How to Monitor Packer with Vigilmon

HashiCorp Packer automates the creation of machine images — AMIs, Vagrant boxes, Docker images, and more — across multiple cloud providers from a single configuration file. When Packer builds fail silently in CI/CD pipelines, teams deploy stale or broken images without knowing it. When the registries or services Packer pushes artifacts to go down, the build succeeds but the image is never available downstream. Vigilmon gives you external visibility into the services that Packer depends on and produces: artifact registries, build webhooks, and the HTTP endpoints your post-processors write to.

What You'll Build

• A monitor on your artifact registry's health endpoint to catch push failures before they propagate
• A webhook receiver monitor to verify Packer's post-processor notifications are landing
• An HTTP check on any custom Packer API service (build status APIs, registry frontends)
• SSL certificate monitoring for your registry and build infrastructure
• An alerting setup tied to your image build cadence

Prerequisites

• A Packer 1.8+ workflow publishing images to a registry or artifact store
• An HTTP-accessible registry, build API, or status endpoint your Packer builds interact with
• A free account at vigilmon.online

Step 1: Understand What to Monitor in a Packer Workflow

Packer itself is a CLI tool — it runs, builds, and exits. What breaks silently is the infrastructure around it:

• Image registries (AWS ECR, Docker Hub, GCP Artifact Registry, custom registries): if the push step fails, Packer may still exit 0 depending on post-processor configuration
• Artifact metadata APIs: services that track which image was built, from which commit, and when
• Webhook receivers: Packer's HTTP post-processor can POST build results to a webhook; if the receiver is down, that data is lost
• Vault or secrets backends: Packer often pulls secrets from Vault during builds; Vault downtime breaks builds

Monitoring the supporting services catches failures that packer build exit codes alone won't surface.

Step 2: Monitor Your Artifact Registry Health Endpoint

Most production registries expose a health or readiness endpoint. Check it before your Packer builds run, and alert if it degrades:

AWS ECR (via the ECR API — reachable if credentials are configured):

curl -I https://ecr.us-east-1.amazonaws.com/

Docker Registry v2:

curl https://registry.example.com/v2/

Returns {} with HTTP 200 when the registry is healthy.

Harbor registry:

curl https://harbor.example.com/api/v2.0/health

Add a Vigilmon HTTP monitor for your registry:

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://registry.example.com/v2/ (or your registry's health endpoint).
3. Check interval: 60 seconds.
4. Response timeout: 10 seconds.
5. Expected status: 200.
6. Label: Packer artifact registry.
7. Click Save.

Step 3: Monitor Your Packer Build Status API

If you expose a build status API (a service that tracks recent Packer builds, their timestamps, and artifact identifiers), add a monitor that confirms it's reachable and returning current data:

curl https://builds.example.com/api/packer/status

Expected response:

{
  "status": "ok",
  "last_build": "2026-07-03T04:00:00Z",
  "latest_ami": "ami-0abc123def456"
}

Add a Vigilmon monitor:

1. Add Monitor → HTTP.
2. URL: https://builds.example.com/api/packer/status.
3. Check interval: 5 minutes.
4. Expected status: 200.
5. Keyword: "status":"ok".
6. Label: Packer build status API.
7. Click Save.

Stale build detection: If your Packer builds run on a schedule (e.g., nightly), set a keyword check for the last_build date string. A stale timestamp means the scheduled build failed silently without updating the record.

Step 4: Monitor a Webhook Receiver for Packer Post-Processor Notifications

Packer's HTTP post-processor can POST a build manifest to a webhook receiver after a successful build. If the receiver goes down, build metadata is lost. Add a health check on your receiver:

curl https://hooks.example.com/packer/health

Your webhook receiver should expose a /health endpoint:

// Node.js example
app.get('/health', (req, res) => res.json({ status: 'ok' }));

app.post('/packer', (req, res) => {
  const manifest = req.body;
  // store manifest, trigger downstream pipeline, etc.
  res.json({ received: true });
});

In your Packer template, configure the HTTP post-processor:

post-processor "shell-local" {
  inline = [
    "curl -s -X POST https://hooks.example.com/packer -H 'Content-Type: application/json' -d @manifest.json"
  ]
}

Add a Vigilmon monitor for the receiver:

1. Add Monitor → HTTP.
2. URL: https://hooks.example.com/packer/health.
3. Check interval: 2 minutes.
4. Expected status: 200.
5. Keyword: "status":"ok".
6. Label: Packer webhook receiver.
7. Click Save.

Step 5: Monitor HashiCorp Vault If Used for Secrets

Packer commonly uses the Vault secrets engine to pull credentials during builds (cloud API keys, signing certificates, etc.). Add a Vault health check:

curl https://vault.example.com/v1/sys/health

Vault returns HTTP 200 when initialized, unsealed, and active. Add a monitor:

1. Add Monitor → HTTP.
2. URL: https://vault.example.com/v1/sys/health.
3. Check interval: 60 seconds.
4. Expected status: 200.
5. Keyword: "initialized":true.
6. Label: Vault (Packer secrets).
7. Click Save.

Step 6: Monitor SSL Certificates

Packer interacts with multiple HTTPS endpoints during builds — registries, Vault, webhook receivers. An expired certificate on any one of them causes Packer to fail with a TLS error:

1. Add Monitor → SSL Certificate.
2. Domain: registry.example.com.
3. Alert when expiry is within: 30 days.
4. Alert again: 14 days, 7 days, 3 days, 1 day.
5. Click Save.

Repeat for each domain Packer connects to: vault.example.com, hooks.example.com, and any cloud provider API domains your builds reach.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Artifact registry | Non-200 or no response | Check registry service; inspect push logs from last Packer run | | Build status API | Non-200 or stale timestamp | Check CI/CD scheduler; inspect last Packer build logs | | Webhook receiver | Non-200 or keyword missing | Restart receiver service; check for unhandled exceptions | | Vault (secrets) | Non-200 or initialized:true missing | Check Vault seal status; run vault status on the Vault host | | SSL certificates | < 30 days to expiry | Renew certificate; check ACME or Vault PKI automation |

Alert after: 1 consecutive failure for registry and Vault (build will fail immediately); 2 failures for build status API (transient API latency is common).

Common Packer Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Registry unreachable — image push fails silently | Registry monitor fires; Packer post-processor push step would also fail | | Vault sealed — builds can't retrieve secrets | Vault monitor fires; Packer exits with secret fetch error | | Webhook receiver down — manifest data lost | Webhook receiver monitor fires; downstream pipeline never triggered | | Expired registry TLS cert | SSL monitor alerts at 30-day threshold; Packer TLS errors on next build | | Build status API stale — nightly build missed | Stale timestamp detected on next check cycle | | Registry storage full — push rejected | Registry health endpoint returns non-200 |

HashiCorp Packer produces your infrastructure's golden images — when the registry that stores them, the secrets backend that authorizes them, or the webhook that notifies downstream systems goes down, you get broken pipelines and stale deployments with no visible error. Vigilmon gives you external eyes on every service Packer depends on and pushes to, so you catch failures the moment they happen rather than when the next deployment goes out.

Start monitoring your Packer infrastructure in under 5 minutes — register free at vigilmon.online.