tutorial

Monitoring HestiaCP with Vigilmon

HestiaCP is the actively developed successor to VestaCP — but managing your own hosting control panel means owning its uptime. Here's how to monitor your HestiaCP web UI, REST API, Exim mail server, SSL certificates, and scheduled tasks with Vigilmon.

HestiaCP is a modern open-source Linux hosting control panel and the actively maintained successor to VestaCP. Running Nginx, Apache, PHP-FPM, Exim, Dovecot, BIND, and vsftpd together under one management interface, it's widely used by VPS operators and small web hosting companies who want a full-featured panel without vendor lock-in. That control comes with a monitoring responsibility: HestiaCP has no built-in uptime dashboard. Vigilmon covers the entire HestiaCP stack — panel availability, REST API health, mail server connectivity, SSL certificate expiry, and scheduled task execution — so you know before your customers do when something breaks.

What You'll Set Up

  • HTTP monitor for the HestiaCP web UI (port 8083 HTTPS login page)
  • REST API availability check (/api/ with API key authentication)
  • TCP port monitor for the Exim mail server (port 25)
  • SSL certificate expiry alerts for the HestiaCP UI and hosted domain certificates
  • Cron heartbeat monitoring for HestiaCP scheduled tasks (daily backups, Let's Encrypt renewal, system health checks)

Prerequisites

  • HestiaCP installed on a Debian/Ubuntu VPS
  • At least one user and domain configured in HestiaCP
  • A free Vigilmon account

Step 1: Monitor the HestiaCP Web UI (Port 8083)

HestiaCP's control panel runs on HTTPS port 8083. A down panel means neither you nor your customers can manage their hosting accounts, add domains, or access mail settings.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter your HestiaCP URL: https://your-server-ip:8083 or https://cp.yourdomain.com:8083.
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Click Save.

HestiaCP's login page at port 8083 returns HTTP 200 on a healthy installation. A firewall rule change, PHP-FPM crash, or Nginx configuration error will drop this check and alert you within minutes.

Step 2: Monitor the HestiaCP REST API

HestiaCP exposes a REST API at /api/ that accepts JSON requests with an API key. This API powers automation, WHMCS billing integration, and third-party management tools. Monitoring it separately from the UI catches backend failures where Nginx still serves static files but the PHP application layer is broken.

  1. In Vigilmon, click Add Monitor → HTTP / HTTPS.
  2. Set the URL to https://your-server-ip:8083/api/.
  3. Set Expected HTTP status to 200.
  4. Under Request headers, add: X-API-Key: your-hestiacp-api-key.
  5. Under Response body, enable Contains keyword and enter {"result": to confirm a valid JSON API response.
  6. Set Check interval to 2 minutes.
  7. Click Save.

To generate a HestiaCP API key, log in as admin, go to Edit User → API Keys, and create a read-only key for monitoring. The API returns a JSON object on every valid request; a keyword match on {"result": confirms the PHP API layer is responding.

Step 3: Monitor the Exim Mail Server (TCP Port 25)

HestiaCP uses Exim as its SMTP server. Monitoring TCP port 25 confirms that outbound and inbound mail routing is available — a critical signal for hosting customers who rely on your server for business email.

  1. In Vigilmon, click Add Monitor → TCP Port.
  2. Enter your server hostname or IP.
  3. Set Port to 25.
  4. Set Check interval to 2 minutes.
  5. Click Save.

A TCP connection failure on port 25 means Exim has stopped or the port has been blocked by a firewall change. Dovecot (IMAP/POP3) failures can be added the same way on ports 143 and 993.

Step 4: SSL Certificate Alerts for HestiaCP and Hosted Domains

HestiaCP manages Let's Encrypt certificates for both the control panel UI and every hosted domain. The renewal process runs via HestiaCP's built-in cron system, but DNS propagation delays and HTTP challenge failures can cause renewals to silently fail.

HestiaCP UI certificate (port 8083)

  1. Open the HTTP monitor you created in Step 1.
  2. Enable Monitor SSL certificate under the SSL section.
  3. Set Alert when certificate expires in less than 21 days.
  4. Click Save.

Hosted domain certificates

For each customer domain hosted in HestiaCP, add an SSL monitor:

  1. Click Add Monitor → HTTP / HTTPS.
  2. Enter the domain URL: https://customerdomain.com.
  3. Enable Monitor SSL certificate and set the threshold to 21 days.
  4. Click Save.

HestiaCP's Let's Encrypt renewal runs automatically, but the 21-day window gives you time to investigate failures and manually trigger renewal via the HestiaCP CLI:

v-add-letsencrypt-domain admin customerdomain.com www.customerdomain.com

Step 5: Heartbeat Monitoring for HestiaCP Scheduled Tasks

HestiaCP schedules critical maintenance jobs through its cron system: daily backups, Let's Encrypt renewal, and system health checks. Use Vigilmon's cron heartbeat to verify these jobs complete on schedule.

Create a heartbeat monitor

  1. In Vigilmon, click Add Monitor → Cron Heartbeat.
  2. Set the Expected ping interval to match the job frequency (e.g., 1440 minutes for daily backups).
  3. Copy the heartbeat URL: https://vigilmon.online/heartbeat/your-token.
  4. Click Save.

Wire the heartbeat to HestiaCP's backup cron

HestiaCP's backup system runs via /usr/local/hestia/bin/v-backup-users. Add a Vigilmon ping on successful completion:

# Edit root crontab
crontab -e

# Daily user backup — ping Vigilmon only on success
0 2 * * * /usr/local/hestia/bin/v-backup-users && curl -s https://vigilmon.online/heartbeat/your-backup-token

For Let's Encrypt renewal (HestiaCP handles this internally, but you can wrap the renewal check):

# Let's Encrypt renewal check — runs at 2:30am daily by default in HestiaCP
30 2 * * * /usr/local/hestia/bin/v-update-sys-ssl-certificates && curl -s https://vigilmon.online/heartbeat/your-ssl-token

The && operator ensures Vigilmon only receives the ping when the command exits with status 0. A failed backup or renewal script silently drops the ping, and Vigilmon alerts after the expected interval passes.

Step 6: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and configure email, Slack, or a webhook for your team's incident response workflow.
  2. Set Consecutive failures before alert to 2 for the panel UI and API monitors — brief PHP-FPM restarts during package updates may cause a single probe to miss.
  3. For the Exim TCP port monitor, set to 1 failure — a downed mail server affects every customer immediately.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP (HestiaCP UI) | https://server:8083 | Panel crash, Nginx/PHP-FPM failure | | HTTP (REST API) | https://server:8083/api/ | API layer failure, PHP crash | | TCP port | :25 (Exim SMTP) | Mail server down, firewall block | | SSL certificate | Panel + each hosted domain | Let's Encrypt renewal failure | | Cron heartbeat | Backup/renewal/health tasks | Scheduled job failure or skipped run |

HestiaCP gives hosting providers and VPS operators a capable self-managed panel without vendor lock-in. Pairing it with Vigilmon closes the observability gap — you get immediate alerts when the panel, API, mail server, or any hosted site's SSL certificate needs attention, before your customers file a support ticket.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles