Monitoring Webmin with Vigilmon

Webmin is the world's most widely deployed open-source web-based system administration interface. Built in Perl with over 30 years of active development and more than 100 modules covering everything from Apache and Postfix to firewall rules and user management, it runs on Debian, Ubuntu, CentOS, RHEL, and most other Unix-like systems. Webmin gives non-command-line administrators full control over their servers — but when the Webmin service itself goes down, that control disappears entirely. Vigilmon monitors Webmin's web UI availability, the login endpoint, TCP service health on port 10000, SSL certificate expiry, and scheduled task execution, so you maintain visibility even when Webmin can't be reached.

What You'll Set Up

HTTP monitor for the Webmin web UI (port 10000 HTTPS login page)
HTTP monitor for the /session_login.cgi login endpoint
TCP port monitor for Webmin service health (port 10000)
SSL certificate expiry alerts for the Webmin management interface
Cron heartbeat monitoring for Webmin Scheduled Commands (backup scripts, system monitoring scripts, cron-based jobs)

Prerequisites

Webmin installed and running on a Linux server (Debian/Ubuntu/CentOS/RHEL or similar)
Webmin configured with HTTPS (strongly recommended for production)
A free Vigilmon account

Step 1: Monitor the Webmin Web UI (Port 10000)

Webmin listens on HTTPS port 10000 by default. This is the primary access point for all server administration — if the service stops or the port becomes unreachable, all administrative access via the web interface is lost.

Log in to vigilmon.online and click Add Monitor.
Set Type to HTTP / HTTPS.
Enter your Webmin URL: https://your-server-ip:10000 or https://admin.yourdomain.com:10000.
Set Check interval to 1 minute.
Set Expected HTTP status to 200.
Click Save.

Webmin's root URL redirects to the login page and returns HTTP 200 on a healthy installation. A crashed Webmin process or blocked port returns a connection error immediately detected by Vigilmon.

Step 2: Monitor the Webmin Login Endpoint

The /session_login.cgi endpoint is Webmin's authentication handler — the specific CGI script that processes login credentials. Monitoring this endpoint separately from the root URL verifies that Webmin's Perl CGI execution layer is functioning, not just the static file serving.

In Vigilmon, click Add Monitor → HTTP / HTTPS.
Set the URL to https://your-server-ip:10000/session_login.cgi.
Set Expected HTTP status to 200.
Under Response body, enable Contains keyword and enter Webmin to confirm the Webmin login form is returned.
Set Check interval to 2 minutes.
Click Save.

The login page contains the text "Webmin" in its HTML body. A keyword match confirms the Perl CGI environment is executing correctly, not just that the TCP port is open.

Step 3: Monitor TCP Port 10000

The TCP port monitor is your lowest-level availability check. It establishes a raw TCP connection to port 10000 without sending any HTTP request, confirming that the Webmin process is bound to the port and accepting connections.

In Vigilmon, click Add Monitor → TCP Port.
Enter your server's hostname or IP.
Set Port to 10000.
Set Check interval to 1 minute.
Click Save.

Layer the three checks together: TCP port 10000 confirms the process is running, the root URL confirms HTTP is served, and /session_login.cgi confirms CGI execution. If TCP passes but HTTP fails, the Webmin Perl process is partially degraded. If TCP fails, the process has crashed entirely.

Step 4: SSL Certificate Alerts for the Webmin Interface

Webmin generates a self-signed certificate during installation and can be configured to use a real CA-signed or Let's Encrypt certificate. Certificate expiry on the management interface locks administrators out of the server if their browser enforces HTTPS errors (or triggers security warnings that erode trust in your infrastructure management workflows).

Open the HTTP monitor for port 10000 created in Step 1.
Enable Monitor SSL certificate under the SSL section.
Set Alert when certificate expires in less than 21 days.
Click Save.

To renew or replace the Webmin certificate, go to Webmin → Webmin Configuration → SSL Encryption. If you're using Let's Encrypt via the Webmin Let's Encrypt module, you can trigger renewal there directly. For manual renewal with Certbot:

certbot certonly --standalone --preferred-challenges http \
  -d admin.yourdomain.com --non-interactive --agree-tos \
  -m your-email@yourdomain.com

Then update the certificate paths in Webmin Configuration → SSL Encryption to point to the new certificate and key files.

Step 5: Heartbeat Monitoring for Webmin Scheduled Commands

Webmin's Scheduled Commands module (under System → Scheduled Commands) provides a cron-based task scheduler accessible through the Webmin UI. System administrators commonly use it for backup scripts, disk cleanup routines, log rotation, and custom monitoring scripts. These background jobs have no HTTP endpoint to probe — use Vigilmon's heartbeat monitor to confirm they complete successfully.

Create a heartbeat monitor

In Vigilmon, click Add Monitor → Cron Heartbeat.
Set the Expected ping interval to match your job frequency (e.g., 1440 minutes for a nightly backup, 60 minutes for an hourly cleanup script).
Copy the heartbeat URL: https://vigilmon.online/heartbeat/your-token.
Click Save.

Wire the heartbeat to a Webmin Scheduled Command

In the Webmin UI, go to System → Scheduled Commands and edit the relevant command. Add the Vigilmon ping at the end of the command:

/root/scripts/nightly-backup.sh && curl -s https://vigilmon.online/heartbeat/your-token

Alternatively, add the heartbeat directly to the system crontab from the Webmin → System → Scheduled Cron Jobs interface:

0 2 * * * /root/scripts/nightly-backup.sh && curl -s https://vigilmon.online/heartbeat/your-token

For a script that should always ping Vigilmon regardless of exit status (so you can track that it ran and inspect its output separately):

0 2 * * * /root/scripts/nightly-backup.sh; curl -s https://vigilmon.online/heartbeat/your-token

Use && when you want Vigilmon to alert on task failure (the ping is withheld on error). Use ; when you want Vigilmon to alert only on completely missed runs (the ping fires even if the task fails, but Vigilmon still alerts if the job doesn't run at all).

Step 6: Configure Alert Channels

Go to Alert Channels in Vigilmon and add your notification method — email, Slack, or a webhook for your incident response tool.
For the web UI and login endpoint monitors, set Consecutive failures before alert to 2 — Webmin occasionally takes a few seconds to restart after a module operation or package update.
For the TCP port monitor, you may prefer 1 failure — a port-down condition means complete loss of administrative access.
For heartbeat monitors tied to critical backups, set up a secondary alert channel (e.g., SMS or PagerDuty) in addition to email.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP (Webmin UI) | https://server:10000 | Webmin process crash, port block | | HTTP (login CGI) | https://server:10000/session_login.cgi | CGI execution failure | | TCP port | :10000 | Webmin process fully stopped | | SSL certificate | Port 10000 management interface | Certificate expiry | | Cron heartbeat | Backup scripts, system tasks | Scheduled job failure or missed run |

Webmin's three-decade track record means it's often the last piece of server infrastructure administrators think to monitor — it's always just been there. With Vigilmon watching the web UI, the login CGI, the TCP service health, the SSL certificate, and scheduled task execution, you'll know immediately when "it's always been there" stops being true.