tutorial

Monitoring iRedMail with Vigilmon

iRedMail is one of the most trusted self-hosted email server solutions — but running your own mail stack means owning every failure. Here's how to monitor iRedMail's admin panel, webmail, Postfix, Dovecot, Amavisd, ClamAV, and SSL certificates with Vigilmon.

iRedMail is one of the oldest and most trusted open-source email server solutions, automating the installation of a complete email stack — Postfix, Dovecot, Amavisd, ClamAV, SpamAssassin, Roundcube or SOGo webmail, and iRedAdmin — on Linux or FreeBSD. Unlike Docker-based solutions, iRedMail installs natively, giving organizations full bare-metal or VM control over their email infrastructure. Running iRedMail means running a production mail server with all the responsibility that entails: when something goes wrong, you need to know immediately. Vigilmon gives you real-time alerts across every layer of your iRedMail stack.

What You'll Set Up

  • HTTP uptime monitors for iRedAdmin web panel and Roundcube/SOGo webmail
  • TCP port monitors for Postfix SMTP (25) and Dovecot IMAP SSL (993)
  • SSL certificate expiry alerts for web services and mail TLS certificates
  • Heartbeat monitoring for Amavisd content filtering and ClamAV antivirus

Prerequisites

  • iRedMail installed on Linux or FreeBSD
  • iRedAdmin accessible over HTTPS
  • Roundcube or SOGo webmail accessible over HTTPS
  • A free Vigilmon account

Step 1: Monitor the iRedAdmin Web Panel

iRedAdmin is the web-based administration panel for managing domains, mailboxes, and aliases. Monitoring it confirms that nginx, the Python WSGI app, and the admin database are all responding.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter your iRedAdmin URL: https://mail.yourdomain.com/iredadmin/
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Click Save.

The /iredadmin/ path is the standard iRedMail installation path for the admin panel. A 200 response confirms the WSGI layer and admin application are healthy.

Step 2: Monitor the Webmail Interface

iRedMail installs Roundcube or SOGo as the webmail frontend for end users. A webmail outage directly affects users trying to read or send email through the browser — monitor it separately from the admin panel.

Roundcube

  1. Click Add Monitor in Vigilmon.
  2. Set Type to HTTP / HTTPS.
  3. Enter: https://mail.yourdomain.com/mail/
  4. Set Expected HTTP status to 200.
  5. Set Check interval to 1 minute.
  6. Click Save.

SOGo

If you chose SOGo as your webmail:

  1. Click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter: https://mail.yourdomain.com/SOGo/
  4. Set Expected HTTP status to 200.
  5. Set Check interval to 1 minute.
  6. Click Save.

Roundcube and SOGo run as separate processes from iRedAdmin. The admin panel being up does not guarantee webmail is up.

Step 3: TCP Port Monitors for Postfix and Dovecot

The core email services — Postfix for transport and Dovecot for IMAP — are independent of the web interfaces. A crashed Postfix daemon means incoming email bounces; a crashed Dovecot means users cannot retrieve mail.

Postfix SMTP Port 25

  1. Click Add Monitor → set Type to TCP Port.
  2. Enter mail.yourdomain.com.
  3. Set Port to 25.
  4. Set Check interval to 1 minute.
  5. Click Save.

Dovecot IMAP SSL Port 993

  1. Click Add Monitor → set Type to TCP Port.
  2. Enter mail.yourdomain.com.
  3. Set Port to 993.
  4. Set Check interval to 1 minute.
  5. Click Save.

Step 4: SSL Certificate Alerts

iRedMail supports Let's Encrypt auto-renewal via included scripts and certbot. Certificate expiry on a mail server causes immediate connection failures — other mail servers reject STARTTLS connections and mail clients refuse to connect.

Web Panel and Webmail HTTPS Certificate

  1. Open the iRedAdmin HTTP monitor (Step 1).
  2. Enable Monitor SSL certificate.
  3. Set Alert when certificate expires in less than 21 days.
  4. Click Save.

Repeat this for the Roundcube or SOGo monitor if they are served from a separate domain.

Postfix SMTP STARTTLS Certificate

  1. Open the TCP Port 25 monitor.
  2. Enable Monitor SSL certificate — Vigilmon issues a STARTTLS probe to SMTP ports.
  3. Set Alert when certificate expires in less than 21 days.
  4. Click Save.

Dovecot IMAP SSL Certificate

  1. Open the TCP Port 993 monitor.
  2. Enable Monitor SSL certificate.
  3. Set Alert when certificate expires in less than 21 days.
  4. Click Save.

iRedMail uses the same Let's Encrypt certificate for web, SMTP, and IMAP by default — but after any certificate renewal you should verify all three services reloaded the new certificate. Having separate monitors catches cases where one service is still serving the old cert.

Step 5: Heartbeat Monitoring for Amavisd Content Filtering

Amavisd-new is the content filter bridge that connects Postfix to SpamAssassin and ClamAV. Every inbound and outbound email passes through Amavisd. If Amavisd stops, mail delivery stalls — Postfix queues pile up waiting for content filter responses.

Use a scheduled SMTP probe that sends a test message through the submission port and confirms it was accepted:

  1. In Vigilmon, click Add Monitor → Cron Heartbeat.
  2. Set Expected ping interval to 10 minutes.
  3. Copy the heartbeat ping URL (e.g. https://vigilmon.online/heartbeat/abc123).
  4. On your iRedMail server, add a cron job that probes the SMTP submission port end-to-end:
# /etc/cron.d/iredmail-amavis-heartbeat
*/10 * * * * root bash -c '
  # Send SMTP probe through submission port (tests Postfix + Amavisd pipeline)
  RESULT=$(echo -e "EHLO localhost\nMAIL FROM:<monitor@yourdomain.com>\nRCPT TO:<monitor@yourdomain.com>\nDATA\nSubject: Amavis probe\n\nheartbeat\n.\nQUIT" | \
    nc -w 10 localhost 587 2>/dev/null | tail -1)
  
  # Check for 221 bye (successful SMTP session)
  echo "$RESULT" | grep -q "^221" && curl -s https://vigilmon.online/heartbeat/abc123
'

This end-to-end SMTP probe exercises Postfix's connection handling, the Amavisd content filter pipeline, and the submission relay configuration. If Amavisd is down, Postfix will respond with a 451 temporary failure instead of completing the session, and the heartbeat ping is skipped.

For a simpler process-level check, verify Amavisd is running:

*/10 * * * * root pgrep -f amavisd > /dev/null && curl -s https://vigilmon.online/heartbeat/abc123

Step 6: Heartbeat Monitoring for ClamAV

ClamAV provides antivirus scanning for every email that passes through Amavisd. The freshclam service keeps the virus database current. ClamAV listens on TCP port 3310 — use a TCP availability check to confirm it's running.

  1. Click Add Monitor → set Type to TCP Port.
  2. Enter localhost (or mail.yourdomain.com if monitoring from Vigilmon's external network — note port 3310 may be firewalled).
  3. Set Port to 3310.
  4. Set Check interval to 5 minutes.
  5. Click Save.

If ClamAV is on a private interface not reachable from Vigilmon, use a heartbeat cron job instead:

# /etc/cron.d/iredmail-clamav-heartbeat
*/5 * * * * root bash -c '
  # Try to connect to ClamAV socket or TCP port
  echo PING | nc -w 3 localhost 3310 2>/dev/null | grep -q PONG && \
    curl -s https://vigilmon.online/heartbeat/YOUR_CLAMAV_HEARTBEAT_URL
'

ClamAV responds to a PING command over its TCP interface with PONG. This confirms the daemon is alive and accepting scan requests.

Step 7: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and add email, Slack, or webhook notifications.
  2. For SMTP and IMAP TCP monitors, set Consecutive failures before alert to 2 — brief connection timeouts during Postfix or Dovecot reloads are normal.
  3. For webmail monitors, set Consecutive failures before alert to 2 — PHP-FPM or SOGo restarts can cause a brief 502.
  4. For the Amavisd heartbeat, set the interval generously (10–15 minutes) so a single slow probe cycle doesn't trigger a false alert.
  5. Schedule maintenance windows before iRedMail upgrades and OS patching:
# Suppress alerts for 15 minutes during upgrades
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_VIGILMON_API_KEY" \
  -d '{"monitor_id": "YOUR_POSTFIX_MONITOR_ID", "duration_minutes": 15}'

Summary

| Monitor | Type | Target | What It Catches | |---|---|---|---| | iRedAdmin panel | HTTP | /iredadmin/ | Admin app crash | | Roundcube webmail | HTTP | /mail/ | Webmail crash | | Postfix SMTP | TCP Port | Port 25 | Inbound mail delivery failure | | Dovecot IMAP SSL | TCP Port | Port 993 | Mail retrieval failure | | Web HTTPS SSL | SSL Certificate | mail.yourdomain.com | Let's Encrypt renewal failure | | SMTP STARTTLS SSL | SSL Certificate | Port 25 STARTTLS | Postfix TLS cert expiry | | IMAP SSL | SSL Certificate | Port 993 | Dovecot TLS cert expiry | | Amavisd heartbeat | Cron Heartbeat | SMTP submission probe | Content filter crash | | ClamAV | TCP Port / Heartbeat | Port 3310 | Antivirus daemon crash |

iRedMail gives you a battle-tested, bare-metal email server with complete control over every component. With Vigilmon monitoring all nine layers — the web UIs, mail transport ports, SSL certificates, content filter, and antivirus — you'll have the operational visibility that enterprise email providers build in, running entirely on your own infrastructure.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles