There is a new version of this tutorial available for Debian 8 (Jessie).

Server Monitoring With munin And monit On Debian Etch - Page 2

4 Install And Configure monit

To install monit, we do this:

apt-get install monit

Now we must edit /etc/monit/monitrc. The default /etc/monit/monitrc has lots of examples, and you can find more configuration examples on However, in my case I want to monitor proftpd, sshd, mysql, apache, and postfix, I want to enable the monit web interface on port 2812, I want a https web interface, I want to log in to the web interface with the username admin and the password test, and I want monit to send email alerts to root@localhost, so my file looks like this:

cp /etc/monit/monitrc /etc/monit/monitrc_orig
cat /dev/null > /etc/monit/monitrc
vi /etc/monit/monitrc

set daemon  60
set logfile syslog facility log_daemon
set mailserver localhost
set mail-format { from: }
set alert root@localhost
set httpd port 2812 and
     PEMFILE  /var/certs/monit.pem
     allow admin:test

check process proftpd with pidfile /var/run/
   start program = "/etc/init.d/proftpd start"
   stop program  = "/etc/init.d/proftpd stop"
   if failed port 21 protocol ftp then restart
   if 5 restarts within 5 cycles then timeout

check process sshd with pidfile /var/run/
   start program  "/etc/init.d/ssh start"
   stop program  "/etc/init.d/ssh stop"
   if failed port 22 protocol ssh then restart
   if 5 restarts within 5 cycles then timeout

check process mysql with pidfile /var/run/mysqld/
   group database
   start program = "/etc/init.d/mysql start"
   stop program = "/etc/init.d/mysql stop"
   if failed host port 3306 then restart
   if 5 restarts within 5 cycles then timeout

check process apache with pidfile /var/run/
   group www
   start program = "/etc/init.d/apache2 start"
   stop program  = "/etc/init.d/apache2 stop"
   if failed host port 80 protocol http
      and request "/monit/token" then restart
   if cpu is greater than 60% for 2 cycles then alert
   if cpu > 80% for 5 cycles then restart
   if totalmem > 500 MB for 5 cycles then restart
   if children > 250 then restart
   if loadavg(5min) greater than 10 for 8 cycles then stop
   if 3 restarts within 5 cycles then timeout

check process postfix with pidfile /var/spool/postfix/pid/
   group mail
   start program = "/etc/init.d/postfix start"
   stop  program = "/etc/init.d/postfix stop"
   if failed port 25 protocol smtp then restart
   if 5 restarts within 5 cycles then timeout

(Please make sure that you check processes only that really exist on your server - otherwise monit won't start. I.e., if you tell monit to check Postfix, but Postfix isn't installed on the system, monit won't start.)

The configuration file is pretty self-explaining; if you are unsure about an option, take a look at the monit documentation:

In the apache part of the monit configuration you find this:

   if failed host port 80 protocol http
      and request "/monit/token" then restart

which means that monit tries to connect to on port 80 and tries to access the file /monit/token which is /var/www/ because our web site's document root is /var/www/ If monit doesn't succeed it means Apache isn't running, and monit is going to restart it. Now we must create the file /var/www/ and write some random string into it:

mkdir /var/www/
echo "hello" > /var/www/

Next we create the pem cert (/var/certs/monit.pem) we need for the SSL-encrypted monit web interface:

mkdir /var/certs
cd /var/certs

We need an OpenSSL configuration file to create our certificate. It can look like this:

vi /var/certs/monit.cnf

# create RSA certs - Server

RANDFILE = ./openssl.rnd

[ req ]
default_bits = 1024
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type

[ req_dn ]
countryName = Country Name (2 letter code)
countryName_default = MO

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Monitoria

localityName                    = Locality Name (eg, city)
localityName_default            = Monittown

organizationName                = Organization Name (eg, company)
organizationName_default        = Monit Inc.

organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = Dept. of Monitoring Technologies

commonName                      = Common Name (FQDN of your server)
commonName_default              =

emailAddress                    = Email Address
emailAddress_default            =

