Monitoring UniFi Network Application with Vigilmon

The UniFi Network Application is the nerve center for every Ubiquiti network — managing Wi-Fi access points, switches, routers, and security gateways from a single web UI. When the controller goes down, adopted devices keep running on cached config, but you lose visibility, can't push configuration changes, and won't know when a device disconnects. Vigilmon keeps watch on the UniFi web UI, the REST API, device adoption health, MongoDB connectivity, and your SSL certificate so you catch failures before they become outages.

What You'll Set Up

• HTTP uptime monitor for the UniFi web UI (port 8443 HTTPS)
• API health check via the UniFi login endpoint
• Device adoption status monitor via the UniFi statistics API
• SSL certificate expiry alert for custom-domain UniFi deployments
• TCP heartbeat monitor for UniFi's embedded MongoDB (port 27117)

Prerequisites

• UniFi Network Application 7.x+ running as a standalone Java app or Docker container
• Controller accessible over HTTPS (default port 8443, or a reverse-proxy domain)
• A free Vigilmon account

Step 1: Monitor the UniFi Web UI (Port 8443)

The UniFi controller serves its management UI on port 8443 over HTTPS. A successful HTTP response confirms the Java application server and embedded web server are running.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the controller URL: https://your-unifi-host:8443/manage
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Enable Accept invalid/self-signed certificates — UniFi uses a self-signed cert by default.
7. Click Save.

If your UniFi controller is behind a reverse proxy on a custom domain (e.g. https://unifi.yourdomain.com), use that URL and leave the self-signed cert option disabled — the proxy certificate is what you want to validate.

Step 2: Monitor the UniFi API Health via Login Endpoint

The UniFi REST API login endpoint performs a deeper health check than a simple HTTP probe: a successful POST confirms the API daemon is running, the application is initialized, and MongoDB is accessible (the login handler reads from the database).

1. In Vigilmon, click Add Monitor → HTTP / HTTPS.
2. Set URL to https://your-unifi-host:8443/api/login
3. Set Method to POST.
4. Set Request body to:

{"username": "monitoring_user", "password": "monitoring_password"}

5. Set Expected HTTP status to 200.
6. Enable Accept invalid/self-signed certificates if using the default self-signed cert.
7. Set Check interval to 5 minutes.
8. Click Save.

Create a read-only local account in the UniFi controller (Settings → Admins → Add Admin) specifically for this health check. A 200 response with a session cookie confirms the API is fully operational and MongoDB returned a valid user record.

Step 3: Monitor Device Adoption Status via the Statistics API

The /api/s/default/stat/device endpoint returns the list of all adopted UniFi devices with their current status. A sudden drop in connected devices indicates a network issue or controller database corruption — even if the web UI is still loading.

Add a custom HTTP monitor that fetches this endpoint:

1. In Vigilmon, click Add Monitor → HTTP / HTTPS.
2. Set URL to https://your-unifi-host:8443/api/s/default/stat/device
3. Set Method to GET.
4. Set Expected HTTP status to 200.
5. Enable Accept invalid/self-signed certificates if needed.
6. Set Check interval to 5 minutes.
7. Add the session cookie from Step 2 as a Cookie header, or use the Vigilmon scripted monitor to first authenticate and then fetch device stats.
8. Set Expected response body contains to "state":1 — at least one device with state 1 (connected) must be present.
9. Click Save.

For a simpler probe, monitor just the API endpoint availability (200 status) without asserting on device count, and use the heartbeat in Step 5 for deeper MongoDB-level health.

Step 4: SSL Certificate Alerts for Custom-Domain Deployments

If your UniFi controller is reverse-proxied behind nginx or Caddy on a custom domain, the SSL certificate on that domain needs monitoring. Let's Encrypt renewals can fail silently.

1. Open the HTTP / HTTPS monitor from Step 1 (the one using your custom domain).
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

For the default self-signed certificate on port 8443, you can skip SSL expiry monitoring since UniFi manages its own cert rotation. Focus SSL monitoring on any externally-facing reverse proxy domain.

Step 5: Heartbeat Monitoring for UniFi MongoDB (Port 27117)

UniFi stores all device configuration, client history, and network statistics in an embedded MongoDB instance on port 27117 (or a custom port in Docker deployments). If MongoDB fails, the UniFi web UI may partially load but device config reads, client lookups, and statistics will fail silently.

Add a TCP probe to monitor MongoDB availability independently:

1. In Vigilmon, click Add Monitor → TCP Port.
2. Set Host to your UniFi server hostname or IP.
3. Set Port to 27117 (or your custom MongoDB port).
4. Set Check interval to 1 minute.
5. Click Save.

This TCP probe confirms MongoDB is accepting connections. Alert on TCP failure independently from the web UI check — the web UI may respond with 200 while MongoDB is in a degraded state. A MongoDB alert while the web UI is healthy is a strong signal of impending controller failure requiring immediate attention.

For Docker deployments, also verify the MongoDB port is exposed to the host:

# docker-compose.yml excerpt
ports:
  - "27117:27017"  # expose MongoDB to host for TCP monitoring

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or a webhook.
2. Set Consecutive failures before alert to 2 on the web UI monitor — UniFi restarts can cause a single probe to fail.
3. Set Consecutive failures before alert to 1 on the MongoDB TCP monitor — MongoDB failures need immediate attention.
4. Use Maintenance windows in Vigilmon when pushing UniFi controller upgrades:

# Trigger maintenance window before upgrade
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "MONITOR_ID", "duration_minutes": 15}'

# Upgrade UniFi controller
sudo systemctl stop unifi
# ... perform upgrade ...
sudo systemctl start unifi

Summary

| Monitor | Target | What It Catches | |---|---|---| | Web UI | https://host:8443/manage | Java app crash, web server down | | API login | POST /api/login | API daemon failure, MongoDB read error | | Device stats | GET /api/s/default/stat/device | Controller DB corruption, device disconnects | | SSL certificate | Custom proxy domain | Let's Encrypt renewal failure | | TCP MongoDB | host:27117 | MongoDB crash, storage failure |

UniFi's self-hosted model gives you full control over your network management stack — but that control means you own the uptime. With Vigilmon watching the web UI, API, device adoption health, and MongoDB independently, you get layered visibility that catches partial failures before the entire network management stack becomes unavailable.