Monitoring FleetDM with Vigilmon

FleetDM is the open-source MDM platform that teams use to manage macOS, Windows, and Linux endpoints at scale. It combines osquery-powered device visibility with vulnerability scanning, software inventory, and policy enforcement — all self-hosted. That self-hosted control means you own the uptime. When the Fleet web server goes down or the MDM enrollment endpoint becomes unreachable, enrolled devices can't check in and your security posture degrades silently. Vigilmon gives you continuous monitoring across every FleetDM service so you know the moment something breaks.

What You'll Set Up

• Web server availability monitoring (port 8080)
• MDM enrollment endpoint health (port 8022)
• Device check-in and osquery live query health
• Vulnerability scanning pipeline heartbeat
• Software inventory sync monitoring
• Fleet agent (fleetd) connectivity check
• MySQL database availability
• Redis cache health

Prerequisites

• FleetDM deployed and accessible (self-hosted, Docker, or Kubernetes)
• A free Vigilmon account

Step 1: Monitor the Fleet Web Server

The Fleet web UI and REST API both live on port 8080 (or 443 if you've terminated TLS in front of it). This is your primary availability signal.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter your Fleet URL: https://fleet.yourdomain.com/healthz
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

FleetDM exposes a built-in health endpoint at /healthz that returns 200 OK when the server is healthy and 503 when dependencies are unavailable. Always probe /healthz rather than the root — the root redirects unauthenticated requests to the login page, which masks real failures.

Step 2: Monitor the MDM Enrollment Endpoint

FleetDM's MDM functionality runs on port 8022 and handles Apple MDM check-ins, enrollment profiles, and Windows MDM commands. If this port is down, enrolled devices can't receive policies or commands.

1. Add a new TCP monitor in Vigilmon.
2. Set Host to your Fleet server hostname.
3. Set Port to 8022.
4. Set Check interval to 2 minutes.
5. Click Save.

For Apple MDM specifically, you can also probe the enrollment SCEP endpoint over HTTPS:

https://fleet.yourdomain.com/mdm/apple/scep

Add an HTTP monitor for this URL with expected status 200. A failure here means new Apple device enrollments will fail even if the main web UI appears healthy.

Step 3: Monitor Device Check-In Health

FleetDM agents (fleetd) contact the Fleet server on a configurable interval to report inventory and run queries. You can verify the live query execution path is working by probing the API:

https://fleet.yourdomain.com/api/v1/fleet/status/live_query

Add an HTTP monitor for this endpoint with expected status 200. A non-200 response or timeout here means osquery live queries will fail for your entire fleet.

For a more active check, use Vigilmon's cron heartbeat to verify that at least one device is checking in regularly:

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected interval to 30 minutes (adjust based on your Fleet check-in interval).
3. Copy the heartbeat URL.
4. Add a Fleet automation that pings the heartbeat URL when device check-in counts are healthy. You can do this with a simple cron job on your Fleet server:

#!/bin/bash
# Check that Fleet has active device check-ins
ACTIVE=$(fleetctl get hosts --status=online --json 2>/dev/null | jq 'length')
if [ "$ACTIVE" -gt "0" ]; then
  curl -s https://vigilmon.online/heartbeat/YOUR_HEARTBEAT_ID
fi

Schedule this via cron every 30 minutes. If the count drops to zero or the script fails, the heartbeat stops and Vigilmon alerts you.

Step 4: Monitor Vulnerability Scanning Pipeline

FleetDM runs a background vulnerability scanning pipeline that compares software inventory against CVE databases. If the pipeline stalls, your vulnerability reports go stale.

1. Add a Cron Heartbeat monitor in Vigilmon.
2. Set the expected interval based on your Fleet vulnerability scanning schedule (default is every hour).
3. Copy the heartbeat URL.
4. On your Fleet server, add a cron job that checks the last vulnerability scan time via the Fleet API and pings the heartbeat if it's recent:

#!/bin/bash
FLEET_TOKEN="your_api_token"
FLEET_URL="https://fleet.yourdomain.com"

# Get last vulnerability sync time
LAST_SYNC=$(curl -s -H "Authorization: Bearer $FLEET_TOKEN" \
  "$FLEET_URL/api/v1/fleet/software/count" | jq -r '.count')

# Ping heartbeat if API responds
if [ -n "$LAST_SYNC" ]; then
  curl -s https://vigilmon.online/heartbeat/YOUR_VULN_HEARTBEAT_ID
fi

Step 5: Monitor Software Inventory Sync

FleetDM's software inventory sync aggregates installed applications across all devices. Probe the software count endpoint to verify the pipeline is running:

Add an HTTP monitor for:

https://fleet.yourdomain.com/api/v1/fleet/software/count

Set Expected HTTP status to 200 and add a keyword check: verify the response body contains "count". A missing or empty count field indicates the inventory pipeline has stalled.

Step 6: Monitor MySQL Database Availability

FleetDM stores all device state, policies, and query results in MySQL. A database failure takes down the entire platform.

Use Vigilmon's TCP monitor to verify MySQL is listening:

1. Add a TCP monitor.
2. Set Host to your MySQL server hostname or IP.
3. Set Port to 3306.
4. Set Check interval to 1 minute.
5. Click Save.

If MySQL runs on the same host as Fleet, point to localhost or the internal IP. For RDS or managed MySQL, use the endpoint hostname.

For deeper database health, expose a simple health script via a local HTTP endpoint:

#!/bin/bash
# /usr/local/bin/mysql-health-server (run via socat or a minimal HTTP wrapper)
mysql -u fleet -pfleetpassword fleetdm -e "SELECT 1" &>/dev/null && echo "ok" || echo "fail"

Then add an HTTP monitor pointing to that local health endpoint.

Step 7: Monitor Redis Cache

FleetDM uses Redis for live query result buffering, session storage, and caching. Redis failures cause live queries to hang and sessions to break.

1. Add a TCP monitor in Vigilmon.
2. Set Host to your Redis server hostname.
3. Set Port to 6379.
4. Set Check interval to 1 minute.
5. Click Save.

If Redis is accessible from your Fleet server, you can also add a cron heartbeat that runs a Redis PING check:

#!/bin/bash
RESULT=$(redis-cli -h your-redis-host ping 2>/dev/null)
if [ "$RESULT" = "PONG" ]; then
  curl -s https://vigilmon.online/heartbeat/YOUR_REDIS_HEARTBEAT_ID
fi

Schedule every 5 minutes. A silent Redis failure will stop this heartbeat and trigger an alert.

Step 8: Configure SSL Certificate Monitoring

FleetDM's MDM functionality is particularly sensitive to certificate issues — Apple MDM requires valid TLS certificates on the enrollment endpoint. A certificate expiry will silently break all Apple device enrollments.

1. Open the HTTP monitor you created for https://fleet.yourdomain.com in Step 1.
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 21 days.
4. Repeat for the MDM-specific domain if it's on a separate hostname.

Step 9: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or a PagerDuty webhook.
2. On endpoint monitors, set Consecutive failures before alert to 2 — Fleet can have brief processing delays during heavy query load.
3. On MySQL and Redis TCP monitors, set consecutive failures to 1 — database failures are never transient.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP health | /healthz | Fleet server down, dependency failure | | TCP MDM port | :8022 | MDM enrollment endpoint unreachable | | HTTP SCEP | /mdm/apple/scep | Apple enrollment broken | | HTTP live query | /api/v1/fleet/status/live_query | osquery pipeline failure | | Cron heartbeat | Device check-in script | Fleet agents not checking in | | Cron heartbeat | Vulnerability scan script | Vuln pipeline stalled | | HTTP inventory | /api/v1/fleet/software/count | Software inventory sync broken | | TCP MySQL | :3306 | Database unavailable | | TCP Redis | :6379 | Cache layer down | | SSL certificate | Fleet domain | Certificate expiry breaks MDM |

FleetDM is your window into every endpoint in your organization — but only if the platform itself is healthy. With Vigilmon monitoring every layer from the web UI to the database, you'll know about failures before your devices do.