Monitoring Bacula with Vigilmon

Bacula is a battle-tested enterprise backup platform trusted in data centers worldwide, with a client-server-catalog architecture that separates the Director (job orchestration), Storage daemon (tape/disk I/O), and File daemon (client-side agent). Baculum provides the modern web management interface and REST API on top of this stack. But a complex distributed system has more failure points — and Bacula's email reporting is easy to misconfigure or miss. Vigilmon provides an independent monitoring layer, watching Bacula's network services and confirming backup jobs complete on schedule.

What You'll Set Up

• HTTP monitor for the Baculum web UI (port 9096)
• Baculum REST API availability check on /api/v2/jobs
• TCP port monitor for the Bacula Director (port 9101)
• SSL certificate alerts for HTTPS Baculum deployments
• Cron heartbeat for Bacula scheduled backup jobs

Prerequisites

• Bacula 11+ with the Baculum web interface installed
• Baculum accessible at http://your-server:9096 (or HTTPS on port 9095)
• Bacula Director running and accessible on TCP port 9101
• A free Vigilmon account

Step 1: Monitor the Baculum Web UI

Baculum's dashboard gives you real-time visibility into Bacula job status, volumes, and schedules. If it goes offline, you're flying blind. Add a monitor for the dashboard health check:

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the URL: http://your-server:9096/panel/dashboard
4. Set Check interval to 5 minutes.
5. Set Expected HTTP status to 200.
6. Click Save.

For SSL-enabled Baculum (recommended for production), use port 9095 and HTTPS:

https://your-server:9095/panel/dashboard

A 200 from the dashboard endpoint confirms the Baculum PHP application and its web server (Apache or nginx) are running.

Step 2: Monitor the Baculum REST API

Baculum's REST API is the integration layer for automation and external tooling. Monitor the /api/v2/jobs endpoint to verify the API layer is functional:

1. Click Add Monitor → HTTP / HTTPS.
2. Enter the URL: http://your-server:9096/api/v2/jobs
3. Set Check interval to 5 minutes.
4. Set Expected HTTP status to 200 (or 401 if your API requires authentication — a 401 confirms the API is responding, just requiring credentials).
5. Click Save.

If you have API credentials configured, you can use Vigilmon's custom headers to pass Basic Auth:

• Add header: Authorization: Basic BASE64_ENCODED_CREDENTIALS

This makes the monitor fully authenticated and validates that the API backend is processing requests, not just returning static error pages.

Step 3: TCP Port Monitor for the Bacula Director

The Bacula Director (port 9101) is the orchestration engine — without it, no backup jobs run, regardless of whether the Baculum UI appears healthy. Add a TCP port monitor to detect Director process failures independently:

1. Click Add Monitor → TCP Port.
2. Enter Host: your-server
3. Enter Port: 9101
4. Set Check interval to 5 minutes.
5. Click Save.

A TCP connection to port 9101 confirms the bacula-dir process is running and accepting connections. This is the fastest way to detect a Director crash that Baculum's UI hasn't yet reflected.

You can also add TCP monitors for the Storage daemon (port 9103) and File daemon (port 9102) if those run on the same host:

| Daemon | Default Port | |---|---| | Director | 9101 | | File daemon | 9102 | | Storage daemon | 9103 |

Step 4: SSL Certificate Alerts for HTTPS Baculum

Production Baculum deployments should run behind HTTPS to protect credentials and backup metadata in transit. Certificate expiry on the Baculum server will break web UI access and API clients simultaneously.

1. Open the Baculum HTTPS monitor from Step 1.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

If you use a self-signed certificate (common in air-gapped environments), Vigilmon can still monitor the expiry date and alert before it lapses. To generate a renewed self-signed certificate:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/bacula/bacula-cert.key \
  -out /etc/bacula/bacula-cert.crt \
  -subj "/CN=backup.internal"

Then restart the Baculum web server to load the new certificate.

Step 5: Heartbeat Monitoring for Bacula Scheduled Jobs

Bacula's job scheduler runs backup jobs defined in bacula-dir.conf. A misconfiguration, a full storage volume, or a catalog database error can silently stop jobs from running. Use Vigilmon's cron heartbeat to verify jobs are completing on schedule.

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected ping interval to match your most critical backup schedule (e.g. 1440 minutes for daily, 10080 for weekly full backup).
3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

Configure Bacula to ping the heartbeat after each successful job using the RunScript directive in your job definition:

Job {
  Name = "DailyClientBackup"
  Type = Backup
  Client = my-client-fd
  FileSet = "Full Set"
  Schedule = "WeeklyCycle"
  Storage = File
  Messages = Standard
  Pool = Default
  RunScript {
    RunsOnSuccess = Yes
    RunsOnClient = No
    Command = "curl -s https://vigilmon.online/heartbeat/abc123"
  }
}

The RunsOnSuccess = Yes and RunsOnClient = No directives ensure the heartbeat ping only fires when the job completes successfully, and runs on the Director host (where curl is available).

To verify the RunScript is configured correctly, check the Bacula Director log after the next scheduled run:

tail -n 50 /var/log/bacula/bacula.log | grep -E "heartbeat|curl"

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add email, Slack, or a webhook.
2. Set Consecutive failures before alert to 2 on the Baculum UI and API monitors.
3. Set the TCP port monitors to alert on 1 failure — a Director that's unreachable for a full check cycle is always urgent.
4. Set the heartbeat alert to 1 missed ping — a missed backup window needs investigation before the next backup window arrives.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP (Baculum UI) | :9096/panel/dashboard | Baculum web server down | | HTTP (REST API) | :9096/api/v2/jobs | API layer failure | | TCP port | :9101 (Director) | Bacula Director crash | | TCP port | :9103 (Storage) | Storage daemon crash | | SSL certificate | https://your-server:9095 | Baculum cert expiry | | Cron heartbeat | Job RunScript ping | Silent job scheduler failure |

Bacula's enterprise architecture is its strength — but distributed systems need distributed monitoring. With Vigilmon watching the Baculum UI, the REST API, the Director TCP port, and backup job heartbeats, you'll catch failures at every layer of the stack before they become data loss events.