/[monit]/monit/monit.pod
ViewVC logotype

Diff of /monit/monit.pod

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.90 by hauk, Thu Aug 7 09:32:13 2003 UTC revision 1.91 by martinp, Tue Aug 12 19:40:05 2003 UTC
# Line 281  monit will raise an email alert if: Line 281  monit will raise an email alert if:
281   o A checksum error occurred (see also the section MD5 CHECKSUM   o A checksum error occurred (see also the section MD5 CHECKSUM
282     below)     below)
283   o A permission error occurred   o A permission error occurred
284     o A uid error occurred
285     o A gid error occurred
286    
287  More than one alert statement can be used in a service entry.  More than one alert statement can be used in a service entry.
288  This means that you can send different emails to different  This means that you can send different emails to different
# Line 295  Simply using: Line 297  Simply using:
297    
298  will send a default email alert to the address foo@bar whenever a  will send a default email alert to the address foo@bar whenever a
299  timeout, start, restart, checksum, resource, stop, connection, size,  timeout, start, restart, checksum, resource, stop, connection, size,
300  permission or timestamp error occurs.  permission, uid, gid or timestamp error occurs.
301    
302  If you only want an alert message sent when a certain event  If you only want an alert message sent when a certain event
303  occurs for example a timeout or when a service is restarted,  occurs for example a timeout or when a service is restarted,
# Line 318  It is also possible to combine events an Line 320  It is also possible to combine events an
320  email addresses like:  email addresses like:
321    
322   alert foo@bar { restart, timeout, resource, connection }   alert foo@bar { restart, timeout, resource, connection }
323   alert security@bar on { checksum, permission, stop }   alert security@bar on { checksum, permission, uid, gid, stop }
324   alert manager@bar   alert manager@bar
325    
326  This will send an alert message to foo@bar whenever a restart,  This will send an alert message to foo@bar whenever a restart,
327  timeout, resource or connection error occurs and a message to  timeout, resource or connection error occurs and a message to
328  security@bar if a checksum, permission or stop error occurs.  security@bar if a checksum, permission, uid, gid or stop error
329  And finally, a message to manager@bar whenever any error event  occurs.  And finally, a message to manager@bar whenever any
330  occurs.  error event occurs.
331    
332  The following alert-statement:  The following alert-statement:
333    
334   alert foo@bar {checksum   alert foo@bar {checksum
335                  connection                  connection
336                    gid
337                  permission                  permission
338                  resource                  resource
339                  restart                  restart
# Line 338  The following alert-statement: Line 341  The following alert-statement:
341                  size                  size
342                  stop                  stop
343                  timeout                  timeout
344                  timestamp}                  timestamp
345                    uid}
346    
347  is equivalent to:  is equivalent to:
348    
# Line 346  is equivalent to: Line 350  is equivalent to:
350    
351  which as stated above, will send a message whenever a timeout, a  which as stated above, will send a message whenever a timeout, a
352  start, restart, checksum, resource, stop, connection, size,  start, restart, checksum, resource, stop, connection, size,
353  permission or timestamp error occurs. (If the postfix variant is  permission, uid, gid or timestamp error occurs. (If the postfix
354  used, then note that the parenthesis are I<mandatory>).  variant is used, then note that the parenthesis are
355    I<mandatory>).
356    
357  A start, stop or restart alert is also sent I<if monit fails to  A start, stop or restart alert is also sent I<if monit fails to
358  execute> a start or stop program for an entry. B<It is therefore  execute> a start or stop program for an entry. B<It is therefore
# Line 406  text with a special value: Line 411  text with a special value:
411  I<$EVENT> A string describing the event that occured. The values  I<$EVENT> A string describing the event that occured. The values
412  are fixed and are, "Started", "Stopped", "Restarted", Checksum  are fixed and are, "Started", "Stopped", "Restarted", Checksum
413  error", "Resource limit matched", "Timeout", "Size rule matched",  error", "Resource limit matched", "Timeout", "Size rule matched",
414  "Permission error" and "Timestamp rule matched".  "Permission error", "Connection test failed", "UID error", "GID
415    error" and "Timestamp rule matched".
416    
417  I<$SERVICE> The service entry name in monitrc (old form  I<$SERVICE> The service entry name in monitrc (old form
418  I<$PROGRAM> is supported too but not recommended).  I<$PROGRAM> is supported too but not recommended).
# Line 1141  Full syntax is: Line 1147  Full syntax is:
1147    
1148  =over 4  =over 4
1149    
1150  =item PERM(ISSION) octalnumber  =item IF FAILED PERM(ISSION) octalnumber THEN action
1151    
1152  =back  =back
1153    
# Line 1149  Full syntax is: Line 1155  Full syntax is:
1155  I<octalnumber> defines appropriate file, directory or device  I<octalnumber> defines appropriate file, directory or device
1156  permissions.  permissions.
1157    
1158  In the case that permission test will fail, monit will call  I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC":
1159  stop method whenever defined if it is running in active  
1160  mode, send alert notification, log an alert message and  =over 4
1161  not check the service anymore.  
