tutorial

How to Monitor Weave Scope with Vigilmon (HTTP + TCP + Alerts)

Weave Scope is a real-time Kubernetes and Docker cluster visualization and monitoring tool that automatically discovers all containers, pods, services, and t...

Weave Scope is a real-time Kubernetes and Docker cluster visualization and monitoring tool that automatically discovers all containers, pods, services, and their connections across your infrastructure. Its server component aggregates probe data from every node and serves the interactive topology UI — if the Scope server goes down, the entire visualization platform goes dark and your team loses real-time visibility into running workloads. Vigilmon adds the external perspective that Weave Scope cannot provide for itself: continuous uptime and latency checks from outside your infrastructure that keep watching even when the visualization platform is the component that has failed. You can add your first monitor for free, no credit card required.

Why Weave Scope needs external monitoring

  • Server process crash makes the topology UI inaccessible. Weave Scope runs a central server that all Scope probes connect to and that serves the browser-based topology UI. When the server process crashes — due to OOM, uncaught exception, or disk exhaustion — every engineer trying to visualize the cluster hits a blank page or connection error. Because the failure is in the monitoring layer itself, no internal alert fires, and the outage typically goes unnoticed until someone opens the UI and finds it dark.

  • Probe disconnections corrupt the topology without surfacing an error. Each cluster node runs a Scope probe that connects back to the server over a long-lived TCP connection. If the server's TCP listener becomes overloaded or the port binding fails after a restart, probes begin accumulating reconnect errors in their logs but the server process stays alive — it simply serves a stale or partial topology. From the outside, the UI loads but shows incorrect data. An external HTTP monitor that validates the health endpoint status catches this class of failure immediately.

  • TLS certificate expiry breaks all probe connections simultaneously. When Weave Scope is deployed with TLS enabled, all probe-to-server connections use the same certificate. If that certificate expires, every probe on every node fails to connect simultaneously, instantly zeroing out the topology display. Because the failure affects all probes at once, it does not look like a node failure — it looks like the entire cluster disappeared. An external SSL and HTTP monitor catches the expiry before it impacts the platform.

  • Memory exhaustion causes the topology renderer to stall. Weave Scope builds an in-memory graph of the entire cluster topology and continuously updates it as pods start and stop. In large clusters with many short-lived pods, this graph can grow to consume several gigabytes of memory. The OS eventually kills the process, but the pod or service running Scope may not restart before the liveness probe grace period expires, leaving the UI serving stale data or a loading spinner indefinitely. Only an external monitor detects this as a real outage.

  • Reverse proxy misconfiguration silently breaks the UI without affecting health endpoints. In many deployments Weave Scope is exposed through a reverse proxy or Kubernetes Ingress. A configuration update to the Ingress controller — a path rewrite rule, header modification, or WebSocket timeout reduction — can break the topology's WebSocket connection and render the interactive UI non-functional while the Scope server itself responds healthy to internal checks. An external HTTP monitor that probes the Ingress URL catches proxy-layer failures that health checks on the service itself will never see.

What you'll need

  • A running Weave Scope instance with its server accessible over HTTPS
  • The public hostname or IP for your Weave Scope deployment, for example https://scope.example.com
  • A free Vigilmon account — monitors start running in under a minute with no credit card required

Step 1: Expose Weave Scope's health endpoint

Verify your Weave Scope installation is reachable and locate the health endpoint before configuring Vigilmon monitors.

# Check Weave Scope server health endpoint
curl -I https://scope.example.com/api

# Sample output:
# HTTP/2 200
# content-type: application/json
# x-scope-probe-version: 1.13.2

# Verify the topology API is responding
curl -s https://scope.example.com/api/topology | jq '.pipe_id // "ok"'
# Expected: "ok" or a non-empty topology descriptor

# Check the UI root
curl -I https://scope.example.com/
# Expected: HTTP/2 200

If Weave Scope is running in Kubernetes as a DaemonSet and Service, verify the Service and Ingress are correctly configured:

# Check the Weave Scope service
kubectl get svc -n weave weave-scope-app -o wide

# Expected:
# NAME               TYPE        CLUSTER-IP    PORT(S)   READY
# weave-scope-app    ClusterIP   10.96.x.x     80/TCP    1/1

