Monitoring Pi-hole with Vigilmon

Pi-hole is the most popular self-hosted DNS-based ad blocker, but it has a quiet failure mode: the service can stop responding to DNS queries while the host machine stays up, leaving every device on your network unable to resolve domains. Vigilmon gives you external visibility into Pi-hole's web UI, REST API, and DNS availability so you find out before your household does.

What You'll Set Up

• HTTP monitor for the Pi-hole web admin interface
• REST API health check against /admin/api.php
• DNS query availability check using an HTTP keyword assertion
• SSL certificate expiry alerts (if Pi-hole is served over HTTPS)
• Cron heartbeat for long-running daemon health

Prerequisites

• Pi-hole installed (v5.x or later) on a Raspberry Pi or Linux server
• Pi-hole web UI accessible via HTTP or HTTPS from the network
• A free Vigilmon account

Step 1: Monitor the Pi-hole Web Admin Interface

The web UI at http://pi.hole/admin is the clearest signal that Pi-hole's web server (lighttpd) is running and responsive.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the URL: http://<your-pihole-ip>/admin/ (e.g. http://192.168.1.2/admin/).
4. Set Check interval to 2 minutes.
5. Set Expected HTTP status to 200.
6. Click Save.

This catches lighttpd failures, port conflicts, and kernel OOM events that kill the web server.

Step 2: Poll the Pi-hole REST API

Pi-hole exposes a lightweight JSON API at /admin/api.php. The summary endpoint returns statistics and a running status that confirms the DNS blocking service itself is healthy — not just the web frontend.

The URL to monitor:

http://<your-pihole-ip>/admin/api.php?summary

A healthy response includes:

{
  "domains_being_blocked": 105842,
  "dns_queries_today": 4821,
  "ads_blocked_today": 1203,
  "status": "enabled"
}

Configure Vigilmon to assert on the status field:

1. Add Monitor → HTTP / HTTPS.
2. URL: http://<your-pihole-ip>/admin/api.php?summary.
3. Set Expected body contains to "status":"enabled".
4. Set Check interval to 2 minutes.
5. Click Save.

If Pi-hole's FTL (Faster Than Light) DNS daemon crashes or is manually disabled, the status field changes to "disabled" or the endpoint returns an error — Vigilmon alerts within 2 minutes.

Step 3: Validate DNS Query Response

Pi-hole's core function is answering DNS queries. The API check confirms the service is enabled, but a misconfigured upstream resolver can still leave your network unable to reach the internet. Use a DNS-over-HTTPS (DoH) endpoint as an indirect sanity check, or monitor a downstream device's ability to reach a known external URL.

A practical approach: monitor a simple test page served by your Pi-hole's local web server that resolves a known hostname server-side. Alternatively, set up a lightweight check script that pings a known domain via your Pi-hole IP and expose a /dns-health endpoint:

#!/bin/bash
# /usr/local/bin/pihole-dns-check
# Returns 0 if Pi-hole can resolve google.com
dig @127.0.0.1 google.com +short > /dev/null 2>&1
echo $?

Expose this via a small HTTP wrapper, or simply rely on the API check from Step 2 which reports dns_queries_today — a zero count after several hours indicates DNS has stopped flowing.

Step 4: SSL Certificate Alerts (HTTPS Setups)

If you've fronted Pi-hole with nginx or Caddy over HTTPS, add a certificate expiry monitor:

1. Add Monitor → SSL Certificate.
2. Enter your Pi-hole HTTPS domain (e.g. https://pihole.home.yourdomain.com).
3. Set Alert when certificate expires in less than 30 days.
4. Click Save.

An expired cert silently breaks all HTTPS access to the admin panel and any DoH endpoint you've configured.

Step 5: Cron Heartbeat for the FTL Daemon

Pi-hole's FTL daemon (pihole-FTL) can crash and fail to restart under low-memory conditions on Raspberry Pi Zero/1 hardware. Use Vigilmon's cron heartbeat to verify it's still alive on a schedule.

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected interval to 5 minutes.
3. Copy the ping URL (e.g. https://vigilmon.online/heartbeat/abc123).
4. Add a cron job on your Pi-hole host:

# Run as root or pi user — edit with: crontab -e
*/5 * * * * systemctl is-active --quiet pihole-FTL && curl -s https://vigilmon.online/heartbeat/abc123

If FTL stops, the systemctl is-active check fails, the curl is never called, and Vigilmon alerts after the expected interval passes without a ping.

Step 6: Alert Channels and Tuning

1. In Vigilmon, go to Alert Channels and add email, Slack, or a webhook.
2. On the API monitor, set Consecutive failures before alert to 2 to avoid false alarms from momentary restarts.
3. Use Maintenance windows in Vigilmon to suppress alerts during Pi-hole updates (pihole -up typically restarts FTL for ~30 seconds).

Going Further

• Dual Pi-hole setup: Monitor both your primary and secondary Pi-hole instances; many homes run a backup on a second machine for DNS redundancy.
• Blocklist staleness: The API returns gravity_last_updated — you can track this in a custom script and alert if the blocklist hasn't refreshed in over 7 days.
• Port 53 TCP monitor: Add a Vigilmon TCP monitor on port 53 to confirm the DNS port itself is open, separate from the HTTP API.

With Vigilmon watching Pi-hole's web UI, REST API, and FTL daemon, you'll catch silent failures before anyone notices ads slipping through — or worse, DNS going dark for the entire network.