Monit

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is ample for monitoring a single host.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web dashboard. Monit serves plain HTTP on port 80. For production or shared access, terminate TLS in front of it with your own domain, using a reverse proxy or Azure Application Gateway.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Monit by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:monit-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name monit \
  --image sac1647283583153:monit-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name monit --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Monit runs as monit.service, with its web server on the loopback interface behind nginx on port 80. A one-shot monit-firstboot.service runs once on first boot to generate the per-instance password.

Confirm that all three units are active, that nginx listens on port 80, and that Monit's web server stays private on 127.0.0.1:2812:

sudo systemctl is-active nginx monit monit-firstboot
sudo ss -tlnp | grep -E ':80 |:2812 '

The output looks like this:

active active active LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",...)) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",...)) LISTEN 0 5 127.0.0.1:2812 0.0.0.0:* users:(("monit",...))

Monit's web server listens only on 127.0.0.1, so it is never reachable directly from the network. Every request goes through nginx on port 80.

Step 5 - Retrieve your per-instance credentials

The dashboard is protected by HTTP Basic authentication. The username is admin. The password is generated uniquely for this instance on first boot and stored in a root-only file. Read the file with:

sudo cat /root/monit-info.txt

The file shows the access URL, the username and the per-instance password:

monit_url=http://<vm-ip>/ monit_username=admin monit_password=<your-unique-password>

Keep this password safe. It is unique to this VM, and no default password ships in the image.

Step 6 - Confirm the dashboard is secure by default

The /healthz endpoint used by load balancer probes is intentionally open and returns 200. The dashboard itself requires credentials: an unauthenticated request returns 401, and a request with the per-instance credentials returns 200.

Replace <monit-password> with the password from /root/monit-info.txt, then run:

curl -s -o /dev/null -w 'no credentials: %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'health probe: %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'with password: %{http_code}\n' -u admin:<monit-password> http://127.0.0.1/

The output looks like this:

no credentials: 401 health probe: 200 with password: 200

Step 7 - Read the monitored services from the command line

Monit ships a command-line client that talks to the same daemon. Check the version and print the live summary of every monitored item and its status:

monit -V | head -1 sudo monit summary

The output lists the System entry, the nginx process and the root filesystem, all reporting OK:

This is Monit version 5.33.0 Monit 5.33.0 uptime: 5m Service Name Status Type monit OK System nginx OK Process rootfs OK Filesystem

The checks that populate this list are defined in /etc/monit/conf.d/. To add your own, drop extra check stanzas there and run sudo monit reload. See the Monit documentation for the full check syntax.

Step 8 - Open the web dashboard

In a browser, open http://<vm-public-ip>/ and sign in as admin with the per-instance password.

The Monit Service Manager page lists every monitored item, each with an at-a-glance OK status. These are the System entry with live load, CPU, memory and swap, the nginx process, and the root filesystem.

Select the System entry to open its detail page. It shows the load average, a full CPU breakdown, memory and swap usage, uptime and the alert thresholds configured for each metric, so you can see exactly when Monit raises an alert.

Select a monitored process, such as nginx, to see its process detail. This includes the pid file Monit tracks, the current pid, uptime, CPU and memory, and the start and stop programs Monit uses to heal the service automatically if it stops responding.

Select the root filesystem to see its detail: filesystem type and flags, total and free space, inode usage, and read and write rates. You can watch disk capacity alongside everything else.

Enable HTTPS for production

Monit serves plain HTTP on port 80 behind nginx. For production or shared access, put your own TLS certificate in front of it. Point a DNS record at the VM's public IP, then terminate TLS with Azure Application Gateway. Alternatively, extend the nginx configuration in /etc/nginx/sites-available/sac-monit with a certbot-issued certificate for your domain.

Once TLS is in place, restrict port 80 in the NSG to your Application Gateway or management network.

Support

Every SecureAnyCloud image includes 24/7 support, 365 days a year, by email and live chat, with a 24 hour response SLA. Contact sales@secureanycloud.com with the product name and your Azure region, and we will help.

Deploy on Azure

Launch Monit on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com