1162    =item *
1163  In the case that it is running in passive mode or stop  
1164  method is not defined, it will just send a failure alert.  ALERT sends the user a permission alert.
1165  The web interface will also show a permission warning.  
1166    =item *
1167    
1168    RESTART restarts the service.
1169    
1170    =item *
1171    
1172    STOP stops the service. If monit stops a service it will
1173    not be checked by monit anymore nor restarted again later. You
1174    must explicit start it again from the web interface or from the
1175    console, like: 'monit start myfile' if you want the monit daemon
1176    to monitor the service again.
1177    
1178    =item *
1179    
1180    EXEC may be used to execute an arbitrary program. If you choose
1181    this action you must state the program to be executed. For
1182    instance; exec "/sbin/ifconfig eth0 down"
1183    
1184    =back
1185    
1186    
1187    The web interface will show a permission warning in the case that
1188    it failed.
1189    
1190    We recommend to use STOP action in the permission statement. The
1191    rationale for this feature is security and that monit does not
1192    start a possible cracked program or script. Example:
1193    
1194     check file myfile with path "/path/to/myfile"
1195       if failed permission 700 then stop
1196    
1197    It will just stop service monitoring. In the case that some other
1198    service depends on myfile service, stop event will be send to it
1199    as well.
1200    
1201    
1202    
1203    =head1 UID TESTING
1204    
1205    Monit can watch file, directory or device owner user id.
1206    
1207    Full syntax is:
1208    
1209    =over 4
1210    
1211    =item IF FAILED UID user THEN action
1212    
1213    =back
1214    
1215    
1216    I<user> defines appropriate file, directory or device
1217    owner user id either in numeric or string form.
1218    
1219    I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC":
1220    
1221    =over 4
1222    
1223    =item *
1224    
1225    ALERT sends the user a uid alert.
1226    
1227    =item *
1228    
1229    RESTART restarts the service.
1230    
1231    =item *
1232    
1233    STOP stops the service. If monit stops a service it will
1234    not be checked by monit anymore nor restarted again later. You
1235    must explicit start it again from the web interface or from the
1236    console, like: 'monit start myfile' if you want the monit daemon
1237    to monitor the service again.
1238    
1239    =item *
1240    
1241    EXEC may be used to execute an arbitrary program. If you choose
1242    this action you must state the program to be executed. For
1243    instance; exec "/sbin/ifconfig eth0 down"
1244    
1245    =back
1246    
1247    
1248    The web interface will show a uid warning in the case that it
1249    failed.
1250    
1251    We recommend to use STOP action in the uid statement. The
1252    rationale for this feature is security and that monit does not
1253    start a possible cracked program or script. Example:
1254    
1255     check file myfile with path "/path/to/myfile"
1256       if failed uid root then stop
1257    
1258    It will just stop service monitoring. In the case that some other
1259    service depends on myfile service, stop event will be send to it
1260    as well.
1261    
1262  The rationale for this feature is security and that monit does  
1263  not start a possible cracked program or script.  
1264    =head1 GID TESTING
1265    
1266    Monit can watch file, directory or device owner group id.
1267    
1268    Full syntax is:
1269    
1270    =over 4
1271    
1272    =item IF FAILED GID user THEN action
1273    
1274    =back
1275    
1276    
1277    I<user> defines appropriate file, directory or device
1278    owner group id either in numeric or string form.
1279    
1280    I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC":
1281    
1282    =over 4
1283    
1284    =item *
1285    
1286    ALERT sends the user a gid alert.
1287    
1288    =item *
1289    
1290    RESTART restarts the service.
1291    
1292    =item *
1293    
1294    STOP stops the service. If monit stops a service it will
1295    not be checked by monit anymore nor restarted again later. You
1296    must explicit start it again from the web interface or from the
1297    console, like: 'monit start myfile' if you want the monit daemon
1298    to monitor the service again.
1299    
1300    =item *
1301    
1302    EXEC may be used to execute an arbitrary program. If you choose
1303    this action you must state the program to be executed. For
1304    instance; exec "/sbin/ifconfig eth0 down"
1305    
1306    =back
1307    
1308    
1309    The web interface will show a gid warning in the case that it
1310    failed.
1311    
1312    We recommend to use STOP action in the uid statement. The
1313    rationale for this feature is security and that monit does not
1314    start a possible cracked program or script. Example:
1315    
1316     check file myfile with path "/path/to/myfile"
1317       if failed gid root then stop
1318    
1319    It will just stop service monitoring. In the case that some other
1320    service depends on myfile service, stop event will be send to it
1321    as well.
1322    
1323    
1324    
# Line 1357  If specified in the control file, monit Line 1516  If specified in the control file, monit
1516  checksum for a file. The checksum is used to verify that a  checksum for a file. The checksum is used to verify that a
1517  file does not change.  file does not change.
1518    
 If a file was changed, monit will send an (optional) alert  
 notification, log an alert message, stop the service and not  
 check it anymore. The web interface will also show a checksum  
 warning.  
   
