Nginx monitoring for Kubernetes and Docker

Requests, 5xx and latency per upstream with nothing to set up, error bursts during a rollout and expiring ingress certificates, explained in plain words.

Nginx, OpenResty and ingress-nginx

Get started free →See it in the live demo
Read the Nginx docs →
The Nginx page in WatchLog for ingress-nginx: requests per second, 5xx, p95 latency and ready upstreams, with requests by status class and response times

Everything on one page, in four tabs

  • OverviewRequests per second, the 5xx share, p50 and p95, connections, ready upstreams and the busiest upstreams.
  • Errors5xx by upstream, the status codes of the last hour, and error bursts marked "during rollout".
  • LatencyThe request duration histogram, and the slowest upstreams by p95.
  • ConnectionsWaiting, reading and writing connections; accepted and dropped connections per second.

Problems it explains

  • The 5xx share, with the upstream that sends most of them and when it was last rolled out
  • An upstream with no ready endpoint
  • A high p95
  • Dropped connections (worker_connections reached)
  • A certificate that expires within 14 days (ingress-nginx)
  • What to turn on when stub_status or ingress-nginx metrics are off

Alerts on from day one

  • More than 5 % of requests answer 5xx for 5 minutes
  • p95 above 1 s for 5 minutes
  • An upstream without a healthy endpoint
  • A certificate expires within 14 days (ingress-nginx)
  • The service unreachable, or slow to connect

To Slack, Telegram, email or a webhook. You choose which start on when you connect, and change any of them in the rule editor.

Nothing to set up

The node agents see each plain-HTTP request and response with eBPF: the method and the status line, never a path, header or body. HTTPS is never decrypted, so a server that only speaks TLS shows its connections. Two optional extras add more:

Every option in the docs →
Platform
# ingress-nginx: its own metrics, if they're off
helm upgrade <release> ingress-nginx/ingress-nginx -n <namespace> --reuse-values \
  --set controller.metrics.enabled=true
# Plain Nginx in a pod: the stub_status block in the Docker tab
# Plain Nginx: connections from stub_status (add, then reload)
server {
    listen 8080;
    location = /stub_status {
        stub_status;
        allow 10.0.0.0/8;
        allow 172.16.0.0/12;
        allow 192.168.0.0/16;
        allow 127.0.0.1;
        deny all;
    }
}

Docker hosts also run the integrations collector: the service page gives its docker run command. On Kubernetes the chart already runs it.

Ask your AI about Nginx

Claude and ChatGPT read the same facts through WatchLog's MCP server, read-only: the service's health, every reason, and the workloads or containers that connect to it.

Connect your assistant →

Why are users getting 502s?

get_application · get_recent_changes

6 % of requests through ingress-nginx answer 5xx, almost all from shop/frontend, rolled out 4 minutes ago. None of its pods is ready yet.

An example on Kubernetes, written from the docs.

Other applications