Monitoring Greenbone GVM with Vigilmon

Greenbone Vulnerability Management (GVM) — the platform behind OpenVAS — is the security backbone for thousands of organizations running network vulnerability scans. But a vulnerability scanner that's silently down isn't catching vulnerabilities: it's giving you false confidence. Vigilmon lets you monitor the Greenbone Security Assistant (GSA) web UI, the REST API, gvmd daemon availability, SSL certificates, and scheduled scan completion — so your scanner is always scanning.

What You'll Set Up

• HTTP uptime monitor for the GSA web UI login page (port 9392)
• REST API availability check for the /api/ endpoint
• gvmd TCP socket health check via HTTP proxy response
• SSL certificate expiry alerts for HTTPS GSA deployments
• Cron heartbeat for GVM scheduled vulnerability scan tasks

Prerequisites

• Greenbone GVM installed (22.x or later, packages or source build)
• GSA web interface accessible on port 9392 (HTTPS)
• gvmd running and accessible via its Unix/TCP socket
• A free Vigilmon account

Step 1: Monitor the GSA Web UI Login Page

The Greenbone Security Assistant web UI is the primary interface security teams use to view scan results and manage tasks. If it goes down, operators lose visibility into vulnerability findings and cannot schedule new scans.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the GSA URL: https://your-gvm-host:9392
4. Set Check interval to 5 minutes.
5. Set Expected HTTP status to 200.
6. Under Keyword check, add Greenbone Security Assistant or Login to verify the page content is the actual login form — not an nginx error page.
7. Click Save.

GVM typically serves GSA over self-signed or locally-issued certificates on port 9392. If your certificate is self-signed, disable certificate verification in the monitor settings. For a production setup, install a valid certificate and keep verification enabled.

Step 2: Monitor the GVM REST API Endpoint

GVM 22+ ships a REST API that tools like gvm-tools and integrations use to trigger scans and fetch results programmatically. Monitoring the API separately from the GSA UI lets you catch cases where the web frontend is up but the API backend has failed.

1. Click Add Monitor → HTTP / HTTPS.
2. Enter the API health URL: https://your-gvm-host:9392/api/
3. Set Expected HTTP status to 200 (or 401 if unauthenticated requests return Unauthorized — the API is responding either way).
4. Set Check interval to 5 minutes.
5. Under Keyword check, add application/json or "version" to confirm a JSON response is returned.
6. Click Save.

To validate the API is genuinely functional rather than just reachable, you can expose a lightweight proxy endpoint that does an authenticated GVM API call. Add this to a small sidecar script:

from flask import Flask, jsonify
import gvm

app = Flask(__name__)

@app.route('/health')
def health():
    with gvm.connections.TLSConnection(hostname='localhost') as conn:
        transform = gvm.transforms.EtreeCheckCommandTransform()
        gmp = gvm.protocols.Gmp(conn, transform=transform)
        gmp.authenticate('admin', 'password')
        return jsonify(status='ok')

Run this on a sidecar port (e.g., 9393) and point a second Vigilmon monitor at http://localhost:9393/health on your GVM host.

Step 3: Check gvmd Daemon Availability via HTTP Proxy

The gvmd daemon handles scan scheduling, result storage, and task management. It communicates over a Unix socket (/run/gvmd/gvmd.sock) or TLS socket, which Vigilmon cannot probe directly. Set up a lightweight TCP proxy health check using socat or a minimal HTTP wrapper.

Option A: socat TCP proxy

# Expose gvmd Unix socket as TCP port 9390
socat TCP-LISTEN:9390,fork,reuseaddr UNIX-CONNECT:/run/gvmd/gvmd.sock &

Add a Vigilmon TCP monitor:

1. Click Add Monitor → TCP Port.
2. Enter your GVM host and port 9390.
3. Set Check interval to 5 minutes.
4. Click Save.

Option B: systemd health script

Create /usr/local/bin/gvmd-health:

#!/bin/bash
# Returns 0 if gvmd is responsive, 1 otherwise
gvm-cli --gmp-username admin --gmp-password "$GVM_PASSWORD" socket \
  --socketpath /run/gvmd/gvmd.sock cmd -- "<get_version/>" \
  | grep -q "<version>" && echo "ok" || exit 1

Wrap it in a tiny HTTP server:

while true; do
  if /usr/local/bin/gvmd-health; then
    echo -e "HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok" | nc -l -p 9390 -q 1
  else
    echo -e "HTTP/1.1 503 Service Unavailable\r\nContent-Length: 4\r\n\r\ndown" | nc -l -p 9390 -q 1
  fi
done &

Add an HTTP monitor pointing to http://your-gvm-host:9390 with expected status 200.

Step 4: SSL Certificate Alerts for GSA HTTPS

GVM's GSA web UI runs on HTTPS. Even with Let's Encrypt or an internal CA, certificates expire — and a scanner with an expired certificate disrupts browser access and automated tooling.

1. Open the GSA web UI monitor you created in Step 1.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

If your GVM installation uses a self-signed certificate managed by greenbone-certd, check its renewal schedule:

# Check current GVM CA and server certificate validity
openssl x509 -in /var/lib/gvm/CA/servercert.pem -noout -dates

Set the Vigilmon alert threshold to give yourself time to regenerate certificates before they expire:

# Regenerate GVM certificates if expiring soon
gvm-manage-certs -a
sudo systemctl restart gvmd gsad

Step 5: Heartbeat Monitoring for GVM Scheduled Scans

GVM's task scheduler runs vulnerability scans on a schedule — daily, weekly, or per-policy. A missed scheduled scan is a silent gap in your vulnerability coverage. Use Vigilmon's cron heartbeat to verify that each scheduled scan task actually completes.

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected ping interval to match your scan schedule (e.g., 1440 minutes for a daily scan).
3. Copy the heartbeat URL (e.g., https://vigilmon.online/heartbeat/abc123).

Add a post-scan hook to your GVM task using gvm-tools to ping the heartbeat after each scan completes:

#!/usr/bin/env python3
# post_scan_heartbeat.py — run via cron or GVM alert action
import gvm
import requests

HEARTBEAT_URL = 'https://vigilmon.online/heartbeat/abc123'
TASK_ID = 'your-gvm-task-uuid'

with gvm.connections.TLSConnection(hostname='localhost') as conn:
    gmp = gvm.protocols.Gmp(conn)
    gmp.authenticate('admin', 'password')
    task = gmp.get_task(task_id=TASK_ID)
    # Only ping if the last report status is Done
    if task.find('.//last_report/report/scan_run_status').text == 'Done':
        requests.get(HEARTBEAT_URL, timeout=10)
        print('Heartbeat sent: scan completed successfully')
    else:
        print('Scan not complete — heartbeat skipped')

Schedule this script to run shortly after your GVM task window closes:

# crontab -e
# Run 30 minutes after expected scan completion
30 6 * * * /usr/bin/python3 /opt/gvm/post_scan_heartbeat.py

If the scan fails, crashes, or gvmd becomes unresponsive mid-scan, the heartbeat is never sent and Vigilmon alerts you.

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add email, Slack, or a webhook.
2. For the GSA UI and API monitors, set Consecutive failures before alert to 2 — GVM can take a moment to respond under heavy scan load.
3. For the heartbeat monitor, leave the threshold at 1 missed ping — a missed vulnerability scan is always an alert-worthy event.

Add a Slack webhook to your security team's channel so scan failures and UI outages land where your team is already watching:

# Test Vigilmon webhook integration
curl -X POST https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK \
  -H 'Content-type: application/json' \
  -d '{"text": "Test: Vigilmon GVM alert channel configured"}'

Summary

| Monitor | Target | What It Catches | |---|---|---| | GSA web UI | https://gvm-host:9392 | Frontend down, nginx crash | | REST API | https://gvm-host:9392/api/ | API backend failure | | gvmd socket | TCP port 9390 or HTTP proxy | Daemon crash, socket failure | | SSL certificate | GSA domain | Certificate expiry | | Cron heartbeat | Heartbeat URL | Missed or failed scheduled scans |

Greenbone GVM is your first line of defense against unpatched vulnerabilities — but only if it's running. With Vigilmon monitoring the GSA interface, REST API, gvmd daemon, and scheduled scan completion, you'll know immediately when your vulnerability management platform needs attention, not weeks later when an audit reveals a coverage gap.