 In the case that it is running in passive mode or stop  
 method is not defined, it will just send a failure alert.  
 The web interface will also show a permission warning.  
   
 The rationale for this feature is security and that monit does  
 not start a possible cracked program or script.  
   
1519  Checksum statement is supported only by file monitoring service  Checksum statement is supported only by file monitoring service
1520  check type, e.g. defined under for example:  check type, e.g. defined under for example:
1521    
# Line 1377  check type, e.g. defined under for examp Line 1524  check type, e.g. defined under for examp
1524  Other monitoring service types (such as process, directory or device)  Other monitoring service types (such as process, directory or device)
1525  are not supported.  are not supported.
1526    
1527  The full syntax for the checksum-statement is as follows:  The full syntax for the checksum statement is as follows:
1528  (keywords are in capital)  (keywords are in capital)
1529    
1530  =over 4  =over 4
1531    
1532  =item CHECKSUM [EXPECT checksum]+  =item IF FAILED CHECKSUM [EXPECT checksum] THEN action
1533    
1534  =back  =back
1535    
1536  The shorthand version is just:  I<expect> statement is optional and used to specify a md5
   
  checksum  
   
 The I<expect> statement is optional and used to specify a md5  
1537  string monit should expect when testing a file's checksum. If  string monit should expect when testing a file's checksum. If
1538  this statement is used monit will not compute an initial checksum  this statement is used monit will not compute an initial checksum
1539  for the file, as in the examples above, but instead use the  for the file, as in the examples above, but instead use the
1540  string you submit. For example:  string you submit. For example:
1541    
1542   checksum and expect 8f7f419955cefa0b33a2ba316cba3659   if failed checksum and expect 8f7f419955cefa0b33a2ba316cba3659
1543        then stop
1544    
1545  or verbose style;  or verbose style;
1546    
1547   checksum and expect the sum 4e5309d1956f003bcdff168748bea647   if failed checksum and expect
1548        the sum 4e5309d1956f003bcdff168748bea647 then alert
1549    
1550    I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC":
1551    
1552    =over 4
1553    
1554    =item *
1555    
1556    ALERT sends the user a checksum alert.
1557    
1558    =item *
1559    
1560    RESTART restarts the service.
1561    
1562    =item *
1563    
1564    STOP stops the service. If monit stops a service it will
1565    not be checked by monit anymore nor restarted again later. You
1566    must explicit start it again from the web interface or from the
1567    console, like: 'monit start myfile' if you want the monit daemon
1568    to monitor the service again.
1569    
1570    =item *
1571    
1572    EXEC may be used to execute an arbitrary program. If you choose
1573    this action you must state the program to be executed. For
1574    instance; exec "/sbin/ifconfig eth0 down"
1575    
1576    =back
1577    
1578    The web interface will show a checksum warning in the case
1579    that it changed.
1580    
1581    We recommend to use STOP action in the checksum statement. The
1582    rationale for this feature is security and that monit does not
1583    start a possible cracked program or script.
1584    
1585  You can, for example, use the GNU utility I<md5sum> to create a  You can, for example, use the GNU utility I<md5sum> to create a
1586  checksum string for a file and then use this string in the  checksum string for a file and then use this string in the
# Line 1591  these options, complete list follows: Line 1771  these options, complete list follows:
1771    inode    inode
1772    space    space
1773    permission    permission
1774      uid
1775      gid
1776    
1777   check directory service2 with path /mydir   check directory service2 with path /mydir
1778    start    start
# Line 1603  these options, complete list follows: Line 1785  these options, complete list follows:
1785    depend    depend
1786    timestamp    timestamp
1787    permission    permission
1788      uid
1789      gid
1790    
1791   check file service3 with path /mydir/myfile   check file service3 with path /mydir/myfile
1792    start    start
# Line 1616  these options, complete list follows: Line 1800  these options, complete list follows:
1800    checksum    checksum
1801    timestamp    timestamp
1802    permission    permission
1803      uid
1804      gid
1805    
1806   check [process] service4 with {pidfile|path} /var/run/myproc.pid   check [process] service4 with {pidfile|path} /var/run/myproc.pid
1807    start    start
# Line 1710  insensitive. Line 1896  insensitive.
1896   stop            The program for stopping the specified   stop            The program for stopping the specified
1897                   service. Full path is required. This                   service. Full path is required. This
1898                   statement is optional.                   statement is optional.
1899   uid and gid     Optional part of a start, stop or exec   uid and gid     Either optional part of a start, stop or exec
1900                   statement. May be used to specify a user id and                   statement (then it may be used to specify a user
1901                   a group id the program should be started as. The                   id and a group id the program should be started
1902                   uid and gid may be specified as a name or as a                   as) or standalone statement of file service
1903                   number. This extension may only be used if the                   check. The uid and gid may be specified as a
1904                   super-user is running monit.                   name or as a number. The first form of this
1905                     extension may only be used if the super-user
1906                     is running monit.
1907   host            The hostname or IP address to test the port   host            The hostname or IP address to test the port
1908                   at. This keyword can only be used together                   at. This keyword can only be used together
1909                   with a port statement.                   with a port statement.
# Line 1764  insensitive. Line 1952  insensitive.
1952                   This statement is optional                   This statement is optional
1953   alert           Specifies an email address for notification   alert           Specifies an email address for notification
1954                   if timeout, start, restart, checksum, resource,                   if timeout, start, restart, checksum, resource,
1955                   stop, connection, size, permission or timestamp                   stop, connection, size, permission, uid, gid or
1956                   occurs.  Alert can also be postfixed, to only                   timestamp occurs. Alert can also be postfixed,
1957                   send a message for certain events. See the                   to only send a message for certain events. See
1958                   examples above. More than one alert statement                   the examples above. More than one alert
1959                   is allowed in an entry. This statement is also                   statement is allowed in an entry. This statement
1960                   optional.                   is also optional.
1961   restart,        These keywords may be used as actions for   restart,        These keywords may be used as actions for
1962   stop and exec   various test statements. The exec statement is   stop and exec   various test statements. The exec statement is
1963                   special in that it requires a following string                   special in that it requires a following string
# Line 1861  I<passive>, I<manual>, I<depends>, I<hos Line 2049  I<passive>, I<manual>, I<depends>, I<hos
2049  I<ftp>, I<smtp>, I<pop>, I<nntp>, I<imap>, I<ssh>, I<dwp>,  I<ftp>, I<smtp>, I<pop>, I<nntp>, I<imap>, I<ssh>, I<dwp>,
2050  I<ldap2>, I<ldap3>, I<request>, I<cpu>, I<mem>, I<totalmem>,  I<ldap2>, I<ldap3>, I<request>, I<cpu>, I<mem>, I<totalmem>,
2051  I<children>, I<loadavg>, I<timestamp>, I<changed>, I<second(s)>,  I<children>, I<loadavg>, I<timestamp>, I<changed>, I<second(s)>,
2052  I<minute(s)>, I<hour(s)>, I<day(s)>, I<space>, I<inode>, I<perm>,  I<minute(s)>, I<hour(s)>, I<day(s)>, I<space>, I<inode>,
2053  I<process>, I<file>, I<directory>, I<device> and I<size>,  I<perm(ission)>, I<process>, I<file>, I<directory>, I<device>,
2054  I<failed>  I<size> and I<failed>
2055    
2056  And here is a complete list of B<noise keywords> ignored by  And here is a complete list of B<noise keywords> ignored by
2057  monit:  monit:
# Line 1973  stop programs. Line 2161  stop programs.
2161     depends on apache_bin     depends on apache_bin
2162    
2163   check file apache_bin with path /usr/local/apache/bin/httpd   check file apache_bin with path /usr/local/apache/bin/httpd
2164     checksum     if failed checksum then stop
2165    
2166  Some servers are slow starters, like for example Java based  Some servers are slow starters, like for example Java based
2167  Application Servers. So if we want to keep the poll-cycle low  Application Servers. So if we want to keep the poll-cycle low
# Line 2048  statement and file check dependency: Line 2236  statement and file check dependency:
2236     group apache     group apache
2237    
2238   check file httpd_bin with path /usr/local/apache/bin/httpd   check file httpd_bin with path /usr/local/apache/bin/httpd
2239     checksum and expect 8f7f419955cefa0b33a2ba316cba3659     if failed checksum and expect 8f7f419955cefa0b33a2ba316cba3659
2240     permission 755       then alert
2241       if failed permission 755 then alert
2242       if failed uid root then alert
2243       if failed gid root then alert
2244     if size changed then alert     if size changed then alert
2245     if timestamp changed then alert     if timestamp changed then alert
2246     alert security@bar on {checksum, size, timestamp, permission}     alert security@bar on {checksum, size, timestamp, permission,
2247       with mail-format {subject: Alaaarrm! on $HOST}       uid, gid} with mail-format {subject: Alaaarrm! on $HOST}
2248     group apache     group apache
2249    
2250    
# Line 2154  Finally an example with all statements: Line 2345  Finally an example with all statements:
2345    
2346   check file httpd_bin with path /usr/local/apache/bin/httpd   check file httpd_bin with path /usr/local/apache/bin/httpd
2347     group server     group server
2348     checksum and expect the sum 8f7f419955cefa0b33a2ba316cba3659     if failed checksum and expect the sum
2349     permission 755       8f7f419955cefa0b33a2ba316cba3659 the alert
2350       if failed permission 755 then alert
2351       if failed uid root then alert
2352       if failed gid root then alert
2353     if size changed then alert     if size changed then alert
2354     if timestamp changed then alert     if timestamp changed then alert
2355     every 2 cycles     every 2 cycles
2356     alert bofh@bar with mail-format {from: monit@foo.bar.no}     alert bofh@bar with mail-format {from: monit@foo.bar.no}
2357     alert foo@bar on { checksum, size, timestamp }     alert foo@bar on { checksum, size, timestamp, uid, gid }
2358     depends on datafs     depends on datafs
2359    
2360   check device datafs with path /dev/sdb1   check device datafs with path /dev/sdb1
2361     group server     group server
2362     start program  = "/bin/mount /data"     start program  = "/bin/mount /data"
2363     stop program  =  "/bin/umount /data"     stop program  =  "/bin/umount /data"
2364     permission 660     if failed permission 660 then stop
2365     if space usage > 80 % then alert     if space usage > 80 % then alert
2366     if space usage > 94 % then stop     if space usage > 94 % then stop
2367     if inode usage > 80 % then alert     if inode usage > 80 % then alert

Legend:
Removed from v.1.90  
changed lines
  Added in v.1.91

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26