Docker Swarm never died, it just got quiet. Plenty of small teams run it because it does one thing well: services on a few nodes, without the Kubernetes tax. Monitoring it is a different problem though, because "the container is running" and "the service is healthy" drift apart quickly.
The layers that can fail independently
Nodes. A worker going silent is the obvious case. Sneakier is a node marked drain that still runs tasks, or a manager losing quorum because two of three managers went down and nobody noticed the first.
Services. Swarm's job is keeping N replicas running. When replicas cannot converge, the service object exists but the workload does not. This is the failure nobody watches for: docker service ls shows 0/3 replicas and the monitoring saw nothing because every container that ran before looked fine.
Tasks. Individual containers get rescheduled constantly. That is normal. A service flapping between nodes every minute is not, and it usually means a health check failing or a node resource limit biting.
The application. Behind all of it, the service still has to answer requests. A replica can be Running and returning 500s.
What to monitor
Node reachability and resource pressure come from an agent on each host: CPU, memory, disk, and Docker's own health. Disk pressure deserves special attention on Swarm nodes because image layers and container logs grow silently until the node starts evicting.
Service replica convergence belongs in a dedicated check: does the service have its desired replica count, and has it stayed there? Replica churn is a leading indicator for almost every real incident on Swarm.
The endpoints behind it all are standard HTTP or TCP monitors from outside the cluster, on the published ports users actually hit. Check through the ingress routing mesh and, if you can, check the real service path rather than a health endpoint designed to always return 200.
Watch quorum, seriously
A Swarm with three managers tolerates one failure. Monitoring that only alerts when everything is already down misses the degraded state where one more restart kills the cluster. Alert when a manager drops, not when quorum is already lost.
Keep it boring
Swarm's selling point is that it stays out of the way. Monitoring should match: agent on each node, one service-convergence check per critical service, external probes on the real ports, alerts routed to where someone reads them. No sidecars, no service mesh, no dashboard you never open.