Monitoring Openfire XMPP Server with Vigilmon

Openfire is a mature open-source XMPP (Jabber) real-time collaboration server developed by Ignite Realtime. Written in Java and used for enterprise instant messaging, group chat, and presence across tens of thousands of organizations, Openfire is robust — but self-hosting means you own the uptime. When Openfire's admin console goes dark or the XMPP port stops accepting connections, your entire organization's messaging infrastructure goes silent. Vigilmon monitors Openfire's admin console availability, XMPP TCP port, SSL certificates, and scheduled background tasks — giving you alerts before your users notice a problem.

What You'll Set Up

HTTP uptime monitor for the Openfire Admin Console (port 9090 or 9091)
TCP port monitor for the XMPP client connection port (5222)
SSL certificate expiry alerts for the Openfire HTTPS admin console
Heartbeat monitoring for Openfire scheduled tasks (user sync, cluster health)

Prerequisites

Openfire installed and running (version 4.6+ recommended)
Admin console accessible at http://your-server:9090 or https://your-server:9091
A free Vigilmon account

Step 1: Monitor the Openfire Admin Console

The Openfire Admin Console is a Java-based web application running on port 9090 (HTTP) or 9091 (HTTPS). Its availability is the clearest signal that the Openfire JVM process is alive and healthy.

Log in to vigilmon.online and click Add Monitor.
Set Type to HTTP / HTTPS.
Enter the admin console URL:
- For HTTP: http://your-server-ip:9090/index.jsp
- For HTTPS: https://your-server-ip:9091/index.jsp
Set Check interval to 1 minute.
Set Expected HTTP status to 200.
Under Keyword check, enter Openfire to confirm the correct page loads.
Click Save.

The admin console at /index.jsp is always accessible (it redirects to login if not authenticated) and serves as the health check for the entire Openfire process. If the JVM crashes or hangs, this endpoint will stop responding.

If your Openfire admin console is on a private network or behind a firewall, consider monitoring from a host on the same network, or open a narrow firewall rule to allow Vigilmon's monitoring IPs to reach port 9090/9091. Alternatively, monitor the XMPP port from outside (Step 2) as the primary external health check.

Step 2: Monitor the XMPP Client Port (TCP 5222)

Port 5222 is the standard XMPP client-to-server port. This is what every XMPP client (Spark, Pidgin, Gajim, Conversations) connects to. Even if the admin console is up, a misconfigured firewall rule, a TLS negotiation failure, or a resource exhaustion issue can prevent clients from connecting on this port.

Add a TCP port monitor:

Click Add Monitor → TCP Port.
Enter your Openfire server hostname or IP.
Set Port to 5222.
Set Check interval to 1 minute.
Click Save.

If you also use the secure XMPP port (5223 for legacy SSL, or STARTTLS on 5222), the single monitor on 5222 with STARTTLS capability covers both cases. Add a separate monitor for port 5223 if you have clients using direct TLS.

For Openfire Enterprise with S2S (server-to-server) federation, also add a TCP monitor on port 5269:

Click Add Monitor → TCP Port.
Set Port to 5269.
Set Check interval to 5 minutes.
Click Save.

Step 3: Monitor the Openfire REST API (Plugin)

If you have the Openfire REST API Plugin installed, you can probe a lightweight endpoint to confirm both the plugin and the Openfire application are healthy:

GET http://your-server-ip:9090/plugins/restapi/v1/system/properties
Authorization: Basic BASE64(admin:password)

For a monitoring probe, use a dedicated read-only admin account:

Click Add Monitor → HTTP / HTTPS.
Enter: http://your-server-ip:9090/plugins/restapi/v1/system/properties.
Set Method to GET.
Add header: Authorization: Basic YOUR_BASE64_CREDENTIALS.
Set Expected HTTP status to 200.
Under Keyword check, enter properties.
Set Check interval to 5 minutes.
Click Save.

This confirms the Openfire REST API plugin is loaded and responsive — useful if you rely on the API for user provisioning or room management automation.

