274 |
o A service was stopped |
o A service was stopped |
275 |
o A port connection failed |
o A port connection failed |
276 |
o A timestamp test didn't pass |
o A timestamp test didn't pass |
277 |
|
o A size test didn't pass |
278 |
o A service was started or restarted |
o A service was started or restarted |
279 |
o A resource statement match (see also the section RESOURCE |
o A resource statement match (see also the section RESOURCE |
280 |
TESTING below) |
TESTING below) |
293 |
alert foo@bar |
alert foo@bar |
294 |
|
|
295 |
will send a default email alert to the address foo@bar whenever a |
will send a default email alert to the address foo@bar whenever a |
296 |
timeout, start, restart, checksum, resource, stop, connection or |
timeout, start, restart, checksum, resource, stop, connection, size |
297 |
timestamp error occurs. |
or timestamp error occurs. |
298 |
|
|
299 |
If you only want an alert message sent when a certain event |
If you only want an alert message sent when a certain event |
300 |
occurs for example a timeout or when a service is restarted, |
occurs for example a timeout or when a service is restarted, |
334 |
checksum |
checksum |
335 |
resource |
resource |
336 |
timestamp |
timestamp |
337 |
|
size |
338 |
connection} |
connection} |
339 |
|
|
340 |
is equivalent to: |
is equivalent to: |
342 |
alert foo@bar |
alert foo@bar |
343 |
|
|
344 |
which as stated above, will send a message whenever a timeout, a |
which as stated above, will send a message whenever a timeout, a |
345 |
start, restart, checksum, resource, stop, connection or timestamp |
start, restart, checksum, resource, stop, connection, size or |
346 |
error occurs. (If the postfix variant is used, then note that |
timestamp error occurs. (If the postfix variant is used, then |
347 |
the parenthesis are I<mandatory>). |
note that the parenthesis are I<mandatory>). |
348 |
|
|
349 |
A start, stop or restart alert is also sent I<if monit fails to |
A start, stop or restart alert is also sent I<if monit fails to |
350 |
execute> a start or stop program for an entry. B<It is therefor |
execute> a start or stop program for an entry. B<It is therefore |
351 |
strongly advised> that at least one alert statement register |
strongly advised> that at least one alert statement register |
352 |
interest for either, start, stop or restart alerts. |
interest for either, start, stop or restart alerts. |
353 |
|
|
402 |
|
|
403 |
I<$EVENT> A string describing the event that occured. The values |
I<$EVENT> A string describing the event that occured. The values |
404 |
are fixed and are, "Started", "Stopped", "Restarted", Checksum |
are fixed and are, "Started", "Stopped", "Restarted", Checksum |
405 |
error", "Resource limit matched", "Timeout", and "Timestamp |
error", "Resource limit matched", "Timeout", "Size rule matched" |
406 |
error" |
and "Timestamp rule matched". |
407 |
|
|
408 |
I<$SERVICE> The service entry name in monitrc (old form |
I<$SERVICE> The service entry name in monitrc (old form |
409 |
I<$PROGRAM> is supported too but not recommended). |
I<$PROGRAM> is supported too but not recommended). |
691 |
if timestamp "/var/run/crappy_program.pid" > 7 days then restart |
if timestamp "/var/run/crappy_program.pid" > 7 days then restart |
692 |
|
|
693 |
|
|
694 |
|
=head1 SIZE TESTING |
695 |
|
|
696 |
|
Monit can watch the size of file targeted by file service type. |
697 |
|
The size statement comes in two flavors. The first and basic |
698 |
|
version is simply to test an existing file for size changes |
699 |
|
and if changed, execute an action. The second, and more compound, |
700 |
|
version is used to test a file for various size changes. |
701 |
|
|
702 |
|
The full syntax for the size statement is as follows |
703 |
|
(keywords are in capital and optional statements in [brackets]): |
704 |
|
|
705 |
|
=over 4 |
706 |
|
|
707 |
|
=item 1. if SIZE was CHANGED then action |
708 |
|
|
709 |
|
=item 2. if SIZE [operator] value [unit] then action |
710 |
|
|
711 |
|
=back |
712 |
|
|
713 |
|
I<operator> is a choice of "<",">","!=","==" in c notation, "GT", |
714 |
|
"LT", "EQ", "NE" in shell sh notation and "GREATER", "LESS", |
715 |
|
"EQUAL", "NOTEQUAL" in human readable form (if not specified, |
716 |
|
default is EQUAL). |
717 |
|
|
718 |
|
I<value> is a size watermark. |
719 |
|
|
720 |
|
I<unit> is a choice of "B","KB","MB","GB" or long alternatives |
721 |
|
"byte", "kilobyte", "megabyte", "gigabyte". If it is not specified, |
722 |
|
"byte" unit is assumed by default. |
723 |
|
|
724 |
|
I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC": |
725 |
|
|
726 |
|
=over 4 |
727 |
|
|
728 |
|
=item * |
729 |
|
|
730 |
|
ALERT sends the user a size alert. |
731 |
|
|
732 |
|
=item * |
733 |
|
|
734 |
|
RESTART restarts the service. |
735 |
|
|
736 |
|
=item * |
737 |
|
|
738 |
|
STOP stops the service. If monit stops a service it will |
739 |
|
not be checked by monit anymore nor restarted again later. You |
740 |
|
must explicit start it again from the web interface or from the |
741 |
|
console, like: 'monit start myfile' if you want the monit daemon |
742 |
|
to monitor the service again. |
743 |
|
|
744 |
|
=item * |
745 |
|
|
746 |
|
EXEC may be used to execute an arbitrary program. If you choose |
747 |
|
this action you must state the program to be executed. For |
748 |
|
instance; exec "/bin/rm -f /tmp/foobar" |
749 |
|
|
750 |
|
=back |
751 |
|
|
752 |
|
|
753 |
|
The basic size statement is useful for checking a file for |
754 |
|
changes and send alert or execute an action. Monit will remember |
755 |
|
the size of the file in the time of Monit start and it will compare |
756 |
|
it to the actual size during tests. It is possible to use it |
757 |
|
for example as one of security checks, like so: |
758 |
|
|
759 |
|
check file su with path /bin/su |
760 |
|
if size was changed then exec "/sbin/ifconfig eth0 down" |
761 |
|
|
762 |
|
which will "cut the cable" and stop the intruder from further system |
763 |
|
compromitation. |
764 |
|
|
765 |
|
Note that this test is just one of security jigsaw and if you want |
766 |
|
to have better security level, another tests like checksum, timestamp, |
767 |
|
etc. are recommended in addition. |
768 |
|
|
769 |
|
|
770 |
|
The second size version is useful for example for log files rotation |
771 |
|
if it reached given size or to check whether some file (for example |
772 |
|
database) isn't growing over suitable limits. |
773 |
|
|
774 |
|
To rotate log file: |
775 |
|
|
776 |
|
check file myapp_log with path /tmp/debug.log |
777 |
|
if size > 50 MB then exec "/usr/local/bin/rotate /tmp/debug.log myapp" |
778 |
|
|
779 |
|
where /usr/local/bin/rotate is simple script, such as: |
780 |
|
|
781 |
|
#/bin/bash |
782 |
|
/bin/mv $1 $1.`date +%y-%m-%d` |
783 |
|
/usr/bin/pkill -HUP $2 |
784 |
|
|
785 |
|
or to send alerts for example for growing file becoming performance |
786 |
|
bottleneck over given size because of database engine limits: |
787 |
|
|
788 |
|
check file mydb with path /data/mydatabase.db |
789 |
|
if size > 1 GB then alert |
790 |
|
|
791 |
|
More restrictive form of first example (size explicitly defined => |
792 |
|
system dependent): |
793 |
|
|
794 |
|
check file su with path /bin/su |
795 |
|
if size != 95564 then exec "/sbin/ifconfig eth0 down" |
796 |
|
|
797 |
|
|
798 |
=head1 CONNECTION TESTING |
=head1 CONNECTION TESTING |
799 |
|
|
800 |
Monit is able to perfom connection testing via networked ports |
Monit is able to perfom connection testing via networked ports |
1765 |
limit is absolute) and action (required). |
limit is absolute) and action (required). |
1766 |
perm(ission) Must be followed by an octal number describing |
perm(ission) Must be followed by an octal number describing |
1767 |
permissions. |
permissions. |
1768 |
|
size Must be followed by a compare operator, a |
1769 |
|
number, unit {B|KB|MB|GB|byte|kilobyte| |
1770 |
|
megabyte|gigabyte} and action. |
1771 |
depends (on) Must be followed by the name of a service this |
depends (on) Must be followed by the name of a service this |
1772 |
service depends on to run before it starts. |
service depends on to run before it starts. |
1773 |
|
|
1786 |
I<ssh>, I<dwp>, I<ldap2>, I<ldap3>, I<request>, I<cpu>, I<mem>, |
I<ssh>, I<dwp>, I<ldap2>, I<ldap3>, I<request>, I<cpu>, I<mem>, |
1787 |
I<totalmem>, I<children>, I<loadavg>, I<timestamp>, I<changed>, |
I<totalmem>, I<children>, I<loadavg>, I<timestamp>, I<changed>, |
1788 |
I<second(s)>, I<minute(s)>, I<hour(s)>, I<day(s)>, I<space>, |
I<second(s)>, I<minute(s)>, I<hour(s)>, I<day(s)>, I<space>, |
1789 |
I<inode>, I<perm>, I<process>, I<file>, I<directory> and |
I<inode>, I<perm>, I<process>, I<file>, I<directory>, I<device> |
1790 |
I<device> |
and I<size> |
1791 |
|
|
1792 |
And here is a complete list of B<noise keywords> ignored by |
And here is a complete list of B<noise keywords> ignored by |
1793 |
monit: |
monit: |