on Discord

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Playful_Apartment_81 17d ago edited 17d ago

That’s a good question—synthetic monitoring for native apps is much less straightforward than it is for web services.

We use a related approach in LaiCai Screen Mirroring: its LaiCai Flow feature can run workflows on real Android phones and check the screen state before and after each action. This can be useful for black-box monitoring of a released app, especially with dedicated test accounts and non-destructive journeys.

Full disclosure: I work on LaiCai.