tutorial

Monitoring FreeIPA with Vigilmon

FreeIPA is the identity backbone for Linux environments — when it goes down, logins fail across your entire infrastructure. Here's how to monitor FreeIPA's web UI, API, LDAP, Kerberos, and replication with Vigilmon.

FreeIPA is the leading open-source enterprise identity management system for Linux and Unix environments — integrating LDAP, Kerberos, DNS, PKI, and a Certificate Authority into a single cohesive platform. It's the upstream project for Red Hat Identity Management (RHEL IdM). When FreeIPA is healthy, authentication is invisible. When it fails, SSH logins hang, sudo stops working, and web apps that rely on LDAP authentication go dark across your entire infrastructure. Vigilmon gives you early warning before a FreeIPA outage becomes an infrastructure-wide lockout.

What You'll Set Up

  • HTTPS monitor for the FreeIPA web UI (port 443, /ipa/ui/)
  • JSON-RPC API availability check on /ipa/json
  • TCP port monitors for LDAP (389) and Kerberos (88)
  • SSL certificate alerts for FreeIPA's HTTPS server and CA
  • Cron heartbeat for FreeIPA replication health checks

Prerequisites

  • FreeIPA 4.9+ installed (Fedora 36+, RHEL 8+, AlmaLinux 8+, or Rocky Linux 8+)
  • FreeIPA web UI accessible at https://ipa.yourdomain.com
  • Admin credentials for the FreeIPA instance
  • A free Vigilmon account

Step 1: Monitor the FreeIPA Web UI

The FreeIPA web interface serves as the primary management surface for user, group, host, and policy management. A healthy response from /ipa/ui/ confirms the Apache HTTPD service and the IPA framework are running:

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter the URL: https://ipa.yourdomain.com/ipa/ui/
  4. Set Check interval to 5 minutes.
  5. Set Expected HTTP status to 200.
  6. Click Save.

FreeIPA always uses HTTPS (port 443) — it does not serve the IPA interface over plain HTTP. The /ipa/ui/ path returns the single-page application shell; a 200 confirms both the web server and the IPA application framework are up.

Step 2: Monitor the FreeIPA JSON-RPC API

FreeIPA's entire management layer — user creation, policy management, Kerberos configuration — runs through the /ipa/json endpoint. Monitoring it with a lightweight ping command verifies the Python backend (ipa-wsgi) is healthy:

  1. Click Add Monitor → HTTP / HTTPS.
  2. Enter the URL: https://ipa.yourdomain.com/ipa/json
  3. Set Method to POST.
  4. Set Request body: 
    {"method":"ping","params":[[], {}],"id":0}
  5. Add header: Content-Type: application/json
  6. Set Expected HTTP status to 200.
  7. Enable Keyword check and set keyword to "summary":"IPA server version".
  8. Click Save.

The ping method requires no authentication and returns server version information. The keyword check confirms the API is executing real IPA logic, not just returning a static error page.

Step 3: TCP Port Monitors for LDAP and Kerberos

LDAP (port 389) and Kerberos (port 88) are the protocols that client machines actually use for authentication — even if the web UI is healthy, a crashed slapd or krb5kdc process will break logins system-wide.

Add TCP monitors for both:

LDAP (389):

  1. Click Add Monitor → TCP Port.
  2. Enter Host: ipa.yourdomain.com
  3. Enter Port: 389
  4. Set Check interval to 5 minutes.
  5. Click Save.

Kerberos (88):

  1. Click Add Monitor → TCP Port.
  2. Enter Host: ipa.yourdomain.com
  3. Enter Port: 88
  4. Set Check interval to 5 minutes.
  5. Click Save.

Also consider monitoring LDAPS (636) if your environment uses encrypted LDAP connections, and the Kerberos admin port (749) if remote kadmin operations are part of your workflows.

| Protocol | Port | Service | |---|---|---| | LDAP | 389 | slapd (389-ds) | | Kerberos | 88 | krb5kdc | | LDAPS | 636 | slapd with TLS | | Kerberos admin | 749 | kadmind |

Step 4: SSL Certificate Alerts

FreeIPA's SSL setup is more complex than a typical web application — it has its own internal Certificate Authority, and the IPA CA certificate has a finite validity period (typically 20 years, but never forget to renew it). The Dogtag CA certificates are the most critical to watch.

  1. Open the HTTPS monitor for https://ipa.yourdomain.com/ipa/ui/ (created in Step 1).
  2. Enable Monitor SSL certificate under the SSL section.
  3. Set Alert when certificate expires in less than 30 days.
  4. Click Save.

Use a longer alert window (30 days rather than 21) for FreeIPA because renewing IPA CA certificates involves certmonger and can require coordination across replicas. To check certificate status on the IPA server:

# Check all IPA-tracked certificates
sudo ipa-getcert list

# Check the IPA CA certificate specifically
sudo getcert list -d /etc/dirsrv/slapd-EXAMPLE-COM

If certmonger shows CA_UNREACHABLE or NEED_CSR_GEN, certificates are at risk of expiry. Vigilmon's 30-day alert gives you enough time to diagnose and remediate certmonger issues before anything expires.

Step 5: Heartbeat Monitoring for Replication Health

FreeIPA multi-master replication keeps identity data consistent across replicas. A replication failure is silent by default — the primary replica keeps working, but the secondary diverges, and failover breaks when you need it most.

Use a scheduled health check script and Vigilmon's cron heartbeat to verify replication status:

  1. In Vigilmon, click Add Monitor → Cron Heartbeat.
  2. Set the expected ping interval to 60 minutes (run the check hourly).
  3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

Create a replication check script on your primary IPA server:

#!/bin/bash
# /usr/local/bin/ipa-replication-check.sh

# Requires a keytab for a service account with permission to run ipa-replica-manage
kinit -kt /etc/ipa/admin.keytab admin@EXAMPLE.COM 2>/dev/null

ERRORS=$(ipa-replica-manage list-ruv 2>&1 | grep -i error | wc -l)

if [ "$ERRORS" -eq "0" ]; then
    curl -s https://vigilmon.online/heartbeat/abc123
fi

kdestroy -q 2>/dev/null

Make it executable and schedule it hourly:

chmod +x /usr/local/bin/ipa-replication-check.sh
echo "0 * * * * root /usr/local/bin/ipa-replication-check.sh" | sudo tee /etc/cron.d/ipa-replication-check

The heartbeat ping only fires when replication shows no errors. If errors are detected, the ping is withheld, Vigilmon alerts after the expected interval, and you have an hour to investigate before the next window.

Step 6: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and add email, Slack, or PagerDuty.
  2. Set Consecutive failures before alert to 1 on all monitors — FreeIPA failures cascade to infrastructure-wide authentication failures almost immediately.
  3. Consider setting up an on-call rotation for FreeIPA alerts given the operational severity of identity system outages.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTPS (Web UI) | /ipa/ui/ | Apache HTTPD or IPA framework down | | HTTP POST (API) | /ipa/json ping | Python WSGI backend failure | | TCP port | :389 LDAP | slapd (389-ds) crash | | TCP port | :88 Kerberos | krb5kdc crash | | SSL certificate | https://ipa.yourdomain.com | IPA cert or CA expiry | | Cron heartbeat | Replication check script | Silent replication divergence |

FreeIPA is the silent load-bearing pillar of your Linux infrastructure — every login, every sudo, every application authentication runs through it. With Vigilmon watching every layer from the web UI to the TCP-level LDAP and Kerberos ports, you'll know about failures before your users do.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles