154 |
will poll all services described in your F<~/.monitrc> file every |
will poll all services described in your F<~/.monitrc> file every |
155 |
5 minutes. |
5 minutes. |
156 |
|
|
157 |
It is possible to set a polling interval in your ~/.monitrc file |
It is possible and recommended to set a polling interval in your |
158 |
by saying 'set daemon B<n>', where B<n> is an integer number of |
~/.monitrc file by saying 'set daemon B<n>', where B<n> is an |
159 |
seconds. If you do this, monit will always start in daemon mode |
integer number of seconds. If you do this, monit will always |
160 |
(as long as no action arguments are given). |
start in daemon mode (as long as no action arguments are given). |
161 |
|
|
162 |
Monit makes a per-instance lockfile in daemon mode. If you need |
Monit makes a per-instance lockfile in daemon mode. If you need |
163 |
more instances, you will need more configuration files, each |
more monit instances, you will need more configuration files, |
164 |
pointing to its own lockfile. |
each pointing to its own lockfile. |
165 |
|
|
166 |
Calling monit with a daemon in the background sends a wakeup |
Calling monit with a daemon in the background sends a wakeup |
167 |
signal to the daemon, forcing it to check services immediately. |
signal to the daemon, forcing it to check services immediately. |
273 |
o A service timed out |
o A service timed out |
274 |
o A service was stopped |
o A service was stopped |
275 |
o A port connection failed |
o A port connection failed |
276 |
|
o A resource statement match |
277 |
|
o A permission error occurred |
278 |
|
o A file checksum was changed |
279 |
o A timestamp test didn't pass |
o A timestamp test didn't pass |
280 |
o A size test didn't pass |
o A file size test didn't pass |
281 |
o A service was started or restarted |
o A service was started or restarted |
282 |
o A resource statement match (see also the section RESOURCE |
o A file/directory/device uid error occurred |
283 |
TESTING below) |
o A file/directory/device gid error occurred |
|
o A checksum error occurred (see also the section MD5 CHECKSUM |
|
|
below) |
|
|
o A permission error occurred |
|
|
o A uid error occurred |
|
|
o A gid error occurred |
|
284 |
|
|
285 |
More than one alert statement can be used in a service entry. |
More than one alert statement can be used in a service entry. |
286 |
This means that you can send different emails to different |
This means that you can send different emails to different |
582 |
See also the example section below. |
See also the example section below. |
583 |
|
|
584 |
|
|
585 |
|
|
586 |
|
|
587 |
|
=head1 FILE CHECKSUM TESTING |
588 |
|
|
589 |
|
If specified in the control file, monit will compute a md5 |
590 |
|
checksum for a file. The checksum is used to verify that a file |
591 |
|
does not change. The checksum statement may B<only> be used in a |
592 |
|
file service entry. |
593 |
|
|
594 |
|
The full syntax for the checksum statement is as follows: |
595 |
|
(keywords are in capital) |
596 |
|
|
597 |
|
=over 4 |
598 |
|
|
599 |
|
=item IF FAILED CHECKSUM [EXPECT checksum] THEN action |
600 |
|
|
601 |
|
=back |
602 |
|
|
603 |
|
I<expect> is optional and if used specifies a md5 string monit |
604 |
|
should expect when testing a file's checksum. If I<expect> is |
605 |
|
used monit will not compute an initial checksum for the file, but |
606 |
|
instead use the string you submit. For example: |
607 |
|
|
608 |
|
if failed checksum and |
609 |
|
expect the sum 8f7f419955cefa0b33a2ba316cba3659 |
610 |
|
then alert |
611 |
|
|
612 |
|
You can, for example, use the GNU utility I<md5sum> to create a |
613 |
|
checksum string for a file and then use this string in the |
614 |
|
expect-statement. |
615 |
|
|
616 |
|
I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC": |
617 |
|
|
618 |
|
=over 4 |
619 |
|
|
620 |
|
=item * |
621 |
|
|
622 |
|
ALERT sends the user a checksum alert. |
623 |
|
|
624 |
|
=item * |
625 |
|
|
626 |
|
RESTART restarts the service I<and> sends an alert. |
627 |
|
|
628 |
|
=item * |
629 |
|
|
630 |
|
STOP stops the service I<and> sends an alert. If monit stops a |
631 |
|
service it will not be checked by monit anymore nor restarted |
632 |
|
again later. You must explicit start it again from the web |
633 |
|
interface or from the console, like: 'monit start myfile' if you |
634 |
|
want the monit daemon to monitor the service again. |
635 |
|
|
636 |
|
=item * |
637 |
|
|
638 |
|
EXEC may be used to execute an arbitrary program I<and> send an |
639 |
|
alert. If you choose this action you must state the program to be |
640 |
|
executed. For instance; exec "/sbin/ifconfig eth0 down". |
641 |
|
|
642 |
|
=back |
643 |
|
|
644 |
|
The checksum statement may be used to check a file for changes |
645 |
|
and if changed, do a specified action. For instance to reload a |
646 |
|
server if its configuration file was changed. The following |
647 |
|
illustrate this for the apache web server: |
648 |
|
|
649 |
|
check file httpd.conf path /usr/local/apache/conf/httpd.conf |
650 |
|
if failed checksum |
651 |
|
then exec "/usr/local/apache/bin/apachectl -k restart" |
652 |
|
|
653 |
|
B<Note>, if you plan to use the checksum statement for security |
654 |
|
reasons, e.g. to monitor a file which should not change, then we |
655 |
|
strongly recommend that you choose the I<alert> action and only |
656 |
|
the alert action. The reason is that you may accidentally execute |
657 |
|
a cracked program if a service depends on the file-service |
658 |
|
containing the checksum test, as in this example: |
659 |
|
|
660 |
|
check apache with pidfile "/usr/local/apache/logs/httpd.pid" |
661 |
|
start program = "/usr/local/apache/bin/http start" |
662 |
|
stop program = "/usr/local/apache/bin/http stop" |
663 |
|
alert hauk@tildeslash.com |
664 |
|
depends on http.bin |
665 |
|
|
666 |
|
check file http.bin path /usr/local/apache/bin/http |
667 |
|
if failed checksum then stop |
668 |
|
|
669 |
|
If /usr/local/apache/bin/http (in the above example) was changed |
670 |
|
then the stop action in the checksum statement is executed, but |
671 |
|
the stop action will also propagate upward in the dependency tree |
672 |
|
and call the stop program for services that depends on the check |
673 |
|
file service as well. Since we just found a checksum error in the |
674 |
|
http binary we should absolutely not want to execute this |
675 |
|
program, that is; the apache service's stop program. |
676 |
|
|
677 |
|
In this example, you should instead choose the alert action. You |
678 |
|
will then only get an alert message saying that |
679 |
|
/usr/local/apache/bin/http was changed and you may then start |
680 |
|
your own cognitive B<OODA> loop, that is; Observe, Orient, Decide |
681 |
|
and Act. In this case, where your system may be compromised, it's |
682 |
|
better that you do this than monit. |
683 |
|
|
684 |
|
|
685 |
|
|
686 |
=head1 TIMESTAMP TESTING |
=head1 TIMESTAMP TESTING |
687 |
|
|
688 |
Monit can monitor file, directories and devices for timestamp |
Monit can monitor file, directories and devices for timestamp |
1032 |
|
|
1033 |
=back |
=back |
1034 |
|
|
1035 |
=head3 Examples |
=head4 Examples |
1036 |
|
|
1037 |
To check a port connection and receive an alert if monit cannot |
To check a port connection and receive an alert if monit cannot |
1038 |
connect to the port, use the following statement: |
connect to the port, use the following statement: |
1048 |
|
|
1049 |
Monit will stop trying to connect to the port after 5 seconds and |
Monit will stop trying to connect to the port after 5 seconds and |
1050 |
assume that the server behind the port is down. You may increase |
assume that the server behind the port is down. You may increase |
1051 |
or decrease the connect timeout by explicit add a timeout as in |
or decrease the connect timeout by explicit add a connection |
1052 |
this example: |
timeout. In the following example the timeout is increased to 15 |
1053 |
|
seconds and if monit cannot connect to the server within 15 |
1054 |
|
seconds the test will fail and an alert message is sent. |
1055 |
|
|
1056 |
if failed port 80 with timeout 15 seconds then alert |
if failed port 80 with timeout 15 seconds then alert |
1057 |
|
|
1058 |
In case a server is listening to a unix socket called |
In case a server is listening to a unix socket the following |
1059 |
/var/run/mysocket, the following statement can be used: |
statement can be used: |
1060 |
|
|
1061 |
if failed unixsocket /var/run/mysocket then alert |
if failed unixsocket /var/run/mysocket then alert |
1062 |
|
|
1063 |
|
A unix socket is used by some servers to conduct communication on |
1064 |
|
localhost only. An open unix socket is specified by a path and in |
1065 |
|
the example above the path, /var/run/mysocket, specifies a unix |
1066 |
|
socket. |
1067 |
|
|
1068 |
If your machine answers for several virtual hosts you can prefix |
If your machine answers for several virtual hosts you can prefix |
1069 |
the port statement with a host-statement like so: |
the port statement with a host-statement like so: |
1070 |
|
|
1105 |
server's certificate. The md5 sum is matched against the one |
server's certificate. The md5 sum is matched against the one |
1106 |
delivered by the server. In case they do not match the connection |
