How to Monitor Your Kong API Gateway with Vigilmon

Kong is a popular open-source API gateway used to manage, secure, and observe API traffic. When Kong goes down or becomes degraded, all traffic to your upstream services fails — it is one of the most critical single points of failure in your stack.

This guide covers monitoring Kong API Gateway with Vigilmon.

Why Kong Monitoring Matters

Kong sits in front of all your APIs. A Kong failure is an everything failure:

• All API calls fail (or bypass security if Kong is bypassed)
• Rate limiting stops working
• Authentication plugins stop validating tokens
• Logging stops for all API traffic

Kong is designed to be highly available, but configuration errors, plugin failures, and infrastructure issues can still bring it down.

Kong's Built-in Health Endpoints

Kong exposes built-in health check endpoints:

Admin API health (port 8001 by default):

GET http://kong-admin:8001/

Returns Kong version, uptime, and configuration info. Use for internal monitoring only — do not expose this publicly.

Status endpoint (port 8100, if enabled):

GET http://kong-admin:8100/status

Returns detailed health information including memory usage and plugin status.

Proxy liveness: The proxy itself (port 8000/8443) should respond to valid API calls.

Setting Up External HTTP Monitoring

Since Kong proxies your APIs, the best external monitor is your API's actual endpoint through Kong:

1. In Vigilmon, create an HTTP monitor targeting a lightweight endpoint routed through Kong:
   • URL: https://api.yourapp.com/health (Kong-proxied endpoint)
   • Expected status: 200
   • Check interval: 1 minute
   • Multi-region: enabled

This tests the full stack — Kong proxy receiving the request, routing it to the upstream service, and returning the response. If Kong is down, this check fails.

Adding a Dedicated Kong Health Route

Create a Kong route that directly returns a health response (without hitting an upstream service). This isolates Kong health from upstream health:

# Create a health service that returns 200 OK
curl -X POST http://kong-admin:8001/services \\
  -d name=health-service \\
  -d url=http://localhost:8080/static-ok

# Route /kong-health to this service
curl -X POST http://kong-admin:8001/services/health-service/routes \\
  -d paths[]=/kong-health

Then monitor https://api.yourapp.com/kong-health in Vigilmon — a 200 response confirms Kong is routing traffic.

TCP Port Monitoring

Monitor Kong's key ports with Vigilmon TCP monitors:

• Port 8000: HTTP proxy (or your custom proxy port)
• Port 8443: HTTPS proxy
• Port 8001: Admin API (internal monitoring only)

Create TCP monitors in Vigilmon for your public-facing proxy ports (8000/8443).

Monitoring Kong's Upstreams

Kong's health checking for upstreams is built in — but it is internal. What Vigilmon adds is external confirmation:

1. Monitor the downstream services directly (not through Kong)
2. Compare with the through-Kong monitoring
3. If the direct service check passes but the Kong check fails, the issue is Kong-side

This split monitoring approach helps isolate whether failures are in Kong or in your upstream services.

Setting Up Alerts

In Vigilmon, configure Kong-specific alerts:

• Slack: #api-gateway channel for immediate notification
• PagerDuty: Page on-call for any Kong proxy failure (Kong down = all APIs down)
• Email: Platform team notification for sustained issues
• Status page: Show "API Gateway" as a component on your status page

Handling Kong Upgrades

Kong upgrades can cause brief downtime during rolling restarts. Configure Vigilmon to alert after 2 consecutive failures to avoid noise during planned maintenance:

1. Before upgrading, create a maintenance window in Vigilmon
2. This pauses alerts during the expected downtime
3. Reactivate normal alerting after the upgrade completes

Getting Started

Start monitoring your Kong gateway at vigilmon.online. No agent needed — Vigilmon checks your proxy endpoint from the outside, the same way your users and API clients do.