This article assumes you’ll be using Ubuntu Server 20.04 or 24.04.
Motivation
Monit is a simple and lightweight tool for monitoring and managing services, processes, files and filesystems on your Linux server. It’s proactive capabilities make it a great choice for server automation. Below are detailed steps on how to install, configure, and use Monit on Ubuntu Server 20.04 and 24.04.
Alternatives
Netdata comes with WordOps and does a great job showing your server’s stats. But it doesn’t have the proactive monitoring features that Monit offers. Other tools like Kibana, Zabbix and Nagios are also popular, but they’re harder to set up and consume more system resources.
Install Monit
Luckily, Monit is included in the Ubuntu’s repository, so let’s install with:
sudo apt update
sudo apt install monitBasic Configuration
The main configuration file for Monit is located at /etc/monit/monitrc. Before editing, it’s a good idea to create a backup:
sudo cp /etc/monit/monitrc /etc/monit/monitrc.backupBy default, Monit checks services every 2 minutes (120 seconds). You can modify this value in the file by editing the line below. We prefer checks to happen every 1 minute:
set daemon 60Monit comes with its own mailserver, but since we need something more robust and have already configured Sendmail, let’s use it as our MTA, pointing the setting to localhost (this parameter is commented by default, so you can just paste above it):
set mailserver localhostThe mail-format parameter define all aspect of your email structure so you’ll need to uncomment all its lines, and the minimal configuration is just changing your FROM email:
from: Monit <mo************@*****le.com>Set an email that will receive all alerts from Monit, typically your own business email:
set alert al****@*****le.comMonit uses its embedded HTTP interface both for providing a web-based status page and for handling command-line commands. Even if you don’t want to enable the web interface, you must supply a valid, complete configuration block in order to establish and endpoint and properly manage Monit.
set httpd port 2812 and use address localhost
allow localhost
allow admin:monit # require user 'admin' with password 'monit'To allow remote access, change localhost to the appropriate server IP or domain, and set secure authentication credentials.
Include additional configuration files:
Aside from its main configuration file, Monit may include additional configuration files from /etc/monit/conf-enabled/. We’ll add several monitors inside this directory, covering most of the services we use on our server, but let’s start with the most important, security.
Monitor successful SSH logins
This is a crucial first alert, since we need to know whenever someone makes a sucessfully login into our server via SSH. This alert was provided by Shireesh at Elitmus and we’ll name it ssh_logins.conf:
check file ssh_logins with path /var/log/auth.log
ignore match "/etc/monit/whitelist_ips.regex"
if match "Accepted publickey" then alertAdd one IP per line on the file /etc/monit/whitelist_ips.regex or comment/remove it if you want to receive all alerts.
Monitor the LEMP stack
Aptly named lemp.conf this monitor cover our systems resources, like storage, CPU and RAM, NGINX, PHP and MySQL, which is MariaDB in our case. The formula for loadavg is 1.5 * numbers of CPU cores:
# Check the filesystem usage on the root filesystem
check filesystem rootfs with path /
if space usage > 90% then alert # Alert if the disk space usage exceeds 90%
# Check system performance metrics on localhost
check system localhost
if loadavg (1min) > 6 then alert # Alert if the 1-minute load average exceeds 6
if loadavg (5min) > 4 then alert # Alert if the 5-minute load average exceeds 4
if memory usage > 90% then alert # Alert if memory usage exceeds 90%
# Alert if CPU usage exceeds 80% for 15 consecutive checks
if cpu usage > 80% for 15 cycles then alert # Total CPU usage
if cpu usage (user) > 70% then alert # User CPU usage
if cpu usage (system) > 30% then alert # System CPU usage
if cpu usage (wait) > 20% then alert # I/O wait CPU usage
# Check the Nginx web server process (HTTPS)
check process nginx with pidfile /var/run/nginx.pid
start program = "/usr/sbin/service nginx start"
stop program = "/usr/sbin/service nginx stop"
if cpu > 80% for 2 cycles then alert # Alert if CPU usage exceeds 80% for 2 consecutive checks
if failed host 127.0.0.1 port 443 protocol https then restart # Restart if Nginx is not responding on HTTPS
# Check the MySQL database server process
check process mysqld with pidfile /var/run/mysqld/mysqld.pid
start program = "/usr/sbin/service mysql start"
stop program = "/usr/sbin/service mysql stop"
if cpu > 80% for 2 cycles then alert # Alert if CPU usage exceeds 80% for 2 consecutive checks
if failed unixsocket /var/run/mysqld/mysqld.sock then restart # Restart MySQL if the Unix socket is not responding
# Check the PHP-FPM process for PHP 8.3
check process php8.3-fpm with pidfile /var/run/php/php8.3-fpm.pid
start program = "/usr/sbin/service php8.3-fpm start"
stop program = "/usr/sbin/service php8.3-fpm stop"
if cpu > 80% for 2 cycles then alert # Alert if CPU usage exceeds 80% for 2 consecutive checksMonitor Redis
Let’s add Redis monitoring on a separate file, redis.conf, since it’s not crucial to running WordPress and can be disabled if needed:
# Redis Monitoring (using Unix socket)
check process redis with pidfile /var/run/redis/redis-server.pid
start program = "/usr/sbin/service redis-server start"
stop program = "/usr/sbin/service redis-server stop"
# Process resource monitoring
if cpu usage > 80% for 5 cycles then alert
if memory usage > 75% then alert
if children > 255 for 5 cycles then alert
group redis
# Check Redis log file for errors
check file redis_log with path /var/log/redis/redis-server.log
if match "ERROR" then alert
if match "CRITICAL" then alert
group redisMonitor Fail2Ban
Using the same methodology, let’s add fail2ban.conf:
check process fail2ban with pidfile /var/run/fail2ban/fail2ban.pid
group services
start program = "/etc/init.d/fail2ban force-start"
stop program = "/etc/init.d/fail2ban stop"
if failed unixsocket /var/run/fail2ban/fail2ban.sock then restart
if 5 restarts within 5 cycles then timeout
check file fail2ban_log with path /var/log/fail2ban.log
if match "ERROR|WARNING" then alertMonitor ClamAV
We need to know if ClamAV, that we installed earlier, finds any virus or malware on our server, so our clamav.conf looks this:
# Watch the ClamAV log file for changes that indicate a detection
check file clamav_log with path /var/log/clamav/clamav.log
if match "FOUND" then alertMonitor the integrity of sensitive files
Monit can watch important files or those that probably shouldn’t change that often and alerts us whenever that happens. That activity is usually called “file integrity monitoring”, so our conf file is name fim.conf and inside it you can list your files like so:
# Monitoring the WordPress configuration file for changes
check file wp_config with path /var/www/example.com/wp-config.php
if changed checksum then alert
check file whitelist_ips with path /etc/monit/whitelist_ips.regex
if changed checksum then alertEnable and Start the Monit Service
Enable Monit to start automatically at boot:
sudo systemctl enable monitThen start the Monit service:
sudo systemctl start monitYou can check the status of the Monit service with:
sudo systemctl status monitTesting the Monit Configuration
Before putting your Monit configuration into production, test it:
sudo monit -t
sudo monit reload
sudo monit statusThe monit status command will list all the services and processes currently being monitored by Monit.
If there are configuration errors, Monit will display them, and you can fix them accordingly.
Leave a Reply