Monitoring Open vSwitch with Vigilmon

Open vSwitch (OVS) is a production-quality, multilayer open-source virtual switch used in OpenStack, Kubernetes via OVN, and cloud infrastructure stacks. It implements VLAN, tunnel (VXLAN/GRE/Geneve), and flow table abstractions that tie your entire virtual network fabric together. When OVS is unhealthy — ovsdb-server unreachable, flow tables stale, OVN controller disconnected — entire tenant networks drop silently. Vigilmon gives you proactive alerting before that silence becomes an incident.

What You'll Set Up

• TCP port monitor for ovsdb-server (port 6640)
• HTTP monitor for OVS management wrapper health endpoint
• TCP monitor for OVN northbound database (port 6641)
• Heartbeat monitor for OVS bridge and flow table health verification
• SSL certificate alerts for TLS-secured ovsdb connections

Prerequisites

• Open vSwitch 2.17+ running on a Linux host or hypervisor
• OVN deployment (optional but covered) with northbound DB accessible
• A lightweight HTTP wrapper or management API exposing OVS health (see Step 2)
• A free Vigilmon account

Step 1: Monitor the ovsdb-server TCP Port

ovsdb-server listens on TCP port 6640 for management plane connections. A TCP port monitor is your first line of defence — it confirms the process is up and accepting connections before any higher-level check runs.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to TCP Port.
3. Enter your OVS host IP and port 6640.
4. Set Check interval to 1 minute.
5. Click Save.

If ovsdb-server binds only to localhost, expose it on a management interface:

# Allow remote management access on a trusted interface
ovs-vsctl set-manager ptcp:6640:192.168.100.10

Verify the listener is up:

ss -tlnp | grep 6640
# LISTEN 0  128  192.168.100.10:6640  0.0.0.0:*  users:(("ovsdb-server",...))

Step 2: Expose an HTTP Health Endpoint for OVS

ovsdb-server speaks the OVSDB JSON-RPC protocol, not plain HTTP, so Vigilmon's HTTP monitor needs a thin wrapper. A minimal script or nginx stub can expose a /health endpoint that runs ovs-vsctl show and returns 200 on success.

Option A: Lightweight Python wrapper

#!/usr/bin/env python3
# ovs_health.py — run with: python3 ovs_health.py
from http.server import BaseHTTPRequestHandler, HTTPServer
import subprocess

class OVSHealthHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path != '/health':
            self.send_response(404)
            self.end_headers()
            return
        result = subprocess.run(
            ['ovs-vsctl', 'show'],
            capture_output=True, timeout=5
        )
        if result.returncode == 0:
            self.send_response(200)
            self.end_headers()
            self.wfile.write(b'{"status":"ok"}')
        else:
            self.send_response(503)
            self.end_headers()
            self.wfile.write(b'{"status":"error"}')

    def log_message(self, *args):
        pass

HTTPServer(('0.0.0.0', 8160), OVSHealthHandler).serve_forever()

Run it as a systemd service so it stays up:

# /etc/systemd/system/ovs-health.service
[Unit]
Description=OVS HTTP health wrapper
After=ovsdb-server.service

[Service]
ExecStart=/usr/bin/python3 /usr/local/bin/ovs_health.py
Restart=always

[Install]
WantedBy=multi-user.target

systemctl enable --now ovs-health

Option B: curl-based nginx stub

location /health {
    content_by_lua_block {
        local handle = io.popen("ovs-vsctl show 2>&1")
        local result = handle:read("*a")
        handle:close()
        if result and #result > 0 then
            ngx.status = 200
            ngx.say('{"status":"ok"}')
        else
            ngx.status = 503
            ngx.say('{"status":"error"}')
        end
    }
}

Once the wrapper is running, add the Vigilmon HTTP monitor:

1. Click Add Monitor → HTTP / HTTPS.
2. Enter http://192.168.100.10:8160/health.
3. Set Expected HTTP status to 200.
4. Set Check interval to 1 minute.
5. Click Save.

Step 3: Monitor the OVN Northbound Database

If you run OVN (Open Virtual Network) on top of OVS, the OVN northbound database (ovn-northd) listens on TCP 6641. Losing this connection means logical network updates stop propagating to hypervisors.

1. Click Add Monitor → TCP Port.
2. Enter your OVN controller host IP and port 6641.
3. Set Check interval to 1 minute.
4. Click Save.

Verify OVN DB connectivity from a compute node:

ovn-nbctl --db=tcp:192.168.100.20:6641 show

If the southbound DB is also critical, add a second TCP monitor on port 6642.

Step 4: SSL Certificate Alerts for TLS-Secured ovsdb

Production OVS deployments use TLS mutual authentication for ovsdb-server connections. A certificate expiry can silently sever the control plane.

If your ovsdb management endpoint is exposed via an HTTPS wrapper:

1. Open the HTTP monitor from Step 2 (or add a new HTTPS monitor on port 8161).
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

To check the certificate OVS itself uses:

openssl s_client -connect 192.168.100.10:6640 </dev/null 2>/dev/null \
  | openssl x509 -noout -dates

For OVN, check the SSL config:

ovs-vsctl get Open_vSwitch . ssl
# {bootstrap-ca-cert=false, ca-cert="/etc/ovn/cacert.pem",
#  certificate="/etc/ovn/cert.pem", private-key="/etc/ovn/privkey.pem"}

Step 5: Heartbeat Monitoring for OVS Bridge and Flow Table Health

OVS can appear healthy (ovsdb running, port open) while actually malfunctioning — bridges can be in a degraded state, flow tables can fail to install, or the OpenFlow controller connection can drop. A heartbeat script catches this deeper class of failure.

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected ping interval to 5 minutes.
3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

Create a health script at /usr/local/bin/ovs-heartbeat.sh:

#!/bin/bash
set -euo pipefail

HEARTBEAT_URL="https://vigilmon.online/heartbeat/abc123"

# Check ovsdb-server is responsive
ovs-vsctl show > /dev/null 2>&1 || exit 1

# Verify at least one bridge exists
BRIDGE_COUNT=$(ovs-vsctl list-br | wc -l)
[ "$BRIDGE_COUNT" -gt 0 ] || exit 1

# Verify OpenFlow is responding on the first bridge
FIRST_BR=$(ovs-vsctl list-br | head -1)
ovs-ofctl show "$FIRST_BR" > /dev/null 2>&1 || exit 1

# All checks passed — ping Vigilmon
curl -fsS --max-time 10 "$HEARTBEAT_URL" > /dev/null

exit 0

chmod +x /usr/local/bin/ovs-heartbeat.sh

Schedule it every 5 minutes with cron:

crontab -e
# Add:
*/5 * * * * /usr/local/bin/ovs-heartbeat.sh

If the bridge count drops to zero, the OpenFlow daemon stops responding, or ovsdb-server hangs, the curl call is never made and Vigilmon fires an alert after the expected interval elapses.

Summary

| Monitor | Type | Target | Interval | |---|---|---|---| | ovsdb-server TCP | TCP Port | host:6640 | 1 min | | OVS health wrapper | HTTP | host:8160/health | 1 min | | OVN northbound DB | TCP Port | ovn-host:6641 | 1 min | | SSL certificate | SSL | HTTPS wrapper | 1 day | | Bridge/flow table health | Heartbeat | /heartbeat/abc123 | 5 min |

Five monitors cover the full Open vSwitch control path — from the OVSDB management plane through OpenFlow to OVN logical topology. When any layer degrades, Vigilmon alerts you before tenant networks notice.

Set up your free Vigilmon account at vigilmon.online and have OVS monitoring live in under 10 minutes.