# Check the Ingress
kubectl get ingress -n weave

# Test from inside the cluster
kubectl run tmp-curl --image=curlimages/curl --rm -it --restart=Never \
  --namespace=weave -- curl -s http://weave-scope-app.weave.svc.cluster.local/api

If Weave Scope is running in Docker, confirm the container is healthy:

# Check container status
docker ps --filter name=scope --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

# Sample output:
# NAMES          STATUS        PORTS
# weavescope     Up 3 days     0.0.0.0:4040->4040/tcp

# Test health inside the container
docker exec weavescope curl -s http://localhost:4040/api

Step 2: Set up HTTP monitoring in Vigilmon

Add an HTTP monitor for the Weave Scope health endpoint:

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Monitor type to HTTP.
  3. Enter the URL: https://scope.example.com/api
  4. Set Check interval to 60 seconds and Expected status code to 200.
  5. Click Save Monitor — Vigilmon will run the first check within a minute.

Add a monitor for the Weave Scope topology API

The topology endpoint is the core data path — a failure here means engineers are looking at a frozen or empty cluster view:

  1. Click Add Monitor again.
  2. Set Monitor type to HTTP.
  3. Enter the URL: https://scope.example.com/api/topology
  4. Set Expected status code to 200 and Timeout to 10 seconds.
  5. Under Response body contains, enter topologies to confirm the topology descriptor is being returned.
  6. Click Save Monitor.

Why external monitoring catches what internal checks miss

Weave Scope is a monitoring tool, which creates a fundamental blind spot: when Scope itself fails, there is nothing inside the stack to generate an alert. Internal Kubernetes probes check whether the Scope pod is running and whether it returns a healthy status code from inside the cluster network — but they cannot detect Ingress routing failures, external DNS misconfiguration, TLS certificate expiry, or load balancer degradation. Vigilmon operates entirely outside your infrastructure, probing Scope from external network vantage points on a fixed interval. It is the only reliable way to know when your cluster visualization platform is dark.

Step 3: Monitor Weave Scope's TCP port

A TCP monitor confirms that the Weave Scope server is accepting connections at the network layer before HTTP processing begins. This catches scenarios where the web server has stopped binding to its port or where a load balancer is terminating connections without forwarding them to the Scope container.

  1. In Vigilmon, click Add Monitor.
  2. Set Monitor type to TCP.
  3. Enter Host: scope.example.com and Port: 443.
  4. Set Check interval to 60 seconds.
  5. Click Save Monitor.

If your Weave Scope instance is exposed on a non-standard port, add a TCP monitor for that port as well:

# Find the ports Weave Scope is listening on
ss -tlnp | grep scope
# or for Docker
docker inspect weavescope | jq '.[0].NetworkSettings.Ports'

# Sample output:
# {
#   "4040/tcp": [{"HostIp": "0.0.0.0", "HostPort": "4040"}]
# }

Add a separate TCP monitor for port 4040 if Scope is exposed directly without a TLS-terminating proxy, so you can distinguish network-layer failures from application-layer failures when an alert fires.

Step 4: Configure alert channels

Email alerts

  1. In Vigilmon, go to Alert Channels and click Add Channel.
  2. Choose Email and enter the address that should receive notifications (for example, platform-team@example.com or an on-call distribution list).
  3. Assign this channel to all Weave Scope monitors created in Steps 2 and 3.
  4. Click Save — Vigilmon will send a test email to confirm delivery.

Webhook alerts

For Slack, PagerDuty, or an internal incident management system, add a webhook channel:

  1. In Alert Channels, click Add Channel and choose Webhook.
  2. Paste your endpoint URL (a Slack incoming webhook, PagerDuty Events API v2 endpoint, or custom URL).
  3. Vigilmon will POST the following JSON payload when a monitor transitions to down:
{
  "monitor_id": "mon_weave_scope_api",
  "monitor_name": "Weave Scope /api",
  "status": "down",
  "previous_status": "up",
  "checked_at": "2026-07-12T09:14:22Z",
  "response_time_ms": null,
  "status_code": null,
  "error": "Connection refused",
  "url": "https://scope.example.com/api"
}
  1. Assign all Weave Scope monitors to this channel and click Save.

Runbook: diagnostics to run when an alert fires

#!/bin/bash
# Weave Scope alert runbook — run these in order when Vigilmon fires

echo "=== Scope pod status ==="
kubectl get pods -n weave -l app=weave-scope,weave-scope-component=app

echo "=== Scope service endpoints ==="
kubectl get endpoints -n weave weave-scope-app

echo "=== Recent Scope app events ==="
kubectl get events -n weave --sort-by='.lastTimestamp' | tail -20

echo "=== Scope API health ==="
curl -sv https://scope.example.com/api 2>&1 | tail -20

echo "=== Topology endpoint response ==="
curl -s https://scope.example.com/api/topology | jq 'keys'

echo "=== Port connectivity ==="
nc -zv scope.example.com 443

echo "=== TLS certificate expiry ==="
echo | openssl s_client -connect scope.example.com:443 \
  -servername scope.example.com 2>/dev/null \
  | openssl x509 -noout -enddate

echo "=== Scope app logs (last 100 lines) ==="
kubectl logs -n weave -l app=weave-scope,weave-scope-component=app --tail=100

Step 5: Create a public status page

A Vigilmon status page gives your engineering team and any teams that depend on cluster visibility a single URL to check Weave Scope health during incidents — no Kubernetes access required.

  1. In Vigilmon, navigate to Status Pages and click New Status Page.
  2. Give it a name such as Weave Scope Cluster Visualization and choose a subdomain like scope-status.vigilmon.page.
  3. Add all monitors created in this tutorial: the /api HTTP monitor, the /api/topology HTTP monitor, and the TCP port monitor.
  4. Optionally add a description explaining which teams rely on Weave Scope for cluster visibility.
  5. Click Publish — the page is immediately accessible and updates in real time.

Share this URL in your team's incident response runbook and link it from your internal developer documentation so engineers know where to check when the topology UI is unavailable.

Putting it all together

| Monitor | Type | What it catches | |---|---|---| | https://scope.example.com/api | HTTP | Scope server crash, process OOM kill, reverse proxy misconfiguration, TLS expiry | | https://scope.example.com/api/topology | HTTP | Topology data failure, probe disconnections, renderer stall | | scope.example.com:443 | TCP | Network-level connectivity loss, load balancer failure, port binding failure |

# Quick-reference diagnostic one-liners when a Vigilmon alert fires

# 1. Is the Scope pod running?
kubectl get pods -n weave -l app=weave-scope,weave-scope-component=app

# 2. Are there recent errors in the Scope app?
kubectl logs -n weave -l app=weave-scope,weave-scope-component=app --tail=50

# 3. Can the API endpoint be reached?
curl -sf https://scope.example.com/api || echo "API check FAILED"

# 4. Is the topology returning data?
curl -s https://scope.example.com/api/topology | jq 'keys // "empty"'

# 5. Is port 443 open?
nc -zv scope.example.com 443 && echo "Port open" || echo "Port CLOSED"

# 6. How long until the TLS cert expires?
echo | openssl s_client -connect scope.example.com:443 \
  -servername scope.example.com 2>/dev/null \
  | openssl x509 -noout -enddate

What's next

  • SSL certificate monitoring — Vigilmon can alert you days before the TLS certificate on scope.example.com expires, giving you time to renew before probe connections begin failing. Add an SSL monitor pointing at the same hostname.
  • Heartbeat monitoring for probe continuity — Configure a cron job to periodically verify that Weave Scope is receiving data from all cluster nodes and POST a heartbeat to a Vigilmon dead-man's-switch endpoint after each successful check. If the pipeline stops sending heartbeats, Vigilmon fires an alert that does not depend on the Scope stack being available.
  • Latency trend monitoring — Use Vigilmon's response time history to establish a latency baseline for the /api and /api/topology endpoints. Sudden latency increases often precede full outages in topology-heavy workloads and give you time to scale or restart the service before visibility is lost.

Get started free at vigilmon.online — no credit card, monitors start running in under a minute.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles