tutorial

Monitoring Roundcube Webmail with Vigilmon

Roundcube is the world's most popular self-hosted webmail client — but PHP crashes, IMAP backend failures, and expired SSL certificates all kill user logins silently. Here's how to monitor Roundcube end-to-end with Vigilmon.

Roundcube is the de-facto standard browser-based webmail for self-hosted mail servers. It ships with cPanel, Plesk, ISPConfig, and DirectAdmin, and it powers the webmail interfaces of countless organizations running their own Postfix/Dovecot stacks. But when Roundcube goes down — a crashed PHP-FPM pool, a failed IMAP backend, or an expired SSL certificate — users see a blank page or a login loop, and you find out from a complaint ticket rather than a monitoring alert. Vigilmon gives you proactive uptime monitoring for the Roundcube web UI, IMAP backend connectivity, and SSL certificates before any of those silent failures reach your users.

What You'll Set Up

  • HTTP uptime monitor for the Roundcube login page (web UI availability)
  • Keyword monitor to verify the login form is rendering (PHP and session/DB backend health)
  • SSL certificate expiry alerts for the webmail domain
  • Heartbeat monitor for end-to-end IMAP connectivity via a periodic login health check

Prerequisites

  • Roundcube installed and accessible over HTTP or HTTPS
  • A mail server backend (Postfix + Dovecot, Exim, or equivalent) that Roundcube connects to
  • A free Vigilmon account

Step 1: Monitor the Roundcube Login Page

The first thing to verify is that nginx (or Apache) is proxying PHP requests correctly and the Roundcube application itself is running. A working Roundcube login page means PHP-FPM is alive and the application bootstrapped successfully.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter your Roundcube URL — typically https://mail.yourdomain.com or https://yourdomain.com/webmail/.
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Click Save.

If your Roundcube installation is at a non-root path, use that full path as the monitor URL. Roundcube returns a 200 with the login form on the root path even for fresh unauthenticated requests, so there is no redirect to handle.

Step 2: Verify the Login Form Is Rendering (PHP and Database Health)

A 200 response from the web server is necessary but not sufficient — the PHP application could be returning an error page or a blank response if the session database is unreachable or the Roundcube configuration is broken. Add a keyword monitor to confirm the login form is actually present in the response.

  1. Open the monitor you created in Step 1 (or create a new HTTP / HTTPS monitor for the same URL).
  2. Expand the Keyword section.
  3. Enter rcmloginuser as the expected keyword.

The rcmloginuser string is the name attribute of the username input on the Roundcube login form. It is only present when Roundcube has fully initialized — including loading its configuration, connecting to the session storage backend (MySQL, PostgreSQL, or SQLite), and rendering the login template. If Roundcube is returning a PHP error, a blank page, or a partial render, this keyword will be absent and Vigilmon will alert.

Step 3: Monitor IMAP Backend Connectivity

Roundcube is only useful if it can reach the IMAP server behind it. The PHP application health check in Step 2 confirms Roundcube itself is running, but the IMAP backend (Dovecot, Courier, etc.) could be down independently. Use Roundcube's installer test endpoint to probe IMAP connectivity status:

Add a second HTTP monitor pointing to:

https://mail.yourdomain.com/?_task=cli&_action=test

This endpoint is available in Roundcube installations that have the installer enabled for testing and returns IMAP configuration and connectivity status. For most production deployments (where the installer is disabled), use an alternative approach: monitor port 143 or 993 (IMAP/IMAPS) on your mail server directly:

  1. Click Add Monitor → choose TCP Port.
  2. Set Host to your IMAP server hostname.
  3. Set Port to 993 (IMAPS) or 143 (IMAP with STARTTLS).
  4. Set Check interval to 1 minute.
  5. Click Save.

A successful TCP connection on port 993 confirms Dovecot (or your IMAP daemon) is listening. If Dovecot crashes, Roundcube logins will fail immediately — this monitor catches that before any user complaint.

Step 4: SSL Certificate Alerts

Roundcube deployments are almost always served over HTTPS, and an expired SSL certificate immediately prevents users from logging in (browsers show a hard error, not a fallback). Let's Encrypt auto-renewal can fail silently if the challenge port is blocked or the renewal cronjob is misconfigured.

Add certificate expiry monitoring to your existing HTTP monitor:

  1. Open the Roundcube HTTP monitor you created in Step 1.
  2. Scroll to the SSL Certificate section.
  3. Enable Monitor SSL certificate expiry.
  4. Set Alert threshold to 21 days before expiry.
  5. Click Save.

A 21-day window gives you three full weeks to investigate a failed auto-renewal and manually trigger it:

# Let's Encrypt manual renewal (adjust for your ACME client)
certbot renew --force-renewal -d mail.yourdomain.com

# Or with acme.sh
acme.sh --renew -d mail.yourdomain.com --force

If you serve Roundcube over a wildcard certificate, add the SSL monitor on the specific webmail subdomain, not the wildcard itself — Vigilmon checks the certificate the server actually presents.

Step 5: Heartbeat Monitoring for End-to-End IMAP Connectivity

TCP port monitoring confirms the IMAP daemon is listening, but it does not verify that Roundcube can successfully authenticate and read a mailbox. For complete end-to-end coverage, set up a heartbeat monitor that triggers a real IMAP login through Roundcube.

  1. In Vigilmon, click Add Monitor → Cron Heartbeat.
  2. Set the expected ping interval to 5 minutes.
  3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

Create a monitoring script on your mail server that performs a Roundcube login and pings the heartbeat on success:

#!/bin/bash
# /usr/local/bin/roundcube-health-check.sh

ROUNDCUBE_URL="https://mail.yourdomain.com"
TEST_USER="monitor@yourdomain.com"
TEST_PASS="your-test-password"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/abc123"

# Fetch the login page and extract the CSRF token
CSRF=$(curl -s -c /tmp/rc_cookies.txt "$ROUNDCUBE_URL" \
  | grep -oP 'name="_token" value="\K[^"]+')

if [ -z "$CSRF" ]; then
  echo "Failed to fetch login page"
  exit 1
fi

# Submit the login form
RESPONSE=$(curl -s -b /tmp/rc_cookies.txt -c /tmp/rc_cookies.txt \
  -X POST "$ROUNDCUBE_URL" \
  -d "_token=$CSRF&_task=login&_action=login&_timezone=UTC&rcmloginuser=$TEST_USER&rcmloginpwd=$TEST_PASS")

# A successful login redirects to the mailbox — check for inbox task
if echo "$RESPONSE" | grep -q '"task":"mail"' || \
   curl -s -b /tmp/rc_cookies.txt "$ROUNDCUBE_URL/?_task=mail" | grep -q 'rcmrow'; then
  curl -s "$HEARTBEAT_URL" > /dev/null
  echo "Login successful — heartbeat sent"
else
  echo "Login failed — IMAP backend may be down"
  exit 1
fi

rm -f /tmp/rc_cookies.txt

Create a dedicated monitoring mailbox (monitor@yourdomain.com) with a known password for this check. Schedule it with cron:

*/5 * * * * /usr/local/bin/roundcube-health-check.sh >> /var/log/roundcube-health.log 2>&1

If the Dovecot IMAP server is down, the login will fail, the heartbeat will not be sent, and Vigilmon will alert after 5 minutes — catching the full chain from Roundcube to IMAP to the mailstore.

Step 6: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and add email, Slack, or a webhook to your on-call channel.
  2. Set Consecutive failures before alert to 2 on the web UI monitors — transient PHP-FPM restarts can cause a single probe failure without a real outage.
  3. Set the heartbeat alert to trigger immediately on the first missed ping, since a missed login heartbeat already represents at least 5 minutes of IMAP unavailability.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP uptime | https://mail.yourdomain.com | nginx/Apache down, PHP-FPM crash | | Keyword (rcmloginuser) | Roundcube login page | DB backend failure, partial render | | TCP port | IMAP server port 993 | Dovecot/IMAP daemon down | | SSL certificate | Webmail domain | Let's Encrypt renewal failure | | Cron heartbeat | Heartbeat URL every 5 min | Full IMAP login chain failure |

Roundcube has no built-in health dashboard — when it fails, users find out at login. With Vigilmon monitoring the web UI, IMAP backend, and SSL certificate, you know before they do.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles