281 |
o A checksum error occurred (see also the section MD5 CHECKSUM |
o A checksum error occurred (see also the section MD5 CHECKSUM |
282 |
below) |
below) |
283 |
o A permission error occurred |
o A permission error occurred |
284 |
|
o A uid error occurred |
285 |
|
o A gid error occurred |
286 |
|
|
287 |
More than one alert statement can be used in a service entry. |
More than one alert statement can be used in a service entry. |
288 |
This means that you can send different emails to different |
This means that you can send different emails to different |
297 |
|
|
298 |
will send a default email alert to the address foo@bar whenever a |
will send a default email alert to the address foo@bar whenever a |
299 |
timeout, start, restart, checksum, resource, stop, connection, size, |
timeout, start, restart, checksum, resource, stop, connection, size, |
300 |
permission or timestamp error occurs. |
permission, uid, gid or timestamp error occurs. |
301 |
|
|
302 |
If you only want an alert message sent when a certain event |
If you only want an alert message sent when a certain event |
303 |
occurs for example a timeout or when a service is restarted, |
occurs for example a timeout or when a service is restarted, |
320 |
email addresses like: |
email addresses like: |
321 |
|
|
322 |
alert foo@bar { restart, timeout, resource, connection } |
alert foo@bar { restart, timeout, resource, connection } |
323 |
alert security@bar on { checksum, permission, stop } |
alert security@bar on { checksum, permission, uid, gid, stop } |
324 |
alert manager@bar |
alert manager@bar |
325 |
|
|
326 |
This will send an alert message to foo@bar whenever a restart, |
This will send an alert message to foo@bar whenever a restart, |
327 |
timeout, resource or connection error occurs and a message to |
timeout, resource or connection error occurs and a message to |
328 |
security@bar if a checksum, permission or stop error occurs. |
security@bar if a checksum, permission, uid, gid or stop error |
329 |
And finally, a message to manager@bar whenever any error event |
occurs. And finally, a message to manager@bar whenever any |
330 |
occurs. |
error event occurs. |
331 |
|
|
332 |
The following alert-statement: |
The following alert-statement: |
333 |
|
|
334 |
alert foo@bar {checksum |
alert foo@bar {checksum |
335 |
connection |
connection |
336 |
|
gid |
337 |
permission |
permission |
338 |
resource |
resource |
339 |
restart |
restart |
341 |
size |
size |
342 |
stop |
stop |
343 |
timeout |
timeout |
344 |
timestamp} |
timestamp |
345 |
|
uid} |
346 |
|
|
347 |
is equivalent to: |
is equivalent to: |
348 |
|
|
350 |
|
|
351 |
which as stated above, will send a message whenever a timeout, a |
which as stated above, will send a message whenever a timeout, a |
352 |
start, restart, checksum, resource, stop, connection, size, |
start, restart, checksum, resource, stop, connection, size, |
353 |
permission or timestamp error occurs. (If the postfix variant is |
permission, uid, gid or timestamp error occurs. (If the postfix |
354 |
used, then note that the parenthesis are I<mandatory>). |
variant is used, then note that the parenthesis are |
355 |
|
I<mandatory>). |
356 |
|
|
357 |
A start, stop or restart alert is also sent I<if monit fails to |
A start, stop or restart alert is also sent I<if monit fails to |
358 |
execute> a start or stop program for an entry. B<It is therefore |
execute> a start or stop program for an entry. B<It is therefore |
411 |
I<$EVENT> A string describing the event that occured. The values |
I<$EVENT> A string describing the event that occured. The values |
412 |
