Monitoring MRTG with Vigilmon

MRTG (Multi Router Traffic Grapher) is the original network traffic graphing tool, created by Tobi Oetiker in 1994 and still widely deployed for SNMP-based bandwidth monitoring. MRTG polls network devices, writes traffic data to log files, and generates static HTML pages with embedded PNG graphs. Its simplicity is its strength — there's no database, no daemon to crash, just a cron job and a web server. But that simplicity also means MRTG has no self-monitoring. If the cron job stops, the web server goes down, or an SNMP target becomes unreachable, you won't know. Vigilmon provides that visibility, watching the MRTG report pages, checking freshness, monitoring SNMP target availability, and alerting on SSL certificate expiry.

What You'll Set Up

• HTTP uptime monitor for MRTG-generated HTML report pages (/mrtg/ directory)
• Report freshness check via Last-Modified timestamp validation
• SNMP target availability check
• SSL certificate expiry alerts for HTTPS-served MRTG graphs
• Cron heartbeat for MRTG's scheduled polling job

Prerequisites

• MRTG 2.17+ installed and generating HTML reports in a web-accessible directory
• Reports served by Apache or nginx at /mrtg/ or equivalent path
• A free Vigilmon account

Step 1: Monitor the MRTG HTML Report Page

The MRTG index page (typically index.html or a device-specific page in your /mrtg/ directory) is the primary availability signal for both the web server and the MRTG output.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter your MRTG URL: https://yourdomain.com/mrtg/ (or http://your-server-ip/mrtg/index.html).
4. Set Check interval to 5 minutes.
5. Set Expected HTTP status to 200.
6. Click Save.

Add a keyword check to confirm the page contains actual MRTG output:

1. Open the monitor settings.
2. Enable Keyword check.
3. Enter Traffic Analysis as the expected keyword — MRTG includes this phrase in its generated HTML pages.
4. Click Save.

This catches cases where the web server returns 200 for a directory listing or placeholder page instead of the generated MRTG report.

Step 2: Validate Report Freshness

MRTG generates static HTML files on a cron schedule. A stale report (one that hasn't been updated in over 10 minutes when polling every 5 minutes) indicates the cron job has stopped even if the old files are still being served. Check report freshness using the HTTP Last-Modified header.

Create a lightweight freshness check script at your web root (/var/www/html/mrtg-fresh.php or equivalent):

<?php
$mrtg_dir = '/var/www/html/mrtg';
$index = $mrtg_dir . '/index.html';

if (!file_exists($index)) {
    http_response_code(503);
    echo json_encode(['status' => 'missing']);
    exit;
}

$age_seconds = time() - filemtime($index);
$max_age = 600; // 10 minutes: 5-min cron + 5-min buffer

if ($age_seconds > $max_age) {
    http_response_code(503);
    echo json_encode(['status' => 'stale', 'age_seconds' => $age_seconds]);
    exit;
}

echo json_encode(['status' => 'fresh', 'age_seconds' => $age_seconds]);

Add a second Vigilmon monitor for this freshness endpoint:

1. Click Add Monitor → HTTP / HTTPS.
2. URL: https://yourdomain.com/mrtg-fresh.php.
3. Set Expected HTTP status to 200.
4. Enable Keyword check with expected value "status":"fresh".
5. Click Save.

This monitor directly detects a stopped MRTG cron job even before the heartbeat (Step 5) fires.

Step 3: Check SNMP Target Availability

MRTG's value depends on the SNMP targets it polls. If a key router or switch becomes SNMP-unreachable, MRTG silently generates graphs with gaps or zeros. Monitor SNMP target availability with a simple port check.

SNMP uses UDP port 161. Most monitoring systems probe it with a lightweight SNMP GET request. Add a TCP port check for your primary SNMP-managed device:

1. In Vigilmon, click Add Monitor.
2. Set Type to TCP Port (note: for UDP/SNMP, use a lightweight HTTP check against a management interface if available).
3. For devices with web management interfaces, add an HTTP monitor for https://router.yourdomain.com/ or the management IP.
4. Set Check interval to 5 minutes.
5. Click Save.

To verify SNMP is responding from the MRTG server itself:

snmpget -v2c -c YOUR_COMMUNITY your-device-ip sysDescr.0
# Should return: STRING: "Cisco IOS Software..." or similar

If snmpget times out, fix the SNMP community string or firewall rules before MRTG polling will work correctly.

Step 4: SSL Certificate Alerts for HTTPS MRTG

If your MRTG graphs are served over HTTPS (recommended for any public or corporate-network deployment), configure certificate expiry monitoring:

1. Open the HTTP monitor created in Step 1.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

Check your web server's certificate configuration:

# For Apache
apachectl -S 2>&1 | grep SSL

# For nginx
nginx -T 2>&1 | grep ssl_certificate

Verify the certificate covers your MRTG domain:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates

For organizational certificates renewed annually, set the alert threshold to 30 days to give your IT team enough lead time.

Step 5: Heartbeat Monitoring for the MRTG Cron Job

MRTG is entirely cron-driven. There is no daemon to monitor — the entire polling and graph generation cycle runs as a cron job, typically every 5 minutes. Vigilmon's heartbeat monitor detects when the cron job stops firing.

Check your MRTG cron entry:

crontab -l
# Or:
cat /etc/cron.d/mrtg

A typical entry:

*/5 * * * * root /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set Expected ping interval to 5 minutes.
3. Set Grace period to 2 minutes to account for MRTG runtime on large configurations.
4. Copy the heartbeat URL: https://vigilmon.online/heartbeat/abc123.

Update your cron entry to ping Vigilmon on successful completion:

*/5 * * * * root /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l && curl -s https://vigilmon.online/heartbeat/abc123

If MRTG has multiple configuration files (one per device group), wrap them in a shell script:

#!/bin/bash
# /usr/local/bin/mrtg-run.sh
/usr/bin/mrtg /etc/mrtg/routers.cfg --lock-file /var/lock/mrtg/routers_l
/usr/bin/mrtg /etc/mrtg/switches.cfg --lock-file /var/lock/mrtg/switches_l
/usr/bin/mrtg /etc/mrtg/servers.cfg --lock-file /var/lock/mrtg/servers_l
curl -s https://vigilmon.online/heartbeat/abc123

Then call the wrapper from cron. The heartbeat fires once all configs have been processed.

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add email, Slack, or a webhook.
2. Set Consecutive failures before alert to 2 on the HTML report monitor — a brief web server restart should not trigger an alert.
3. Set Consecutive failures before alert to 1 on the freshness monitor — a stale report means data collection has stopped.
4. Use Maintenance windows during MRTG configuration changes:

# Before modifying mrtg.cfg and restarting cron
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "abc123", "duration_minutes": 10}'

# Edit mrtg.cfg, test with:
/usr/bin/mrtg /etc/mrtg/mrtg.cfg

# Maintenance window expires automatically

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTML report page | /mrtg/index.html | Web server down, missing output | | Report freshness | /mrtg-fresh.php | Cron job stopped, stale graphs | | SNMP target | Management interface | Router/switch unreachable | | SSL certificate | HTTPS domain | Certificate expiry, renewal failure | | Cron heartbeat | Heartbeat URL | MRTG cron job failure |

MRTG has been faithfully graphing network traffic since 1994 — but it was never designed to monitor itself. With Vigilmon watching the report pages, freshness, SNMP targets, SSL certificates, and the cron heartbeat, you get complete visibility into the tool that gives you visibility into your network traffic.