Monitoring JumpServer with Vigilmon

JumpServer is the world's most-starred open-source Privileged Access Management (PAM) platform, giving enterprises web-based SSH, RDP, VNC, and Kubernetes access with full session recording, RBAC, and MFA. When JumpServer goes down — whether the web UI is unreachable, the Koko SSH gateway is offline, or a scheduled password-rotation job silently stops running — your operations team loses audited access to every server it manages. Vigilmon keeps watch on every layer: web UI, REST API, SSH gateway port, SSL certificates, and scheduled task heartbeats.

What You'll Set Up

• HTTP uptime monitor for the JumpServer web UI login page
• REST API endpoint monitor for the terminals API
• TCP port monitor for the Koko SSH gateway (port 2222)
• SSL certificate expiry alerts for HTTPS deployments
• Heartbeat monitor for JumpServer's built-in task scheduler (session cleanup, asset connectivity checks, password rotation)

Prerequisites

• JumpServer deployed and accessible (typically port 80 or 443 for the web UI, port 2222 for Koko)
• A free Vigilmon account

Step 1: Monitor the JumpServer Web UI

The JumpServer web interface is the primary access point for administrators and users. If it goes down, no one can log in or manage sessions.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the login page URL: https://jumpserver.yourdomain.com/core/auth/login/
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

The /core/auth/login/ path is JumpServer's standard login endpoint and responds with a 200 even when the backend is healthy — making it a reliable liveness probe for the entire web tier.

Step 2: Monitor the JumpServer REST API

JumpServer exposes a REST API used by the web UI and external integrations. Monitoring the terminals API endpoint confirms the core API service is responding, not just the nginx frontend.

1. Click Add Monitor → HTTP / HTTPS.
2. Enter the terminals API URL: https://jumpserver.yourdomain.com/api/v1/terminal/terminals/
3. Set Check interval to 2 minutes.
4. Under Request headers, add: Authorization: Bearer YOUR_SERVICE_ACCOUNT_TOKEN
5. Set Expected HTTP status to 200.
6. Optionally set Expected response body to contain "count" (the API returns a paginated JSON object with a count field).
7. Click Save.

To create a dedicated service account token for monitoring, generate one in JumpServer under System Settings → User Management or via the API:

curl -X POST https://jumpserver.yourdomain.com/api/v1/authentication/auth/ \
  -H "Content-Type: application/json" \
  -d '{"username": "monitor-user", "password": "YOUR_PASSWORD"}'
# Copy the "token" value from the response

Using a read-only service account limits the blast radius if the token is ever exposed.

Step 3: Monitor the Koko SSH Gateway (TCP Port 2222)

Koko is JumpServer's SSH/SFTP/Kubernetes gateway component. It listens on TCP port 2222 and is the entry point for all SSH connections managed through JumpServer. A TCP probe confirms it is accepting connections even when no active sessions exist.

1. Click Add Monitor → TCP Port.
2. Enter your JumpServer hostname and set Port to 2222.
3. Set Check interval to 1 minute.
4. Click Save.

To verify Koko is listening before adding the monitor:

# From a machine with network access to JumpServer
nc -zv jumpserver.yourdomain.com 2222
# Expected: Connection to jumpserver.yourdomain.com 2222 port [tcp/*] succeeded!

If the TCP check passes but SSH sessions are failing, also check Koko's logs:

docker logs jms_koko --tail 50
# or for systemd installs:
journalctl -u jms_koko -n 50

Step 4: SSL Certificate Alerts

JumpServer deployments exposed over HTTPS risk certificate expiry silently breaking web UI access and API calls. Add a certificate monitor alongside your existing HTTP monitor.

1. Open the HTTP monitor you created in Step 1.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

JumpServer is commonly deployed behind nginx. If you use Let's Encrypt with certbot, ensure auto-renewal is active:

# Check renewal timer
systemctl status certbot.timer

# Test renewal manually (dry run)
certbot renew --dry-run

A 21-day alert window gives you three weeks to investigate and resolve renewal failures before users are locked out.

Step 5: Heartbeat Monitoring for Scheduled Tasks

JumpServer runs a built-in task scheduler (Celery-based) for critical background jobs: session cleanup, periodic asset connectivity checks, and password rotation. If the scheduler stops working, stale sessions accumulate, asset health data goes stale, and password rotation silently fails — often without any visible error in the web UI.

Verify scheduled jobs are executing by monitoring the job executions API endpoint as a heartbeat:

1. Click Add Monitor → Cron Heartbeat.
2. Set the expected ping interval to 10 minutes (JumpServer's default scheduler tick).
3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).
4. Add a script to your JumpServer host that queries the job executions API and pings Vigilmon on success:

#!/bin/bash
# /usr/local/bin/jumpserver-scheduler-heartbeat.sh
TOKEN="YOUR_SERVICE_ACCOUNT_TOKEN"
JS_HOST="https://jumpserver.yourdomain.com"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/abc123"

# Check that at least one job execution exists in the last 15 minutes
RECENT=$(curl -sf \
  -H "Authorization: Bearer $TOKEN" \
  "$JS_HOST/api/v1/ops/job-executions/?limit=1&ordering=-date_created" \
  | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('count',0))")

if [ "$RECENT" -gt "0" ]; then
  curl -sf "$HEARTBEAT_URL"
fi

5. Schedule the script with cron:

crontab -e
# Add:
*/10 * * * * /usr/local/bin/jumpserver-scheduler-heartbeat.sh

Make the script executable: chmod +x /usr/local/bin/jumpserver-scheduler-heartbeat.sh

If the Celery worker crashes, the job executions endpoint stops returning new records and Vigilmon alerts after 10 minutes without a ping.

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or a webhook.
2. Set Consecutive failures before alert to 2 on the web UI and API monitors — JumpServer restarts take 20–60 seconds and may cause a single probe to miss.
3. Keep Consecutive failures before alert at 1 on the TCP port 2222 monitor — Koko failures are critical and should alert immediately.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP / HTTPS | /core/auth/login/ | Web UI crash, nginx down | | HTTP / HTTPS | /api/v1/terminal/terminals/ | Core API service failure | | TCP Port | :2222 | Koko SSH gateway down | | SSL Certificate | JumpServer domain | Certificate expiry | | Cron Heartbeat | /api/v1/ops/job-executions/ | Celery scheduler stopped, jobs silently failing |

JumpServer gives your team centralized, audited access to every server in your infrastructure. Vigilmon ensures that access is always available — and that the background jobs keeping your PAM platform healthy are actually running.