are fixed and are, "Started", "Stopped", "Restarted", Checksum |
are fixed and are, "Started", "Stopped", "Restarted", Checksum |
413 |
error", "Resource limit matched", "Timeout", "Size rule matched", |
error", "Resource limit matched", "Timeout", "Size rule matched", |
414 |
"Permission error" and "Timestamp rule matched". |
"Permission error", "Connection test failed", "UID error", "GID |
415 |
|
error" and "Timestamp rule matched". |
416 |
|
|
417 |
I<$SERVICE> The service entry name in monitrc (old form |
I<$SERVICE> The service entry name in monitrc (old form |
418 |
I<$PROGRAM> is supported too but not recommended). |
I<$PROGRAM> is supported too but not recommended). |
1147 |
|
|
1148 |
=over 4 |
=over 4 |
1149 |
|
|
1150 |
=item PERM(ISSION) octalnumber |
=item IF FAILED PERM(ISSION) octalnumber THEN action |
1151 |
|
|
1152 |
=back |
=back |
1153 |
|
|
1155 |
I<octalnumber> defines appropriate file, directory or device |
I<octalnumber> defines appropriate file, directory or device |
1156 |
permissions. |
permissions. |
1157 |
|
|
1158 |
In the case that permission test will fail, monit will call |
I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC": |
1159 |
stop method whenever defined if it is running in active |
|
1160 |
mode, send alert notification, log an alert message and |
=over 4 |
1161 |
not check the service anymore. |
|
1162 |
|
=item * |
1163 |
In the case that it is running in passive mode or stop |
|
1164 |
method is not defined, it will just send a failure alert. |
ALERT sends the user a permission alert. |
1165 |
The web interface will also show a permission warning. |
|
1166 |
|
=item * |
1167 |
|
|
1168 |
|
RESTART restarts the service. |
1169 |
|
|
1170 |
|
=item * |
1171 |
|
|
1172 |
|
STOP stops the service. If monit stops a service it will |
1173 |
|
not be checked by monit anymore nor restarted again later. You |
1174 |
|
must explicit start it again from the web interface or from the |
1175 |
|
console, like: 'monit start myfile' if you want the monit daemon |
1176 |
|
to monitor the service again. |
1177 |
|
|
1178 |
|
=item * |
1179 |
|
|
1180 |
|
EXEC may be used to execute an arbitrary program. If you choose |
1181 |
|
this action you must state the program to be executed. For |
1182 |
|
instance; exec "/sbin/ifconfig eth0 down" |
1183 |
|
|
1184 |
|
=back |
1185 |
|
|
1186 |
|
|
1187 |
|
The web interface will show a permission warning in the case that |
1188 |
|
it failed. |
1189 |
|
|
1190 |
|
We recommend to use STOP action in the permission statement. The |
1191 |
|
rationale for this feature is security and that monit does not |
1192 |
|
start a possible cracked program or script. Example: |
1193 |
|
|
1194 |
|
check file myfile with path "/path/to/myfile" |
1195 |
|
if failed permission 700 then stop |
1196 |
|
|
1197 |
|
It will just stop service monitoring. In the case that some other |
1198 |
|
service depends on myfile service, stop event will be send to it |
1199 |
|
as well. |
1200 |
|
|
1201 |
|
|
1202 |
|
|
1203 |
|
=head1 UID TESTING |
1204 |
|
|
1205 |
|
Monit can watch file, directory or device owner user id. |
1206 |
|
|
1207 |
|
Full syntax is: |
1208 |
|
|
1209 |
|
=over 4 |
1210 |
|
|
1211 |
|
=item IF FAILED UID user THEN action |
1212 |
|
|
1213 |
|
=back |
1214 |
|
|
1215 |
|
|
1216 |
|
I<user> defines appropriate file, directory or device |
1217 |
|
owner user id either in numeric or string form. |
1218 |
|
|
1219 |
|
I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC": |
1220 |
|
|
1221 |
|
=over 4 |
1222 |
|
|
1223 |
|
=item * |
1224 |
|
|
1225 |
|
ALERT sends the user a uid alert. |
1226 |
|
|
1227 |
|
=item * |
1228 |
|
|
1229 |
|
RESTART restarts the service. |
1230 |
|
|
1231 |
|
=item * |
1232 |
|
|
1233 |
|
STOP stops the service. If monit stops a service it will |
1234 |
|
not be checked by monit anymore nor restarted again later. You |
1235 |
|
must explicit start it again from the web interface or from the |
1236 |
|
console, like: 'monit start myfile' if you want the monit daemon |
1237 |
|
to monitor the service again. |
1238 |
|
|
1239 |
|
=item * |
1240 |
|
|
1241 |
|
EXEC may be used to execute an arbitrary program. If you choose |
1242 |
|
this action you must state the program to be executed. For |
1243 |
|
instance; exec "/sbin/ifconfig eth0 down" |
1244 |
|
|
1245 |
|
=back |
1246 |
|
|
1247 |
|
|
1248 |
|
The web interface will show a uid warning in the case that it |
1249 |
|
failed. |
1250 |
|
|
1251 |
|
We recommend to use STOP action in the uid statement. The |
1252 |
|
rationale for this feature is security and that monit does not |
1253 |
|
start a possible cracked program or script. Example: |
1254 |
|
|
1255 |
|
check file myfile with path "/path/to/myfile" |
1256 |
|
if failed uid root then stop |
1257 |
|
|
1258 |
|
It will just stop service monitoring. In the case that some other |
1259 |
|
service depends on myfile service, stop event will be send to it |
1260 |
|
as well. |
1261 |
|
|
1262 |
The rationale for this feature is security and that monit does |
|
1263 |
not start a possible cracked program or script. |
|
1264 |
|
=head1 GID TESTING |
1265 |
|
|
1266 |
|
Monit can watch file, directory or device owner group id. |
1267 |
|
|
1268 |
|
Full syntax is: |
1269 |
|
|
1270 |
|
=over 4 |
1271 |
|
|
1272 |
|
=item IF FAILED GID user THEN action |
1273 |
|
|
1274 |
|
=back |
1275 |
|
|
1276 |
|
|
1277 |
|
I<user> defines appropriate file, directory or device |
1278 |
|
owner group id either in numeric or string form. |
1279 |
|
|
1280 |
|
I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC": |
1281 |
|
|
1282 |
|
=over 4 |
1283 |
|
|
1284 |
|
=item * |
1285 |
|
|
1286 |
|
ALERT sends the user a gid alert. |
1287 |
|
|
1288 |
|
=item * |
1289 |
|
|
1290 |
|
RESTART restarts the service. |
1291 |
|
|
1292 |
|
=item * |
1293 |
|
|
1294 |
|
STOP stops the service. If monit stops a service it will |
1295 |
|
not be checked by monit anymore nor restarted again later. You |
1296 |
|
must explicit start it again from the web interface or from the |
1297 |
|
console, like: 'monit start myfile' if you want the monit daemon |
1298 |
|
to monitor the service again. |
1299 |
|
|
1300 |
|
=item * |
1301 |
|
|
1302 |
|
EXEC may be used to execute an arbitrary program. If you choose |
1303 |
|
this action you must state the program to be executed. For |
1304 |
|
instance; exec "/sbin/ifconfig eth0 down" |
1305 |
|
|
1306 |
|
=back |
1307 |
|
|
1308 |
|
|
1309 |
|
The web interface will show a gid warning in the case that it |
1310 |
|
failed. |
1311 |
|
|
1312 |
|
We recommend to use STOP action in the uid statement. The |
1313 |
|
rationale for this feature is security and that monit does not |
1314 |
|
start a possible cracked program or script. Example: |
1315 |
|
|
1316 |
|
check file myfile with path "/path/to/myfile" |
1317 |
|
if failed gid root then stop |
1318 |
|
|
1319 |
|
It will just stop service monitoring. In the case that some other |
1320 |
|
service depends on myfile service, stop event will be send to it |
1321 |
|
as well. |
1322 |
|
|
1323 |
|
|
1324 |
|
|
1516 |
checksum for a file. The checksum is used to verify that a |
checksum for a file. The checksum is used to verify that a |
1517 |
file does not change. |
file does not change. |
1518 |
|
|
|
If a file was changed, monit will send an (optional) alert |
|
|
notification, log an alert message, stop the service and not |
|
|
check it anymore. The web interface will also show a checksum |
|
|
warning. |
|
|
|
|
|
In the case that it is running in passive mode or stop |
|
|
method is not defined, it will just send a failure alert. |
|
|
The web interface will also show a permission warning. |
|
|
|
|
|
The rationale for this feature is security and that monit does |
|
|
not start a possible cracked program or script. |
|
|
|
|
1519 |
Checksum statement is supported only by file monitoring service |
Checksum statement is supported only by file monitoring service |
1520 |
check type, e.g. defined under for example: |
check type, e.g. defined under for example: |
1521 |
|
|
1524 |
Other monitoring service types (such as process, directory or device) |
Other monitoring service types (such as process, directory or device) |
1525 |
are not supported. |
are not supported. |
1526 |
|
|
1527 |
The full syntax for the checksum-statement is as follows: |
The full syntax for the checksum statement is as follows: |
1528 |
(keywords are in capital) |
(keywords are in capital) |
1529 |
|
|
1530 |
=over 4 |
=over 4 |
1531 |
|
|
1532 |
=item CHECKSUM [EXPECT checksum]+ |
=item IF FAILED CHECKSUM [EXPECT checksum] THEN action |
1533 |
|
|
1534 |
=back |
=back |
1535 |
|
|
1536 |
The shorthand version is just: |
I<expect> statement is optional and used to specify a md5 |
|
|
|
|
checksum |
|
|
|
|
|
The I<expect> statement is optional and used to specify a md5 |
|
1537 |
string monit should expect when testing a file's checksum. If |
string monit should expect when testing a file's checksum. If |
1538 |
this statement is used monit will not compute an initial checksum |
this statement is used monit will not compute an initial checksum |
1539 |
for the file, as in the examples above, but instead use the |
for the file, as in the examples above, but instead use the |
1540 |
string you submit. For example: |
string you submit. For example: |
1541 |
|
|
1542 |
checksum and expect 8f7f419955cefa0b33a2ba316cba3659 |
if failed checksum and expect 8f7f419955cefa0b33a2ba316cba3659 |
1543 |
|
then stop |
1544 |
|
|
1545 |
or verbose style; |
or verbose style; |
1546 |
|
|
1547 |
checksum and expect the sum 4e5309d1956f003bcdff168748bea647 |
if failed checksum and expect |
1548 |
|
the sum 4e5309d1956f003bcdff168748bea647 then alert |
1549 |
|
|
1550 |
|
I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC": |
1551 |
|
|
1552 |
|
=over 4 |
1553 |
|
|
1554 |
|
=item * |
1555 |
|
|
1556 |
|
ALERT sends the user a checksum alert. |
1557 |
|
|
1558 |
|
=item * |
1559 |
|
|
1560 |
|
RESTART restarts the service. |
1561 |
|
|
1562 |
|
=item * |
1563 |
|
|
1564 |
|
STOP stops the service. If monit stops a service it will |
1565 |
|
not be checked by monit anymore nor restarted again later. You |
1566 |
|
must explicit start it again from the web interface or from the |
1567 |
|
console, like: 'monit start myfile' if you want the monit daemon |
1568 |
|
to monitor the service again. |
1569 |
|
|
1570 |
|
=item * |
1571 |
|
|
1572 |
|
EXEC may be used to execute an arbitrary program. If you choose |
1573 |
|
this action you must state the program to be executed. For |
1574 |
|
instance; exec "/sbin/ifconfig eth0 down" |
1575 |
|
|
1576 |
|
=back |
1577 |
|
|
1578 |
|
The web interface will show a checksum warning in the case |
1579 |
|
that it changed. |
1580 |
|
|
1581 |
|
We recommend to use STOP action in the checksum statement. The |
1582 |
|
rationale for this feature is security and that monit does not |
1583 |
|
start a possible cracked program or script. |
1584 |
|
|
1585 |
You can, for example, use the GNU utility I<md5sum> to create a |
You can, for example, use the GNU utility I<md5sum> to create a |
1586 |
checksum string for a file and then use this string in the |
checksum string for a file and then use this string in the |
1771 |
inode |
inode |
1772 |
space |
space |
1773 |
permission |
permission |
1774 |
|
uid |
1775 |
|
gid |
1776 |
|
|
1777 |
check directory service2 with path /mydir |
check directory service2 with path /mydir |
1778 |
start |
start |
1785 |
depend |
depend |
1786 |
timestamp |
timestamp |
1787 |
permission |
permission |
1788 |
|
uid |
1789 |
|
gid |
1790 |
|
|
1791 |
check file service3 with path /mydir/myfile |
check file service3 with path /mydir/myfile |
1792 |
start |
start |
1800 |
checksum |
checksum |
1801 |
timestamp |
timestamp |
1802 |
permission |
permission |
1803 |
|
uid |
1804 |
|
gid |
1805 |
|
|
1806 |
check [process] service4 with {pidfile|path} /var/run/myproc.pid |
check [process] service4 with {pidfile|path} /var/run/myproc.pid |
1807 |
start |
start |
1896 |
stop The program for stopping the specified |
stop The program for stopping the specified |
1897 |
service. Full path is required. This |
service. Full path is required. This |
1898 |
statement is optional. |
statement is optional. |
1899 |
uid and gid Optional part of a start, stop or exec |
uid and gid Either optional part of a start, stop or exec |
1900 |
statement. May be used to specify a user id and |
statement (then it may be used to specify a user |
1901 |
a group id the program should be started as. The |
id and a group id the program should be started |
1902 |
uid and gid may be specified as a name or as a |
as) or standalone statement of file service |
1903 |
number. This extension may only be used if the |
check. The uid and gid may be specified as a |
1904 |
super-user is running monit. |
name or as a number. The first form of this |
1905 |
|
extension may only be used if the super-user |
1906 |
|
is running monit. |
1907 |
host The hostname or IP address to test the port |
host The hostname or IP address to test the port |
1908 |
at. This keyword can only be used together |
at. This keyword can only be used together |
1909 |
with a port statement. |
with a port statement. |
1952 |
This statement is optional |
This statement is optional |
1953 |
alert Specifies an email address for notification |
alert Specifies an email address for notification |
1954 |
if timeout, start, restart, checksum, resource, |
if timeout, start, restart, checksum, resource, |
1955 |
stop, connection, size, permission or timestamp |
stop, connection, size, permission, uid, gid or |
1956 |
occurs. Alert can also be postfixed, to only |
timestamp occurs. Alert can also be postfixed, |
1957 |
send a message for certain events. See the |
to only send a message for certain events. See |
1958 |
examples above. More than one alert statement |
the examples above. More than one alert |
1959 |
is allowed in an entry. This statement is also |
statement is allowed in an entry. This statement |
1960 |
optional. |
is also optional. |
1961 |
restart, These keywords may be used as actions for |
restart, These keywords may be used as actions for |
1962 |
stop and exec various test statements. The exec statement is |
stop and exec various test statements. The exec statement is |
1963 |
special in that it requires a following string |
special in that it requires a following string |
2049 |
I<ftp>, I<smtp>, I<pop>, I<nntp>, I<imap>, I<ssh>, I<dwp>, |
I<ftp>, I<smtp>, I<pop>, I<nntp>, I<imap>, I<ssh>, I<dwp>, |
2050 |
I<ldap2>, I<ldap3>, I<request>, I<cpu>, I<mem>, I<totalmem>, |
I<ldap2>, I<ldap3>, I<request>, I<cpu>, I<mem>, I<totalmem>, |
2051 |
I<children>, I<loadavg>, I<timestamp>, I<changed>, I<second(s)>, |
I<children>, I<loadavg>, I<timestamp>, I<changed>, I<second(s)>, |
2052 |
I<minute(s)>, I<hour(s)>, I<day(s)>, I<space>, I<inode>, I<perm>, |
I<minute(s)>, I<hour(s)>, I<day(s)>, I<space>, I<inode>, |
2053 |
I<process>, I<file>, I<directory>, I<device> and I<size>, |
I<perm(ission)>, I<process>, I<file>, I<directory>, I<device>, |
2054 |
I<failed> |
I<size> and I<failed> |
2055 |
|
|
2056 |
And here is a complete list of B<noise keywords> ignored by |
And here is a complete list of B<noise keywords> ignored by |
2057 |
monit: |
monit: |
2161 |
depends on apache_bin |
depends on apache_bin |
2162 |
|
|
2163 |
check file apache_bin with path /usr/local/apache/bin/httpd |
check file apache_bin with path /usr/local/apache/bin/httpd |
2164 |
checksum |
if failed checksum then stop |
2165 |
|
|
2166 |
Some servers are slow starters, like for example Java based |
Some servers are slow starters, like for example Java based |
2167 |
Application Servers. So if we want to keep the poll-cycle low |
Application Servers. So if we want to keep the poll-cycle low |
2236 |
group apache |
group apache |
2237 |
|
|
2238 |
check file httpd_bin with path /usr/local/apache/bin/httpd |
check file httpd_bin with path /usr/local/apache/bin/httpd |
2239 |
checksum and expect 8f7f419955cefa0b33a2ba316cba3659 |
if failed checksum and expect 8f7f419955cefa0b33a2ba316cba3659 |
2240 |
permission 755 |
then alert |
2241 |
|
if failed permission 755 then alert |
2242 |
|
if failed uid root then alert |
2243 |
|
if failed gid root then alert |
2244 |
if size changed then alert |
if size changed then alert |
2245 |
if timestamp changed then alert |
if timestamp changed then alert |
2246 |
alert security@bar on {checksum, size, timestamp, permission} |
alert security@bar on {checksum, size, timestamp, permission, |
2247 |
with mail-format {subject: Alaaarrm! on $HOST} |
uid, gid} with mail-format {subject: Alaaarrm! on $HOST} |
2248 |
group apache |
group apache |
2249 |
|
|
2250 |
|
|
2345 |
|
|
2346 |
check file httpd_bin with path /usr/local/apache/bin/httpd |
check file httpd_bin with path /usr/local/apache/bin/httpd |
2347 |
group server |
group server |
2348 |
checksum and expect the sum 8f7f419955cefa0b33a2ba316cba3659 |
if failed checksum and expect the sum |
2349 |
permission 755 |
8f7f419955cefa0b33a2ba316cba3659 the alert |
2350 |
|
if failed permission 755 then alert |
2351 |
|
if failed uid root then alert |
2352 |
|
if failed gid root then alert |
2353 |
if size changed then alert |
if size changed then alert |
2354 |
if timestamp changed then alert |
if timestamp changed then alert |
2355 |
every 2 cycles |
every 2 cycles |
2356 |
alert bofh@bar with mail-format {from: monit@foo.bar.no} |
alert bofh@bar with mail-format {from: monit@foo.bar.no} |
2357 |
alert foo@bar on { checksum, size, timestamp } |
alert foo@bar on { checksum, size, timestamp, uid, gid } |
2358 |
depends on datafs |
depends on datafs |
2359 |
|
|
2360 |
check device datafs with path /dev/sdb1 |
check device datafs with path /dev/sdb1 |
2361 |
group server |
group server |
2362 |
start program = "/bin/mount /data" |
start program = "/bin/mount /data" |
2363 |
stop program = "/bin/umount /data" |
stop program = "/bin/umount /data" |
2364 |
permission 660 |
if failed permission 660 then stop |
2365 |
if space usage > 80 % then alert |
if space usage > 80 % then alert |
2366 |
if space usage > 94 % then stop |
if space usage > 94 % then stop |
2367 |
if inode usage > 80 % then alert |
if inode usage > 80 % then alert |