[ cert_type ]
nsCertType = server

Now we create the certificate like this:

openssl req -new -x509 -days 365 -nodes -config ./monit.cnf -out /var/certs/monit.pem -keyout /var/certs/monit.pem

openssl gendh 512 >> /var/certs/monit.pem

openssl x509 -subject -dates -fingerprint -noout -in /var/certs/monit.pem

chmod 700 /var/certs/monit.pem

Afterwards we edit /etc/default/monit to enable the monit daemon. Change startup to 1 and set CHECK_INTERVALS to the interval in seconds that you would like monit to check your system. I choose 60 (seconds) so my file looks like this:

vi /etc/default/monit

# Defaults for monit initscript
# sourced by /etc/init.d/monit
# installed at /etc/default/monit by maintainer scripts
# Fredrik Steen <>

# You must set this variable to for monit to start

# To change the intervals which monit should run uncomment
# and change this variable.

Finally, we can start monit:

/etc/init.d/monit start

Now point your browser to (make sure port 2812 isn't blocked by your firewall), log in with admin and test, and you should see the monit web interface. It should look like this:

(Main Screen)

(Apache Status Page)

Depending on your configuration in /etc/monit/monitrc monit will restart your services if they fail and send notification emails if process IDs of services change, etc.

Have fun!


Share this page:

Suggested articles

5 Comment(s)

Add comment



Monit was not starting for me, and I found the error by looking at:

 tail /var/log/syslog

 which said "monit: /etc/monit/monitrc:123: Error: syntax error '"monit/token"'

 and I realized that the token file was actually at "/web/monit/token" and after making that change to /etc/monit/monitrc monit started properly. 

Others may set their root web directory to be /web and will not experience this problem, but for those who don't this is a fix.


I have munin and monit installed on my ISPConfi Servers and also Prelude/Prewikka - follwoing the HowTos on this site. Now, Prewikka gives web access to Prelude, OSSEC and Snort, but Munin, ISPConfig and Monit are still separate websites. So I thought why not use the generated Munin Overview screen as a linkscreen to all the different programs for all my servers?

As the Munin screens are generated, it is not a question of adjusting simple html. You need to edit /etc/munin/templates/munin-overview.tmpl. You will see some pseudo HTML code with many variables, which are obviously replaced at generation time. We will need to make adjustments in the middle:

  <li><span class="domain"><a href="<TMPL_VAR NAME="DOMAIN">/index.html"><TMPL_VAR ESCAPE="HTML" NAME="DOMAIN"></a></span><TMPL_IF NAME="COMPARE"> :: [ <a href="<TMPL_VAR NAME="DOMAIN">/comparison-day.html">day</a> <a href="<TMPL_VAR NAME="DOMAIN">/comparison-week.html">week</a> <a href="<TMPL_VAR NAME="DOMAIN">/comparison-month.html">month</a> <a href="<TMPL_VAR NAME="DOMAIN">/comparison-year.html">year</a> ]</TMPL_IF>
        <li><span class="host"><a href="<TMPL_VAR NAME="DOMAIN">/<TMPL_VAR NAME="NODE">.html"><TMPL_VAR ESCAPE="HTML" NAME="NODE"></a></span> ::
        [ <TMPL_LOOP NAME="CATEGORIES"><a <TMPL_IF NAME="STATE_WARNING">class="warn"</TMPL_IF> <TMPL_IF NAME="STATE_CRITICAL">class="crit"</TMPL_IF> href="<TMPL_VAR NAME="DOMAIN">/<TMPL_VAR NAME="NODE">.html#<TMPL_VAR NAME="NAME">"><TMPL_VAR ESCAPE="HTML" NAME="NAME"></a> </TMPL_LOOP> <a target="_blank" href="https://<TMPL_VAR NAME="NODE">:2812/">Monit</a> <a target="_blank" href="https://<TMPL_VAR NAME="NODE">:81/">ISPConfig</a> ]</li>
        <li><span class="host"><a target="_blank" href="https://prelude.<TMPL_VAR NAME="DOMAIN">">Prewikka Console</a></li>

The code in bold will generate the link to Monit and ISPConfig respective. The code in bold and italic will generate the link to prewikka/prelude, but assumes you created a subdomain (or a co-domain in ISPConfig) of the name The '' is replaced at runtime with the real name - in my case a .net domain actually - not .com.

From: Eder Gobbi

But, if the process set "zombie", and do not runing? The pid are yet in the /var/run...

From: Anonymous coward

dont forget to run "monit -t" to verify monit.conf syntax.

From: enderst

how about instead of 'cat /dev/null > /etc/monit/monitrc'

use '>  /etc/monit/monitrc'