/[monit]/monit/monit.pod
ViewVC logotype

Diff of /monit/monit.pod

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.92 by martinp, Tue Aug 12 20:05:01 2003 UTC revision 1.93 by hauk, Sun Aug 17 02:21:22 2003 UTC
# Line 154  for the given polling interval. Line 154  for the given polling interval.
154  will poll all services described in your F<~/.monitrc> file every  will poll all services described in your F<~/.monitrc> file every
155  5 minutes.  5 minutes.
156    
157  It is possible to set a polling interval in your ~/.monitrc file  It is possible and recommended to set a polling interval in your
158  by saying 'set daemon B<n>', where B<n> is an integer number of  ~/.monitrc file by saying 'set daemon B<n>', where B<n> is an
159  seconds.  If you do this, monit will always start in daemon mode  integer number of seconds.  If you do this, monit will always
160  (as long as no action arguments are given).  start in daemon mode (as long as no action arguments are given).
161    
162  Monit makes a per-instance lockfile in daemon mode. If you need  Monit makes a per-instance lockfile in daemon mode. If you need
163  more instances, you will need more configuration files, each  more monit instances, you will need more configuration files,
164  pointing to its own lockfile.  each pointing to its own lockfile.
165    
166  Calling monit with a daemon in the background sends a wakeup  Calling monit with a daemon in the background sends a wakeup
167  signal to the daemon, forcing it to check services immediately.  signal to the daemon, forcing it to check services immediately.
# Line 273  monit will raise an email alert if: Line 273  monit will raise an email alert if:
273   o A service timed out   o A service timed out
274   o A service was stopped   o A service was stopped
275   o A port connection failed   o A port connection failed
276     o A resource statement match
277     o A permission error occurred
278     o A file checksum was changed
279   o A timestamp test didn't pass   o A timestamp test didn't pass
280   o A size test didn't pass   o A file size test didn't pass
281   o A service was started or restarted   o A service was started or restarted
282   o A resource statement match (see also the section RESOURCE   o A file/directory/device uid error occurred
283     TESTING below)   o A file/directory/device gid error occurred
  o A checksum error occurred (see also the section MD5 CHECKSUM  
    below)  
  o A permission error occurred  
  o A uid error occurred  
  o A gid error occurred  
284    
285  More than one alert statement can be used in a service entry.  More than one alert statement can be used in a service entry.
286  This means that you can send different emails to different  This means that you can send different emails to different
# Line 584  expression could be used: Line 582  expression could be used:
582  See also the example section below.  See also the example section below.
583    
584    
585    
586    
587    =head1 FILE CHECKSUM TESTING
588    
589    If specified in the control file, monit will compute a md5
590    checksum for a file. The checksum is used to verify that a file
591    does not change. The checksum statement may B<only> be used in a
592    file service entry.
593    
594    The full syntax for the checksum statement is as follows:
595    (keywords are in capital)
596    
597    =over 4
598    
599    =item IF FAILED CHECKSUM [EXPECT checksum] THEN action
600    
601    =back
602    
603    I<expect> is optional and if used specifies a md5 string monit
604    should expect when testing a file's checksum. If I<expect> is
605    used monit will not compute an initial checksum for the file, but
606    instead use the string you submit. For example:
607    
608     if failed checksum and
609        expect the sum 8f7f419955cefa0b33a2ba316cba3659
610     then alert
611    
612    You can, for example, use the GNU utility I<md5sum> to create a
613    checksum string for a file and then use this string in the
614    expect-statement.
615    
616    I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC":
617    
618    =over 4
619    
620    =item *
621    
622    ALERT sends the user a checksum alert.
623    
624    =item *
625    
626    RESTART restarts the service I<and> sends an alert.
627    
628    =item *
629    
630    STOP stops the service I<and> sends an alert. If monit stops a
631    service it will not be checked by monit anymore nor restarted
632    again later. You must explicit start it again from the web
633    interface or from the console, like: 'monit start myfile' if you
634    want the monit daemon to monitor the service again.
635    
636    =item *
637    
638    EXEC may be used to execute an arbitrary program I<and> send an
639    alert. If you choose this action you must state the program to be
640    executed. For instance; exec "/sbin/ifconfig eth0 down".
641    
642    =back
643    
644    The checksum statement may be used to check a file for changes
645    and if changed, do a specified action. For instance to reload a
646    server if its configuration file was changed. The following
647    illustrate this for the apache web server:
648    
649     check file httpd.conf path /usr/local/apache/conf/httpd.conf
650      if failed checksum
651      then exec "/usr/local/apache/bin/apachectl -k restart"
652    
653    B<Note>, if you plan to use the checksum statement for security
654    reasons, e.g. to monitor a file which should not change, then we
655    strongly recommend that you choose the I<alert> action and only
656    the alert action. The reason is that you may accidentally execute
657    a cracked program if a service depends on the file-service
658    containing the checksum test, as in this example:
659    
660     check apache with pidfile "/usr/local/apache/logs/httpd.pid"
661      start program = "/usr/local/apache/bin/http start"
662      stop program  = "/usr/local/apache/bin/http stop"
663      alert hauk@tildeslash.com
664      depends on http.bin
665    
666     check file http.bin path /usr/local/apache/bin/http
667      if failed checksum then stop
668    
669    If /usr/local/apache/bin/http (in the above example) was changed
670    then the stop action in the checksum statement is executed, but
671    the stop action will also propagate upward in the dependency tree
672    and call the stop program for services that depends on the check
673    file service as well. Since we just found a checksum error in the
674    http binary we should absolutely not want to execute this
675    program, that is; the apache service's stop program.
676    
677    In this example, you should instead choose the alert action. You
678    will then only get an alert message saying that
679    /usr/local/apache/bin/http was changed and you may then start
680    your own cognitive B<OODA> loop, that is; Observe, Orient, Decide
681    and Act. In this case, where your system may be compromised, it's
682    better that you do this than monit.
683    
684    
685    
686  =head1 TIMESTAMP TESTING  =head1 TIMESTAMP TESTING
687    
688  Monit can monitor file, directories and devices for timestamp  Monit can monitor file, directories and devices for timestamp
# Line 933  instance; exec "/etc/init.d/network rest Line 1032  instance; exec "/etc/init.d/network rest
1032    
1033  =back  =back
1034    
1035  =head3 Examples  =head4 Examples
1036    
1037  To check a port connection and receive an alert if monit cannot  To check a port connection and receive an alert if monit cannot
1038  connect to the port, use the following statement:  connect to the port, use the following statement:
# Line 949  with udp, you can specify this after the Line 1048  with udp, you can specify this after the
1048    
1049  Monit will stop trying to connect to the port after 5 seconds and  Monit will stop trying to connect to the port after 5 seconds and
1050  assume that the server behind the port is down. You may increase  assume that the server behind the port is down. You may increase
1051  or decrease the connect timeout by explicit add a timeout as in  or decrease the connect timeout by explicit add a connection
1052  this example:  timeout. In the following example the timeout is increased to 15
1053    seconds and if monit cannot connect to the server within 15
1054    seconds the test will fail and an alert message is sent.
1055    
1056    if failed port 80 with timeout 15 seconds then alert    if failed port 80 with timeout 15 seconds then alert
1057    
1058  In case a server is listening to a unix socket called  In case a server is listening to a unix socket the following
1059  /var/run/mysocket, the following statement can be used:  statement can be used:
1060    
1061   if failed unixsocket /var/run/mysocket then alert   if failed unixsocket /var/run/mysocket then alert
1062    
1063    A unix socket is used by some servers to conduct communication on
1064    localhost only. An open unix socket is specified by a path and in
1065    the example above the path, /var/run/mysocket, specifies a unix
1066    socket.
1067    
1068  If your machine answers for several virtual hosts you can prefix  If your machine answers for several virtual hosts you can prefix
1069  the port statement with a host-statement like so:  the port statement with a host-statement like so:
1070    
# Line 999  The I<TCPSSL> statement accepts optional Line 1105  The I<TCPSSL> statement accepts optional
1105  server's certificate. The md5 sum is matched against the one  server's certificate. The md5 sum is matched against the one
1106  delivered by the server. In case they do not match the connection  delivered by the server. In case they do not match the connection
1107  test fails.  In case the ssl version independant handshake is not  test fails.  In case the ssl version independant handshake is not
1108  working properly you can force a specific ssl version too, as we  working properly you can force a specific ssl version, as we
1109  demonstrate in this example:  demonstrate in this example:
1110    
1111   if failed host shop.sol.no port 443   if failed host shop.sol.no port 443
1112     type TCPSSL TLSV1     type TCPSSL SSLV3
1113     CERTMD5 94A07F97ADFEDEDD16F053EEE6351AB1     CERTMD5 94A07F97ADFEDEDD16F053EEE6351AB1
1114   protocol http then restart     protocol http
1115     then restart
1116    
1117  Finally, it is of course possible to mix networked ports and unix  Finally, it is of course possible to mix networked ports and unix
1118  sockets checks for a service.  sockets checks for a service.
# Line 1014  See also the example section below. Line 1121  See also the example section below.
1121    
1122    
1123    
1124    
1125  =head1 SPACE TESTING  =head1 SPACE TESTING
1126    
1127  Monit supports test of devices/filesystems. You can check for  Monit supports test of devices/filesystems. You can check for
# Line 1510  password is written in clear-text. (Use Line 1618  password is written in clear-text. (Use
1618  complain and exit if the control file is readable by others.  complain and exit if the control file is readable by others.
1619    
1620    
 =head1 MD5 CHECKSUM  
   
 If specified in the control file, monit will compute a md5  
 checksum for a file. The checksum is used to verify that a  
 file does not change.  
   
 Checksum statement is supported only by file monitoring service  
 check type, e.g. defined under for example:  
   
  check file myfile with path /path/to/my/file  
   
 Other monitoring service types (such as process, directory or device)  
 are not supported.  
   
 The full syntax for the checksum statement is as follows:  
 (keywords are in capital)  
   
 =over 4  
   
 =item IF FAILED CHECKSUM [EXPECT checksum] THEN action  
   
 =back  
   
 I<expect> statement is optional and used to specify a md5  
 string monit should expect when testing a file's checksum. If  
 this statement is used monit will not compute an initial checksum  
 for the file, as in the examples above, but instead use the  
 string you submit. For example:  
   
  if failed checksum and expect 8f7f419955cefa0b33a2ba316cba3659  
     then stop  
   
 or verbose style;  
   
  if failed checksum and expect  
     the sum 4e5309d1956f003bcdff168748bea647 then alert  
   
 I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC":  
   
 =over 4  
   
 =item *  
   
 ALERT sends the user a checksum alert.  
   
 =item *  
   
 RESTART restarts the service.  
   
 =item *  
   
 STOP stops the service. If monit stops a service it will  
 not be checked by monit anymore nor restarted again later. You  
 must explicit start it again from the web interface or from the  
 console, like: 'monit start myfile' if you want the monit daemon  
 to monitor the service again.  
   
 =item *  
   
 EXEC may be used to execute an arbitrary program. If you choose  
 this action you must state the program to be executed. For  
 instance; exec "/sbin/ifconfig eth0 down"  
   
 =back  
   
 The web interface will show a checksum warning in the case  
 that it changed.  
   
 We recommend to use STOP action in the checksum statement. The  
 rationale for this feature is security and that monit does not  
 start a possible cracked program or script.  
   
 You can, for example, use the GNU utility I<md5sum> to create a  
 checksum string for a file and then use this string in the  
 expect-statement.  
   
   
1621    
1622  =head1 DEPENDENCY CHECKING  =head1 DEPENDENCY CHECKING
1623    
# Line 2066  first line must specify an interpreter f Line 2097  first line must specify an interpreter f
2097  program. E.g. C<#!/bin/sh>  program. E.g. C<#!/bin/sh>
2098    
2099  It's possible to write scripts directly into the I<start> and  It's possible to write scripts directly into the I<start> and
2100  I<stop> entries by using a string of shell-commands. Like:  I<stop> entries by using a string of shell-commands. Like so:
2101    
2102     start="/bin/bash -c 'echo $$ > pidfile; exec program'"
2103     stop="/bin/bash -c 'kill -s SIGTERM `cat pidfile`'"
2104    
2105   start: "/bin/sh -c { echo $$ > pidfile; exec program }"  When a program is started by monit
  stop:  "/bin/sh -c { kill -s SIGTERM `cat pidfile` }"  
2106    
2107    
2108  =head2 CONFIGURATION EXAMPLES  =head2 CONFIGURATION EXAMPLES

Legend:
Removed from v.1.92  
changed lines
  Added in v.1.93

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26