Monitoring Form.io with Vigilmon

Form.io treats forms as your data model — a Node.js API server backed by MongoDB that other applications embed and submit to via the form.io JavaScript SDK. Healthcare organizations, government agencies, and enterprises rely on it for structured data collection with complex workflows and role-based access. That reliance makes availability non-negotiable: a crashed form.io API server breaks every form embedded across every application that depends on it, often with no visible error message until a user tries to submit. Vigilmon monitors your form.io deployment end-to-end — API health, admin panel, SSL certificate compliance, and submission pipeline integrity — so you catch failures before your downstream applications do.

What You'll Set Up

• Form.io API server health monitor (Node.js/Express)
• API availability check (database connectivity signal)
• Admin panel readiness monitor
• SSL certificate expiry alerts (HIPAA/GDPR compliance)
• Heartbeat monitor for the full submission pipeline

Prerequisites

• Form.io API server running on port 3000 (or behind a reverse proxy on 80/443)
• A free Vigilmon account

Step 1: Monitor the Form.io API Server Health

The form.io API server exposes a /health endpoint that confirms the Node.js/Express process is running and accepting connections.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter: https://forms.yourcompany.com/health (or http://yourserver:3000/health if not behind a proxy).
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Under Keyword check, enter OK or status.
7. Click Save.

If the Node.js process crashes, runs out of memory, or is killed by the OOM killer, this monitor fires within one minute — before any embedded form in your applications encounters a submission failure.

Step 2: Monitor the Form.io API Availability

The /form endpoint returns a JSON array of form definitions. Even an empty array (for a fresh installation) returns [] with HTTP 200 when the API and MongoDB are both healthy. A 500 response means MongoDB is down — all API endpoints return 500 when the database is unavailable.

1. Click Add Monitor.

2. Set Type to HTTP / HTTPS.

3. Enter: https://forms.yourcompany.com/form.

4. Set Expected HTTP status to 200 (if your API is public or you're not using auth on this endpoint).

   Or, if your deployment requires authentication on all endpoints, monitor for an expected 401:

   • Enter: https://forms.yourcompany.com/form.
   • Set Expected HTTP status to 401.

5. Click Save.

Both a 200 and a 401 response confirm the API layer is functioning and MongoDB is connected. A 500 confirms MongoDB failure — the distinction matters for rapid diagnosis.

Step 3: Monitor the Form.io Admin Panel

The admin portal is the interface for managing form definitions, roles, and submissions. A 200 response with the form.io branding confirms the frontend assets are being served and the admin routing is intact.

1. Click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter: https://forms.yourcompany.com/app/admin (or your configured admin path).
4. Set Expected HTTP status to 200.
5. Under Keyword check, enter form.io.
6. Click Save.

An admin panel failure while the API itself is healthy typically indicates a corrupted asset build, a missing static file directory, or a misconfigured nginx location block — worth catching independently.

Step 4: SSL Certificate Alerts

Form.io deployments frequently handle regulated data: healthcare intake forms (HIPAA), government applications (FedRAMP), financial records (PCI DSS), and GDPR-covered personal data. HTTPS is not just best practice — it is a compliance requirement for data in transit. An expired certificate may directly violate your compliance posture and trigger audit findings.

1. Open the API server monitor created in Step 1.
2. Scroll to the SSL certificate section.
3. Enable Monitor SSL certificate.
4. Set Alert when certificate expires in less than 30 days.
5. Click Save.

For regulated deployments, a 30-day lead time allows time for formal certificate renewal procedures, change advisory board (CAB) approval if required, and deployment testing before the expiry deadline.

Step 5: Heartbeat Monitoring for the Submission Pipeline

The form.io API can be running and returning 200 on /health while the submission pipeline is partially broken. Authentication failures, MongoDB write errors, and form schema validation problems can all cause submission POST requests to fail without affecting the health endpoint. Any embedded form in your applications will silently reject user submissions.

Use a heartbeat monitor to run an hourly end-to-end pipeline test:

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set Expected ping interval to 60 minutes.
3. Copy the heartbeat URL: https://vigilmon.online/heartbeat/YOUR_TOKEN.

Create a dedicated heartbeat test form in form.io (note its formId). Then write the pipeline test:

#!/bin/bash
set -e

FORMIO_URL="https://forms.yourcompany.com"
ADMIN_EMAIL="admin@yourcompany.com"
ADMIN_PASSWORD="YOUR_ADMIN_PASSWORD"
HEARTBEAT_FORM_ID="YOUR_FORM_ID"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/YOUR_TOKEN"

# Step 1: Authenticate
AUTH_RESPONSE=$(curl -sf -X POST \
  "$FORMIO_URL/user/login" \
  -H "Content-Type: application/json" \
  -d "{\"data\":{\"email\":\"$ADMIN_EMAIL\",\"password\":\"$ADMIN_PASSWORD\"}}")

JWT_TOKEN=$(echo "$AUTH_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

# Step 2: Verify forms list is accessible
curl -sf "$FORMIO_URL/form" \
  -H "x-jwt-token: $JWT_TOKEN" \
  -o /dev/null

# Step 3: Submit a test submission to the heartbeat form
SUBMISSION_RESPONSE=$(curl -sf -X POST \
  "$FORMIO_URL/form/$HEARTBEAT_FORM_ID/submission" \
  -H "Content-Type: application/json" \
  -H "x-jwt-token: $JWT_TOKEN" \
  -d '{"data":{"heartbeat":"ok","timestamp":"'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'"}}')

SUBMISSION_ID=$(echo "$SUBMISSION_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['_id'])")

# Step 4: Delete the test submission (keep the test form clean)
curl -sf -X DELETE \
  "$FORMIO_URL/form/$HEARTBEAT_FORM_ID/submission/$SUBMISSION_ID" \
  -H "x-jwt-token: $JWT_TOKEN"

# Step 5: Signal success
curl -sf "$HEARTBEAT_URL"

Schedule with cron:

0 * * * * /path/to/formio-pipeline-test.sh >> /var/log/formio-heartbeat.log 2>&1

This test exercises authentication, form schema loading, MongoDB submission write, and submission deletion — the full lifecycle any embedded form depends on. If any step fails, the script exits and Vigilmon never receives its ping.

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add email, Slack, PagerDuty, or a webhook to your incident management system.
2. For the API server monitor, set Consecutive failures before alert to 2 — Node.js process restarts via PM2 take a few seconds and should not trigger a false alarm.
3. For the SSL certificate monitor, set Alert immediately with a notification to your compliance team as well as your ops team.
4. For the submission pipeline heartbeat, alert immediately on the first missed ping — a silent submission failure is always urgently actionable.

Summary

| Monitor | Target | What It Catches | |---|---|---| | API server health | /health | Node.js/Express crash, OOM kill | | API availability | /form (200 or 401) | MongoDB down, all endpoints broken | | Admin panel | /app/admin | Frontend asset failure, routing error | | SSL certificate | Form.io domain | Cert expiry, compliance violation | | Submission heartbeat | Hourly cron → Vigilmon | Auth failure, MongoDB write error, pipeline broken |

Form.io's API-first architecture means a single failed deployment can break form submissions across every application in your ecosystem. With Vigilmon watching the Node.js health endpoint, MongoDB connectivity, admin panel availability, SSL certificate compliance, and the full submission pipeline, you have the observability coverage that enterprise and regulated deployments require.