Monitoring SOGo Groupware with Vigilmon

SOGo is the open-source groupware suite that enterprises and universities reach for when they need Outlook-like collaboration — webmail, calendar (CalDAV), and contacts (CardDAV) — without commercial licensing costs. It powers mail infrastructure for large ISPs and academic institutions running Postfix + Dovecot stacks. But SOGo has more moving parts than a simple webmail client: the sogod Objective-C daemon listens on port 20000, nginx proxies requests to it, PostgreSQL or MySQL stores all groupware data, and Dovecot handles IMAP behind the scenes. When any layer fails, SOGo presents a silent error to users. Vigilmon gives you external monitoring across every critical layer — the web UI, the sogod daemon, CalDAV/CardDAV availability, and the database/IMAP backend — so you know before your users do.

What You'll Set Up

• HTTP uptime monitor for the SOGo web interface at /SOGo/
• TCP port monitor for the sogod daemon on port 20000 (Objective-C process health)
• HTTP monitor for CalDAV/CardDAV availability at /SOGo/dav/ (groupware protocol health)
• SSL certificate expiry alerts for the SOGo domain
• Heartbeat monitor for SOGo's database and IMAP backend health

Prerequisites

• SOGo installed with the sogod daemon running
• nginx or Apache proxying requests to sogod on port 20000
• PostgreSQL or MySQL database configured for SOGo
• Dovecot providing IMAP backend access
• A free Vigilmon account

Step 1: Monitor the SOGo Web Interface

SOGo's web interface is served at the /SOGo/ path. This URL passes through nginx, which proxies the request to the sogod FastCGI process on port 20000. A successful 200 response with the keyword SOGo confirms that both nginx and the sogod daemon are running and communicating correctly.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter your SOGo URL: https://mail.yourdomain.com/SOGo/.
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Expand the Keyword section and enter SOGo.
7. Click Save.

The SOGo keyword appears in the web interface title and meta tags. If nginx is running but sogod has crashed, nginx returns a 502 Bad Gateway. If sogod is overloaded, the request may time out. Both scenarios trigger a Vigilmon alert.

Step 2: Monitor the sogod Daemon Directly (Port 20000)

The sogod Objective-C daemon is the core of SOGo — it handles all web requests, CalDAV/CardDAV operations, and database queries. It listens on port 20000 (by default) as a local HTTP server that nginx proxies to. Monitoring this port directly lets you distinguish a SOGo daemon failure from an nginx configuration problem.

1. Click Add Monitor in Vigilmon.
2. Set Type to TCP Port.
3. Set Host to your SOGo server hostname or IP address.
4. Set Port to 20000.
5. Set Check interval to 1 minute.
6. Click Save.

A successful TCP connection to port 20000 confirms sogod is alive. If sogod crashes (common after an OOM event or a failed database connection), this monitor will alert while the nginx monitor in Step 1 may show a different error (502). The two monitors together tell you exactly which layer failed.

To verify the current sogod status:

# Check sogod process
ps aux | grep sogod

# SOGo service status (systemd)
systemctl status sogo

# View sogod logs
journalctl -u sogo -n 50

Step 3: Monitor CalDAV and CardDAV Availability

SOGo serves CalDAV and CardDAV at /SOGo/dav/. These endpoints are used by Thunderbird, Apple Calendar, Apple Contacts, and other DAV clients to sync calendars and contacts. An unauthenticated GET to /SOGo/dav/ returns a 401 Unauthorized — which is the expected response and confirms the DAV stack is active.

1. Click Add Monitor in Vigilmon.
2. Set Type to HTTP / HTTPS.
3. Enter https://mail.yourdomain.com/SOGo/dav/.
4. Set Check interval to 5 minutes.
5. Set Expected HTTP status to 401.
6. Click Save.

Vigilmon supports monitoring for specific non-200 status codes as expected responses. A 401 response from /SOGo/dav/ is the correct unauthenticated behavior — it means the CalDAV/CardDAV endpoint is reachable and SOGo is correctly requiring authentication. If this endpoint returns 404, 502, or no response, the DAV stack has failed and calendar/contacts sync will break for all connected clients.

Step 4: SSL Certificate Alerts

SOGo deployments handle calendaring and email for entire organizations. An expired SSL certificate breaks not just the web interface, but also calendar and contacts sync for every connected client — Thunderbird, Apple Calendar, iOS, Android — simultaneously. The blast radius is larger than a simple webmail outage.

1. Open the SOGo web interface monitor from Step 1.
2. Scroll to the SSL Certificate section.
3. Enable Monitor SSL certificate expiry.
4. Set Alert threshold to 30 days before expiry.

A 30-day window (compared to the typical 21-day threshold for simpler services) gives you more time to coordinate certificate renewal across an organization's infrastructure, where SOGo may be behind load balancers or use certificates managed by a central PKI team.

# Check current certificate expiry
openssl s_client -connect mail.yourdomain.com:443 -servername mail.yourdomain.com \
  2>/dev/null | openssl x509 -noout -dates

# Force Let's Encrypt renewal
certbot renew --force-renewal -d mail.yourdomain.com
systemctl reload nginx

Step 5: Heartbeat Monitoring for Database and IMAP Backend Health

SOGo depends on two backends simultaneously: a relational database (PostgreSQL or MySQL) for groupware data (calendar events, contacts, ACLs) and Dovecot for IMAP mailbox access. A heartbeat monitor can verify that SOGo can reach both.

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected ping interval to 10 minutes.
3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

SOGo includes a sogo-tool command-line utility. Use it to verify database connectivity as a health check:

#!/bin/bash
# /usr/local/bin/sogo-health-check.sh

HEARTBEAT_URL="https://vigilmon.online/heartbeat/abc123"
SOGO_DB_HOST="localhost"
SOGO_DB_NAME="sogo"
SOGO_DB_USER="sogo"

# Check database connectivity via sogo-tool
if sogo-tool check-defaults > /dev/null 2>&1; then
  DB_OK=true
else
  DB_OK=false
fi

# Alternatively, check PostgreSQL directly
if pg_isready -h "$SOGO_DB_HOST" -U "$SOGO_DB_USER" -d "$SOGO_DB_NAME" -q; then
  DB_OK=true
fi

# Check Dovecot IMAP availability
if nc -z -w 5 localhost 993 > /dev/null 2>&1 || \
   nc -z -w 5 localhost 143 > /dev/null 2>&1; then
  IMAP_OK=true
else
  IMAP_OK=false
fi

# Check sogod process
if pgrep -x sogod > /dev/null; then
  SOGOD_OK=true
else
  SOGOD_OK=false
fi

if $DB_OK && $IMAP_OK && $SOGOD_OK; then
  curl -s "$HEARTBEAT_URL" > /dev/null
  echo "SOGo health check passed — heartbeat sent"
else
  echo "SOGo health check failed — DB: $DB_OK, IMAP: $IMAP_OK, sogod: $SOGOD_OK"
  exit 1
fi

Schedule the check:

*/10 * * * * /usr/local/bin/sogo-health-check.sh >> /var/log/sogo-health.log 2>&1

This heartbeat confirms all three critical dependencies — sogod process, PostgreSQL/MySQL database, and Dovecot IMAP — are healthy simultaneously. A failure in any one of them stops the heartbeat and triggers a Vigilmon alert within 10 minutes.

Step 6: Monitor SOGo Admin Panel (Optional)

SOGo provides an admin API at /SOGo/so/admin/ for managing users, ACLs, and diagnostics. This endpoint requires authentication but confirming it is reachable adds an extra layer of observability for enterprise deployments:

# Test the admin endpoint (requires valid admin credentials)
curl -u "admin:password" https://mail.yourdomain.com/SOGo/so/admin/

For Vigilmon monitoring, add a separate HTTP monitor for /SOGo/so/admin/ with expected status 401 (unauthenticated) or 200 (if you use the SOGo admin credentials in the monitor). This confirms the admin API is routing correctly through sogod.

Step 7: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add email, Slack, PagerDuty, or a webhook to your infrastructure team's on-call channel.
2. Set Consecutive failures before alert to 2 on the web UI and CalDAV monitors — brief sogod restarts during upgrades or OOM recovery can cause a single probe to fail.
3. For the TCP port monitor on port 20000, set Consecutive failures to 1 — a TCP connection failure to sogod is always significant and warrants immediate attention.
4. Keep the heartbeat alert at 1 missed ping.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP + keyword (SOGo) | https://mail.yourdomain.com/SOGo/ | nginx down, sogod crash | | TCP port | Server port 20000 | sogod Objective-C daemon down | | HTTP status 401 | /SOGo/dav/ | CalDAV/CardDAV stack failure | | SSL certificate | SOGo domain | Certificate expiry (30-day window) | | Cron heartbeat | Heartbeat URL every 10 min | PostgreSQL, Dovecot, or sogod failure |

SOGo's power comes from integrating webmail, calendaring, and contacts in one platform — but that integration means more failure points than a simple webmail client. Vigilmon monitors each layer independently so you can pinpoint which component failed, resolve it faster, and keep your users' calendars, contacts, and mail flowing without interruption.