delivered by the server. In case they do not match the connection |
1107 |
test fails. In case the ssl version independant handshake is not |
test fails. In case the ssl version independant handshake is not |
1108 |
working properly you can force a specific ssl version too, as we |
working properly you can force a specific ssl version, as we |
1109 |
demonstrate in this example: |
demonstrate in this example: |
1110 |
|
|
1111 |
if failed host shop.sol.no port 443 |
if failed host shop.sol.no port 443 |
1112 |
type TCPSSL TLSV1 |
type TCPSSL SSLV3 |
1113 |
CERTMD5 94A07F97ADFEDEDD16F053EEE6351AB1 |
CERTMD5 94A07F97ADFEDEDD16F053EEE6351AB1 |
1114 |
protocol http then restart |
protocol http |
1115 |
|
then restart |
1116 |
|
|
1117 |
Finally, it is of course possible to mix networked ports and unix |
Finally, it is of course possible to mix networked ports and unix |
1118 |
sockets checks for a service. |
sockets checks for a service. |
1121 |
|
|
1122 |
|
|
1123 |
|
|
1124 |
|
|
1125 |
=head1 SPACE TESTING |
=head1 SPACE TESTING |
1126 |
|
|
1127 |
Monit supports test of devices/filesystems. You can check for |
Monit supports test of devices/filesystems. You can check for |
1618 |
complain and exit if the control file is readable by others. |
complain and exit if the control file is readable by others. |
1619 |
|
|
1620 |
|
|
|
=head1 MD5 CHECKSUM |
|
|
|
|
|
If specified in the control file, monit will compute a md5 |
|
|
checksum for a file. The checksum is used to verify that a |
|
|
file does not change. |
|
|
|
|
|
Checksum statement is supported only by file monitoring service |
|
|
check type, e.g. defined under for example: |
|
|
|
|
|
check file myfile with path /path/to/my/file |
|
|
|
|
|
Other monitoring service types (such as process, directory or device) |
|
|
are not supported. |
|
|
|
|
|
The full syntax for the checksum statement is as follows: |
|
|
(keywords are in capital) |
|
|
|
|
|
=over 4 |
|
|
|
|
|
=item IF FAILED CHECKSUM [EXPECT checksum] THEN action |
|
|
|
|
|
=back |
|
|
|
|
|
I<expect> statement is optional and used to specify a md5 |
|
|
string monit should expect when testing a file's checksum. If |
|
|
this statement is used monit will not compute an initial checksum |
|
|
for the file, as in the examples above, but instead use the |
|
|
string you submit. For example: |
|
|
|
|
|
if failed checksum and expect 8f7f419955cefa0b33a2ba316cba3659 |
|
|
then stop |
|
|
|
|
|
or verbose style; |
|
|
|
|
|
if failed checksum and expect |
|
|
the sum 4e5309d1956f003bcdff168748bea647 then alert |
|
|
|
|
|
I<action> is a choice of "ALERT", "RESTART", "STOP" or "EXEC": |
|
|
|
|
|
=over 4 |
|
|
|
|
|
=item * |
|
|
|
|
|
ALERT sends the user a checksum alert. |
|
|
|
|
|
=item * |
|
|
|
|
|
RESTART restarts the service. |
|
|
|
|
|
=item * |
|
|
|
|
|
STOP stops the service. If monit stops a service it will |
|
|
not be checked by monit anymore nor restarted again later. You |
|
|
must explicit start it again from the web interface or from the |
|
|
console, like: 'monit start myfile' if you want the monit daemon |
|
|
to monitor the service again. |
|
|
|
|
|
=item * |
|
|
|
|
|
EXEC may be used to execute an arbitrary program. If you choose |
|
|
this action you must state the program to be executed. For |
|
|
instance; exec "/sbin/ifconfig eth0 down" |
|
|
|
|
|
=back |
|
|
|
|
|
The web interface will show a checksum warning in the case |
|
|
that it changed. |
|
|
|
|
|
We recommend to use STOP action in the checksum statement. The |
|
|
rationale for this feature is security and that monit does not |
|
|
start a possible cracked program or script. |
|
|
|
|
|
You can, for example, use the GNU utility I<md5sum> to create a |
|
|
checksum string for a file and then use this string in the |
|
|
expect-statement. |
|
|
|
|
|
|
|
1621 |
|
|
1622 |
=head1 DEPENDENCY CHECKING |
=head1 DEPENDENCY CHECKING |
1623 |
|
|
2097 |
program. E.g. C<#!/bin/sh> |
program. E.g. C<#!/bin/sh> |
2098 |
|
|
2099 |
It's possible to write scripts directly into the I<start> and |
It's possible to write scripts directly into the I<start> and |
2100 |
I<stop> entries by using a string of shell-commands. Like: |
I<stop> entries by using a string of shell-commands. Like so: |
2101 |
|
|
2102 |
|
start="/bin/bash -c 'echo $$ > pidfile; exec program'" |
2103 |
|
stop="/bin/bash -c 'kill -s SIGTERM `cat pidfile`'" |
2104 |
|
|
2105 |
start: "/bin/sh -c { echo $$ > pidfile; exec program }" |
When a program is started by monit |
|
stop: "/bin/sh -c { kill -s SIGTERM `cat pidfile` }" |
|
2106 |
|
|
2107 |
|
|
2108 |
=head2 CONFIGURATION EXAMPLES |
=head2 CONFIGURATION EXAMPLES |