tutorial

Monitoring XCP-ng with Vigilmon

XCP-ng is a powerful open-source hypervisor — but a crashed XAPI daemon or expired Xen Orchestra certificate can silently take down your entire VM fleet. Here's how to monitor XCP-ng hosts, the XAPI REST API, and SSL certificates with Vigilmon.

XCP-ng is an open-source Xen-based hypervisor that gives you enterprise-grade virtualization without the VMware price tag. Running production VMs on XCP-ng means that if the XAPI management daemon goes down, or Xen Orchestra becomes unavailable, your entire infrastructure management plane is gone — even if the VMs themselves keep running. Vigilmon watches the XAPI REST API, Xen Orchestra web UI, host TLS connectivity, and VM backup heartbeats so you know the moment something breaks.

What You'll Set Up

  • HTTP monitor for the XAPI REST API health endpoint
  • Uptime monitor for the Xen Orchestra web UI
  • TCP port monitor for host HTTPS (port 443)
  • SSL certificate expiry alerts for Xen Orchestra and XCP-ng host certificates
  • Heartbeat monitoring for scheduled VM backup jobs

Prerequisites

  • XCP-ng 8.x host running and accessible on your network
  • Xen Orchestra (XO) installed (Community Edition or XOA appliance)
  • A free Vigilmon account

Step 1: Monitor the XAPI REST API

XCP-ng exposes a REST API via the XAPI daemon on every host. The /api/ endpoint returns a version string and confirms the management plane is responsive.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter the XAPI REST API URL: https://your-xcpng-host.local/api/
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Under Advanced, set Verify SSL certificate to No if you use XCP-ng's self-signed certificate (or Yes if you've installed a trusted certificate).
  7. Click Save.

The XAPI daemon must be running for any xe CLI commands, Xen Orchestra operations, or API calls to work. If this monitor alerts, your hypervisor management plane is down even if guest VMs are still running.

To test the endpoint manually:

curl -k https://your-xcpng-host.local/api/
# Should return: {"vendor":"XenSource","product":"XCP-ng","product_version":"8.3.0",...}

Step 2: Monitor Xen Orchestra Web UI Availability

Xen Orchestra (XO) is the primary management interface for XCP-ng. Add a monitor for its web UI:

  1. Click Add Monitor → HTTP / HTTPS.
  2. Enter the Xen Orchestra URL: https://xo.yourdomain.com (or https://your-xo-appliance-ip).
  3. Set Check interval to 1 minute.
  4. Set Expected HTTP status to 200.
  5. Click Save.

If you run XO Community Edition compiled from source, add a secondary check on the Node.js process port:

  1. Click Add Monitor → TCP Port.
  2. Enter Host: your-xo-server.local.
  3. Enter Port: 80 (or 443 if you've set up TLS termination).
  4. Click Save.

An XO outage means no VM console access, no snapshot management, and no live migration — catching it early prevents extended management downtime.

Step 3: TCP Port Monitor for Host HTTPS

XCP-ng hosts accept management connections on port 443. A TCP-level check detects cases where XAPI is unresponsive but the host itself is still reachable:

  1. Click Add Monitor → TCP Port.
  2. Enter Host: your-xcpng-host.local (or IP address).
  3. Enter Port: 443.
  4. Set Check interval to 1 minute.
  5. Click Save.

For multi-host pools, add a TCP monitor for each host. A host dropping off port 443 while the pool master is healthy typically indicates a crashed XAPI daemon or host network failure.

Step 4: SSL Certificate Alerts

XCP-ng generates a self-signed certificate by default, but if you've installed a trusted CA certificate for Xen Orchestra or your hosts, you need to know before it expires.

For Xen Orchestra (public domain with trusted cert)

  1. Open the HTTP / HTTPS monitor created in Step 2.
  2. Enable Monitor SSL certificate.
  3. Set Alert when certificate expires in less than 21 days.
  4. Click Save.

For XCP-ng hosts (if using trusted certs)

XCP-ng 8.3+ supports installing custom TLS certificates on hosts:

# Check current certificate expiry on a host
xe host-param-get uuid=$(xe host-list --minimal) param-name=certificate
openssl x509 -noout -dates -in /etc/xensource/xapi-ssl.pem

If your hosts use trusted certificates, add an SSL monitor for each host's management IP or FQDN via the HTTP / HTTPS monitor with SSL certificate monitoring enabled.

A 21-day alert window gives you time to roll new certificates across the pool before any expire.

Step 5: Heartbeat Monitoring for VM Backup Jobs

XCP-ng snapshot-based backups (via Xen Orchestra or xe snapshot-create) run as scheduled tasks. There's no built-in alert if a backup job silently fails or hangs. Use Vigilmon heartbeats to catch missed runs.

  1. In Vigilmon, click Add Monitor → Cron Heartbeat.
  2. Set the expected ping interval to match your backup schedule (e.g. 1440 minutes for daily backups).
  3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

For Xen Orchestra backup jobs

XO's continuous replication and backup jobs support a post-job hook. Add the Vigilmon ping to a wrapper script that XO calls after each successful job, or use XO's API to trigger it:

#!/bin/bash
# /usr/local/bin/xcpng-backup-heartbeat.sh
# Run after successful XO backup job completes

JOB_STATUS=$?
if [ $JOB_STATUS -eq 0 ]; then
    curl -s --max-time 10 https://vigilmon.online/heartbeat/abc123
fi

For xe CLI backup scripts

If you schedule snapshots with xe and cron:

#!/bin/bash
# /usr/local/bin/backup-vms.sh

VM_UUID="your-vm-uuid"
SNAPSHOT_NAME="daily-backup-$(date +%Y%m%d)"

xe vm-snapshot uuid=$VM_UUID new-name-label="$SNAPSHOT_NAME" && \
    curl -s --max-time 10 https://vigilmon.online/heartbeat/abc123

echo "Backup completed: $SNAPSHOT_NAME"

Add to cron:

0 2 * * * /usr/local/bin/backup-vms.sh >> /var/log/xcpng-backup.log 2>&1

If the backup script crashes or produces a non-zero exit code, the heartbeat ping is never sent and Vigilmon alerts after the interval passes.

Step 6: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and add email, Slack, or a webhook endpoint.
  2. For XAPI and TCP monitors, set Consecutive failures before alert to 2 — brief network glitches or XAPI restarts can cause isolated probe failures.
  3. For the Xen Orchestra UI monitor, set Consecutive failures to 3 — XO sometimes takes a moment to respond during heavy operations.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP (XAPI REST) | https://host/api/ | XAPI daemon down, management plane failure | | HTTP (Xen Orchestra) | https://xo.domain.com | XO web UI unavailable | | TCP port | host:443 | Host network failure, XAPI unresponsive | | SSL certificate | XO domain / host cert | Certificate expiry before renewal | | Cron heartbeat | Heartbeat URL | Missed or failed VM backup jobs |

XCP-ng gives you enterprise hypervisor capability at zero license cost — but that also means zero managed monitoring. With Vigilmon watching the XAPI REST API, Xen Orchestra, host TLS connectivity, and backup job heartbeats, you get the same observability assurance that commercial virtualization platforms bundle into their support contracts.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles