tutorial

How to Monitor Cockpit (Linux Server Management) with Vigilmon

Cockpit is the built-in web-based admin interface for RHEL, Fedora, Ubuntu, and Debian. This guide shows you how to monitor the Cockpit web service, systemd socket activation, storage and container plugins, remote host connections, and TLS certificate health with Vigilmon.

Cockpit is the web-based Linux server administration interface built into every major Linux distribution — RHEL, Fedora, Ubuntu, Debian, CentOS Stream. It gives administrators a browser-based GUI for managing services, storage, networking, users, Podman containers, and KVM virtual machines without SSH. When Cockpit itself goes down, your web-based management path disappears and you're back to terminal-only access.

This tutorial shows you how to monitor Cockpit's web service, systemd socket activation, plugin health, remote host connections, and TLS certificate expiry using Vigilmon.

What You'll Set Up

  • Cockpit web service availability monitor (HTTPS on port 9090)
  • systemd socket activation health heartbeat (cockpit.socket)
  • Storage plugin health check (cockpit-storaged / udisks2)
  • Container management plugin health (cockpit-podman)
  • Remote host connection health check
  • TLS certificate expiry alert
  • PCP metrics collection health heartbeat

Prerequisites

  • Cockpit installed and enabled on a Linux server
  • cockpit.socket systemd unit active
  • The server accessible over HTTPS on port 9090
  • A free Vigilmon account

Step 1: Monitor the Cockpit Web Service

Cockpit listens on port 9090 over HTTPS. The root path serves the login page.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. URL: https://your-server.example.com:9090/
  4. Expected HTTP status: 200 or 302.
  5. Check interval: 1 minute.
  6. Click Save.

This catches the most common failures: the cockpit-ws process crashing, the port becoming unreachable, or the systemd socket failing to activate the service.

Step 2: Monitor systemd Socket Activation

Cockpit uses systemd socket-based activation — cockpit.socket listens on port 9090 and only starts cockpit.service on the first connection. If cockpit.socket is inactive or failed, Cockpit will appear down even though cockpit.service isn't explicitly running (that's normal).

Add a heartbeat that checks socket unit state:

#!/bin/bash
# Check that cockpit.socket is active (listening)
if systemctl is-active --quiet cockpit.socket; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_SOCKET_HEARTBEAT_ID
fi

Add to cron every 2 minutes:

*/2 * * * * root /opt/scripts/check-cockpit-socket.sh
  1. Click Add Monitor → Cron Heartbeat in Vigilmon.
  2. Set expected interval to 2 minutes.
  3. Copy the heartbeat URL into the script.

A cockpit.socket unit in failed or inactive state skips the ping, and Vigilmon alerts after one missed interval.

Step 3: Monitor the Cockpit Bridge Process

The cockpit-bridge process executes privileged operations on behalf of the Cockpit web UI. Without it, authenticated sessions connect but all management actions fail silently.

Add a heartbeat that confirms bridge availability by hitting the /ping endpoint (which Cockpit exposes for health checks):

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://your-server.example.com:9090/ping
  3. Expected status: 200.
  4. Response body contains: "cockpit"
  5. Check interval: 2 minutes.
  6. Click Save.

The /ping endpoint returns a JSON payload confirming the bridge is active. A 502 or 504 means the cockpit-ws process is up but the bridge isn't responding.

Step 4: Monitor Storage Plugin Health (cockpit-storaged)

The cockpit-storaged plugin interfaces with udisks2 to provide disk and RAID management. If udisks2 crashes or its D-Bus service becomes unavailable, the Storage tab in Cockpit will fail to load.

Add a heartbeat that checks the udisks2 service:

#!/bin/bash
# Check udisks2 D-Bus service is running
if systemctl is-active --quiet udisks2; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_STORAGE_HEARTBEAT_ID
fi

For environments where storage management is critical (RAID arrays, LVM volumes), run this check every minute.

Step 5: Monitor Container Management Plugin (cockpit-podman)

If you use Cockpit to manage Podman containers, the cockpit-podman plugin depends on the Podman socket being active.

Add a heartbeat that checks Podman socket availability:

#!/bin/bash
# Check Podman system socket is running
if systemctl is-active --quiet podman.socket; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_PODMAN_HEARTBEAT_ID
fi

For rootless Podman (user-level socket), check the user socket instead:

#!/bin/bash
# Check user-level Podman socket for the cockpit-using user
if systemctl --user is-active --quiet podman.socket; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_PODMAN_HEARTBEAT_ID
fi

Step 6: Monitor Remote Host Connections

Cockpit can manage multiple remote Linux hosts through SSH from a single dashboard. If a remote host becomes unreachable, that host's management tabs silently fail.

Add TCP port checks for each remote host Cockpit manages:

  1. Click Add Monitor → TCP Port.
  2. Host: remote-host-1.example.com, Port: 22.
  3. Check interval: 2 minutes.
  4. Click Save.

Repeat for each remote host. An SSH port check confirms the host is up and accepting connections — if Cockpit can't reach it via SSH, it can't manage it.

For a deeper check that verifies end-to-end Cockpit remote access, add a heartbeat on each remote host:

#!/bin/bash
# Run on each remote host Cockpit manages
curl -sf https://vigilmon.online/heartbeat/YOUR_REMOTE_HOST_HEARTBEAT_ID

Step 7: Monitor Virtual Machine Management Plugin (cockpit-machines)

The cockpit-machines plugin uses libvirt/KVM for VM management. If libvirtd is not running, the Virtual Machines tab in Cockpit fails to load.

Add a heartbeat that checks the libvirt daemon:

#!/bin/bash
if systemctl is-active --quiet libvirtd || systemctl is-active --quiet virtqemud; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_LIBVIRT_HEARTBEAT_ID
fi

The check covers both the legacy libvirtd monolithic daemon and the newer split virtqemud daemon used in recent RHEL/Fedora releases.

Step 8: Monitor PCP Metrics Collection

Cockpit integrates with PCP (Performance Co-Pilot) to provide historical resource graphs. If the PCP daemon (pmcd) stops collecting metrics, the resource history graphs in Cockpit go blank.

#!/bin/bash
if systemctl is-active --quiet pmcd; then
  curl -sf https://vigilmon.online/heartbeat/YOUR_PCP_HEARTBEAT_ID
fi

Set heartbeat interval to 5 minutes in Vigilmon — PCP is a monitoring dependency, not a critical service path.

Step 9: TLS Certificate Expiry Monitoring

Cockpit generates its own self-signed certificate by default at /etc/cockpit/ws-certs.d/0-self-signed.cert. Self-signed certificates don't expire soon after install (they're typically valid for 1–10 years), but if you replace the default with a short-lived certificate from Let's Encrypt, expiry monitoring becomes critical.

  1. Open the Cockpit HTTP monitor from Step 1.
  2. Enable Monitor SSL certificate.
  3. Set Alert when certificate expires in less than 21 days.
  4. Click Save.

To replace the self-signed cert with a Let's Encrypt certificate:

# Install certbot and generate a certificate
certbot certonly --standalone -d cockpit.your-domain.example.com

# Combine the cert and key for Cockpit
cat /etc/letsencrypt/live/cockpit.your-domain.example.com/fullchain.pem \
    /etc/letsencrypt/live/cockpit.your-domain.example.com/privkey.pem \
    > /etc/cockpit/ws-certs.d/letsencrypt.cert

systemctl restart cockpit

After installing a real certificate, the 21-day Vigilmon alert gives you enough time to investigate renewal failures before users hit browser certificate warnings.

Step 10: Configure Alert Channels

  1. Go to Alert Channels → Add Channel.
  2. Add email, Slack, or a webhook.
  3. For the web service and socket monitors, set Consecutive failures before alert to 1 — Cockpit going down is an immediate issue.
  4. For storage, container, and VM plugin heartbeats, set to 2.
  5. For PCP metrics, set to 3 — missing PCP data doesn't affect server operation, only monitoring graphs.

Quick-start: Install All Heartbeat Scripts

Here's a combined setup script that installs all the cron heartbeats at once:

#!/bin/bash
# Replace the YOUR_*_HEARTBEAT_ID placeholders with your actual Vigilmon IDs

VIGIL_SOCKET="https://vigilmon.online/heartbeat/YOUR_SOCKET_HEARTBEAT_ID"
VIGIL_STORAGE="https://vigilmon.online/heartbeat/YOUR_STORAGE_HEARTBEAT_ID"
VIGIL_PODMAN="https://vigilmon.online/heartbeat/YOUR_PODMAN_HEARTBEAT_ID"
VIGIL_LIBVIRT="https://vigilmon.online/heartbeat/YOUR_LIBVIRT_HEARTBEAT_ID"
VIGIL_PCP="https://vigilmon.online/heartbeat/YOUR_PCP_HEARTBEAT_ID"

mkdir -p /opt/vigil-checks

cat > /opt/vigil-checks/cockpit-health.sh << 'EOF'
#!/bin/bash
systemctl is-active --quiet cockpit.socket && curl -sf "$VIGIL_SOCKET"
systemctl is-active --quiet udisks2 && curl -sf "$VIGIL_STORAGE"
systemctl is-active --quiet podman.socket 2>/dev/null && curl -sf "$VIGIL_PODMAN"
systemctl is-active --quiet libvirtd 2>/dev/null || systemctl is-active --quiet virtqemud 2>/dev/null && curl -sf "$VIGIL_LIBVIRT"
systemctl is-active --quiet pmcd 2>/dev/null && curl -sf "$VIGIL_PCP"
EOF

chmod +x /opt/vigil-checks/cockpit-health.sh

# Add to cron
echo "*/2 * * * * root /opt/vigil-checks/cockpit-health.sh" > /etc/cron.d/cockpit-vigil

Summary

| Monitor | Type | Target | What It Catches | |---------|------|--------|-----------------| | Cockpit web UI | HTTP | :9090/ | Web service crash, port down | | /ping endpoint | HTTP | :9090/ping | Bridge process failure | | cockpit.socket | Heartbeat | systemctl is-active | Socket activation failure | | udisks2 | Heartbeat | systemctl is-active | Storage plugin broken | | Podman socket | Heartbeat | systemctl is-active | Container plugin broken | | Remote hosts | TCP | :22 per host | SSH unreachable, remote management lost | | libvirtd/virtqemud | Heartbeat | systemctl is-active | VM management plugin broken | | PCP (pmcd) | Heartbeat | systemctl is-active | Metrics history lost | | TLS certificate | SSL | Port 9090 | Certificate expiry |

Cockpit is your browser-based window into Linux server management — when it's down, you're SSH-only. With Vigilmon watching the web service, socket activation, key plugins, and certificate health, you'll know before your team loses their management interface.

Get started free at vigilmon.online — no credit card required.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles