Monitoring Kong API Gateway Infrastructure with Vigilmon

Kong API Gateway sits in front of every API request your users and services make. When Kong degrades, upstream services become unreachable regardless of whether they're healthy — and the failure manifests as errors across every consumer at once. Vigilmon gives you external uptime monitoring for Kong: proxy availability checks, admin API health monitoring, SSL certificate alerts, and heartbeat tracking for background consumer processes.

What You'll Set Up

• HTTP uptime monitor for Kong's proxy layer availability
• Admin API health check monitor
• SSL certificate expiry alerts for gateway domains
• TCP port check for the proxy and admin ports
• Cron heartbeat for Kong's background consumer workers

Prerequisites

• Kong Gateway 3.x (self-hosted OSS, Kong Enterprise, or Kong Konnect)
• Kong proxy exposed on HTTPS (port 8443 or via a load balancer on 443)
• Kong Admin API accessible (even if internal-only — via SSH tunnel for external checks)
• A free Vigilmon account

Step 1: Monitor the Kong Proxy Layer

Kong's proxy is the data plane — it handles all API traffic. Add a Vigilmon monitor targeting a low-latency, always-available route through your Kong gateway. If you have a health check route configured, use it:

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter your Kong proxy health route: https://api.yourdomain.com/health
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

If you don't have a health route yet, add one to Kong via the Admin API:

# Create a lightweight health check service
curl -X POST http://localhost:8001/services \
  -d "name=health-check" \
  -d "url=http://localhost:8000"

# Add a route for the health check
curl -X POST http://localhost:8001/services/health-check/routes \
  -d "paths[]=/health" \
  -d "methods[]=GET"

Alternatively, Kong itself exposes a status endpoint at http://localhost:8000/ (the default proxy port) that returns 404 for unmatched routes — use that with Expected HTTP status set to 404 as a proxy-is-alive signal if no route exists:

https://api.yourdomain.com/  → Expected: 404

Step 2: Monitor the Kong Admin API

Kong's Admin API is the control plane — it manages services, routes, plugins, and consumers. If the Admin API goes down, you can't push config changes, enable new plugins, or roll back broken routes.

1. Click Add Monitor → HTTP / HTTPS.
2. If your Admin API is publicly accessible (not recommended for production), enter: http://kong-admin.internal:8001/
3. Alternatively, set up an internal health probe using Vigilmon's private locations or expose a read-only status endpoint through your monitoring subnet.
4. Set Expected HTTP status to 200.
5. Click Save.

For teams running Kong with kong.conf default settings, the Admin API status check at /:

curl -s http://localhost:8001/ | jq '.tagline'
# "Welcome to kong"

For production deployments where the Admin API must remain internal, monitor it via a sidecar health probe that writes to a shared metric, or expose /status through a dedicated monitoring VLAN.

Kong 3.x also exposes /status on the Admin API:

curl -s http://localhost:8001/status | jq '{database: .database, server: .server}'
# {
#   "database": {"reachable": true},
#   "server": {"connections_active": 3}
# }

Step 3: SSL Certificate Alerts for Gateway Domains

Kong terminates TLS for all your APIs. A certificate expiry on the gateway domain is maximally disruptive — every API endpoint it serves becomes unreachable simultaneously.

1. Open the proxy monitor from Step 1.
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 30 days.
4. Click Save.

Kong manages TLS certificates via its certificate store. List your certificates and their expiry:

# List all certificates in Kong
curl -s http://localhost:8001/certificates | jq '.data[] | {id: .id, snis: .snis, created_at: .created_at}'

For Kong with Let's Encrypt via the cert-manager plugin or acme plugin:

# Check ACME plugin status
curl -s http://localhost:8001/plugins | jq '.data[] | select(.name == "acme") | .config'

If you manage multiple SNI entries in Kong, add a separate SSL monitor in Vigilmon for each critical domain that Kong serves.

Step 4: TCP Port Monitoring for Proxy and Admin Ports

Add TCP monitors for Kong's core ports to catch network-layer failures that HTTP checks miss:

Proxy port (443 or 8443):

1. Click Add Monitor → TCP Port.
2. Host: api.yourdomain.com, Port: 443.
3. Interval: 1 minute. Click Save.

Admin API port (if in a monitored network):

1. Click Add Monitor → TCP Port.
2. Host: kong-admin.internal, Port: 8001.
3. Interval: 5 minutes. Click Save.

Kong's cluster control port (port 8005 for traditional deployments, gRPC on 8005/8006 for Hybrid mode) is worth monitoring if you're running a multi-node Kong cluster:

# Verify Kong node connectivity
curl -s http://localhost:8001/clustering/status | jq .

Step 5: Heartbeat Monitoring for Kong Consumer Workers

Kong plugins like kafka-upstream, kafka-log, and queue-based plugins run background consumer goroutines. These are invisible to HTTP health checks but critical for event-driven API architectures.

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set Expected ping interval to 10 minutes.
3. Copy the heartbeat URL: https://vigilmon.online/heartbeat/YOUR_ID

Create a Kong plugin health probe script:

#!/bin/bash
# /usr/local/bin/kong-consumer-watchdog.sh

# Check Kong worker process is running
if ! pgrep -f "nginx: worker" > /dev/null; then
    echo "Kong nginx worker not running"
    exit 1
fi

# Check Kong queue plugin processing (customize for your plugin)
QUEUE_DEPTH=$(curl -s http://localhost:8001/queues 2>/dev/null | jq '.total' 2>/dev/null || echo "0")

# Ping heartbeat if workers are healthy
curl -s https://vigilmon.online/heartbeat/YOUR_ID

Schedule every 5 minutes:

*/5 * * * * /usr/local/bin/kong-consumer-watchdog.sh

For Kong on Kubernetes, add a CronJob:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: kong-worker-heartbeat
  namespace: kong
spec:
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: ping
            image: curlimages/curl:latest
            command: ["curl", "-s", "https://vigilmon.online/heartbeat/YOUR_ID"]
          restartPolicy: OnFailure

Step 6: Configure Alert Channels and Maintenance Windows

1. In Vigilmon, go to Alert Channels and configure Slack, PagerDuty, email, or a webhook.
2. Set Consecutive failures before alert to 2 on proxy monitors — a single probe failure during a Kong config reload (which causes a brief worker restart) is normal.
3. Suppress alerts during planned Kong upgrades:

# Open maintenance window before rolling Kong upgrade
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_VIGILMON_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"monitor_id": "YOUR_MONITOR_ID", "duration_minutes": 15}'

# Perform rolling upgrade
kubectl rollout restart deployment/kong -n kong

For Kong Enterprise teams using Konnect, add the Konnect control plane URL as a separate monitor to detect control plane connectivity issues independently of the data plane.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Proxy health route | https://api.yourdomain.com/health | Kong proxy layer down | | Admin API | http://localhost:8001/status | Control plane failure | | SSL certificate | Gateway domains | Certificate expiry (30-day warning) | | TCP proxy port | :443 | Network or load balancer failure | | TCP admin port | :8001 | Admin API unreachable | | Cron heartbeat | Heartbeat URL | Consumer worker crash |

Kong is the single point through which all your API traffic flows. A Kong outage doesn't just break one service — it breaks every service behind the gateway simultaneously. With Vigilmon watching the proxy layer, Admin API, SSL certificates, and worker heartbeats, you catch Kong problems before they cascade into a company-wide API outage.