Step 4: SSL Certificate Alerts for the Openfire HTTPS Console

Openfire's admin console can be served over HTTPS on port 9091. The certificate is managed via the Openfire keystore (a Java keystore file) — it does not auto-renew like Let's Encrypt unless you've set up an external process to refresh it. Certificate expiry on the admin console is a common oversight that can lock administrators out of the console on renewal day.

Add SSL monitoring for the HTTPS admin console:

Open the monitor for https://your-server-ip:9091/index.jsp (created in Step 1).
Enable Monitor SSL certificate under the SSL section.
Set Alert when certificate expires in less than 30 days.
Click Save.

Use a 30-day window for Openfire's admin console because Java keystore certificate renewal is a manual process — you need time to generate a new certificate, import it into the keystore, and restart Openfire. A 30-day alert gives you a full renewal cycle with buffer.

Also add SSL monitoring for the XMPP port if your clients connect via STARTTLS or direct TLS. Many XMPP clients display certificate warnings rather than refusing connections outright, so certificate expiry may go unnoticed by users until it's critical.

For XMPP client TLS, add a separate monitor:

Click Add Monitor → HTTP / HTTPS.
Enter https://your-server-ip:5223/ (or use a TCP port monitor with SSL probing if your Vigilmon plan supports it).
Enable Monitor SSL certificate.
Set Alert when certificate expires in less than 30 days.
Click Save.

Step 5: Heartbeat Monitoring for Openfire Scheduled Tasks

Openfire and its plugins run background tasks for user synchronization, cluster health checks, and administrative routines:

User import sync — If you use LDAP/AD integration, Openfire periodically syncs user accounts from the directory. A failed sync leaves stale accounts or new employees unable to log in.
Cluster health checks — Openfire Enterprise uses Hazelcast for clustering; cluster nodes need regular health probes to detect split-brain scenarios.
Scheduled plugin tasks — Plugins like Monitoring Service (packet capture), Content Filter, and Candy use scheduled jobs.

For LDAP/AD sync or any external synchronization script, use Vigilmon's heartbeat:

In Vigilmon, click Add Monitor → Cron Heartbeat.
Set the expected ping interval to match your sync frequency (e.g. 60 minutes for hourly LDAP sync).
Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).
In your sync script (or after the Openfire-managed sync completes), add the ping:

#!/bin/bash
# /etc/cron.d/openfire-ldap-sync
0 * * * * openfire /opt/openfire/bin/run-ldap-sync.sh && curl -s https://vigilmon.online/heartbeat/abc123

For Openfire Enterprise cluster monitoring, add a REST API probe via the cluster status endpoint (available with the Clustering plugin):

GET http://your-server-ip:9090/plugins/clustering/v1/status

Add a Vigilmon HTTP monitor for this endpoint with a keyword check on RUNNING (the expected cluster state).

Step 6: Configure Alert Channels

Go to Alert Channels in Vigilmon and add email, Slack, or a webhook endpoint.
On the admin console monitor, set Consecutive failures before alert to 1 — if the Openfire admin console is down, the JVM process may have crashed and needs immediate attention.
On the XMPP TCP port monitor, set it to 1 — any interruption to the client connection port means users cannot send or receive messages.
On the SSL certificate monitors, the single-alert default is appropriate.
On the heartbeat monitor, the alert fires automatically when the grace period expires without a ping.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Admin Console | :9090/index.jsp or :9091/index.jsp | JVM crash, Openfire process failure | | XMPP client port | TCP port 5222 | Client connection failure, firewall issue | | S2S federation port | TCP port 5269 | Federation breakdown (optional) | | REST API | /plugins/restapi/v1/system/properties | Plugin failure, API unavailability | | SSL certificates | Admin console + XMPP ports | Certificate expiry, manual renewal needed | | Sync heartbeat | Heartbeat URL | LDAP/AD sync failure, silent background task failure |

Openfire powers real-time messaging for your organization — when it goes down, communication stops. Vigilmon provides the external monitoring layer that catches Openfire failures before your users do, giving you time to respond before a JVM crash turns into a long outage.