I think this should do it check file firebirdlog with path /var/log/firebird/firebird.log if match "^.*$" then alert
Nick Upson On 20 January 2012 09:10, Martin Pala <[email protected]> wrote: > The combo rule which will consists of multiple tests can be supported in > the future - we're refactoring the monit check engine to allow more > flexible tests. > > > On Jan 20, 2012, at 10:01 AM, Nick Upson wrote: > > the filesystem I use is ext3 (Centos) > > that looks very useful but how about also allowing multiple tests so > something like this would work > > if changed and size > 0 then alert > > > Nick Upson > > > > On 20 January 2012 08:41, Martin Pala <[email protected]> wrote: > >> We can add an option for the tmestamp test, which can allow to restrict >> the timestamp test to ctime or mtime only instead of the current >> ctime||mtime. >> >> => the syntax could be something like this: >> >> IF CHANGED [CONTENT | INODE] TIMESTAMP THEN <ACTION> >> >> and usage examples: >> >> 1.) test ctime or mtime changes (current behavior): >> if changed timestamp then … >> >> 2.) test mtime only: >> if changed content timestamp … >> >> 3.) test ctime only: >> if changed inode timestamp … >> >> >> I think the ctime could be changed by some backup program (for example >> Veritas/Symantec Netbackup and Legato/EMC Networker can use ctime for >> backup - both of them optionally allow to disable the ctime modification). >> Do you use some backup program which can use ctime like this? If not, which >> filesystem do you use? >> >> Regards, >> Martin >> >> >> On Jan 19, 2012, at 11:58 AM, Nick Upson wrote: >> >> thank you, I can see that would work but the logrotate is for *.log. I >> would really prefer to implement this within monit. >> >> I'm a little surprised that no-one else has had this requirement before. >> >> Nick Upson >> >> >> >> On 18 January 2012 21:43, Martin Pala <[email protected]> wrote: >> >>> You can add the unmonitor/monitor of the given service to the >>> logrotation script, for example: >>> >>> prerotate >>> /usr/bin/monit unmonitor firebirdlog >>> endscript >>> postrotate >>> /usr/bin/monit monitor firebirdlog >>> endscript >>> >>> >>> Regards, >>> Martin >>> >>> >>> On Jan 18, 2012, at 4:48 PM, Nick Upson wrote: >>> >>> This seems to be what I want but is considered a syntax error, is there >>> another way to achieve the same thing >>> >>> check file firebirdlog with path /var/log/firebird/firebird.log >>> if changed timestamp and size > 0 then alert >>> >>> Nick Upson >>> >>> >>> >>> On 18 January 2012 10:01, Nick Upson <[email protected]> wrote: >>> >>>> The complication I need to handle is that when this file is logrotated >>>> it should not alert me >>>> Nick Upson >>>> >>>> >>>> >>>> >>>> On 18 January 2012 09:51, Nick Upson <[email protected]> wrote: >>>> >>>>> Hi, >>>>> >>>>> Access: 2012-01-16 23:55:16.000000000 +0000 >>>>> Modify: 2012-01-16 23:55:16.000000000 +0000 >>>>> Change: 2012-01-18 09:45:01.000000000 +0000 >>>>> >>>>> That's it then, the ctime is changing, which is wierd because there is >>>>> no change to the file itself. I need another way to be alerted when the >>>>> file changes, MD5sum perhaps >>>>> >>>>> Nick Upson >>>>> >>>>> >>>>> >>>>> >>>>> On 17 January 2012 21:49, Martin Pala <[email protected]> wrote: >>>>> >>>>>> Hi, >>>>>> >>>>>> can you get the "stat" output for that file? Monit tests the mtime >>>>>> (content modification time) and ctime (inode modification time - owner, >>>>>> permission, etc.), the event is generated if one of them changed. The >>>>>> "ls" >>>>>> won't display ctime by default, to display the ctime with ls, you can >>>>>> use: >>>>>> "ls -lc" >>>>>> >>>>>> Regards, >>>>>> Martin >>>>>> >>>>>> >>>>>> >>>>>> On Jan 17, 2012, at 5:39 PM, Nick Upson wrote: >>>>>> >>>>>> > Hi, >>>>>> > >>>>>> > I continue to get alerts from the config entry below even when the >>>>>> file hasn't changed, it doesn't happen every cycle either. >>>>>> > The log extract below it changing yet the file hasn't changed since >>>>>> 16:14 >>>>>> > >>>>>> > check file firebirdlog with path /var/log/firebird/firebird.log >>>>>> > if changed timestamp then alert >>>>>> > >>>>>> > [GMT Jan 17 16:20:33] debug : 'firebirdlog' file exists check >>>>>> succeeded >>>>>> > [GMT Jan 17 16:20:33] debug : 'firebirdlog' is a regular file >>>>>> > [GMT Jan 17 16:20:33] error : 'firebirdlog' timestamp was >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > [GMT Jan 17 16:23:05] debug : 'firebirdlog' file exists check >>>>>> succeeded >>>>>> > [GMT Jan 17 16:23:05] debug : 'firebirdlog' is a regular file >>>>>> > [GMT Jan 17 16:23:05] debug : 'firebirdlog' timestamp was not >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > [GMT Jan 17 16:23:05] info : 'firebirdlog' timestamp was not >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > [GMT Jan 17 16:25:37] debug : 'firebirdlog' file exists check >>>>>> succeeded >>>>>> > [GMT Jan 17 16:25:37] debug : 'firebirdlog' is a regular file >>>>>> > [GMT Jan 17 16:25:37] error : 'firebirdlog' timestamp was >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > [GMT Jan 17 16:28:09] debug : 'firebirdlog' file exists check >>>>>> succeeded >>>>>> > [GMT Jan 17 16:28:09] debug : 'firebirdlog' is a regular file >>>>>> > [GMT Jan 17 16:28:09] debug : 'firebirdlog' timestamp was not >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > [GMT Jan 17 16:28:09] info : 'firebirdlog' timestamp was not >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > [GMT Jan 17 16:30:41] debug : 'firebirdlog' file exists check >>>>>> succeeded >>>>>> > [GMT Jan 17 16:30:41] debug : 'firebirdlog' is a regular file >>>>>> > [GMT Jan 17 16:30:41] error : 'firebirdlog' timestamp was >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > [GMT Jan 17 16:33:13] debug : 'firebirdlog' file exists check >>>>>> succeeded >>>>>> > [GMT Jan 17 16:33:13] debug : 'firebirdlog' is a regular file >>>>>> > [GMT Jan 17 16:33:13] debug : 'firebirdlog' timestamp was not >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > [GMT Jan 17 16:33:13] info : 'firebirdlog' timestamp was not >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > [GMT Jan 17 16:35:45] debug : 'firebirdlog' file exists check >>>>>> succeeded >>>>>> > [GMT Jan 17 16:35:45] debug : 'firebirdlog' is a regular file >>>>>> > [GMT Jan 17 16:35:45] error : 'firebirdlog' timestamp was >>>>>> changed for /var/log/firebird/firebird.log >>>>>> > >>>>>> > Nick Upson >>>>>> > >>>>>> > -- >>>>>> > To unsubscribe: >>>>>> > https://lists.nongnu.org/mailman/listinfo/monit-general >>>>>> >>>>>> >>>>>> -- >>>>>> To unsubscribe: >>>>>> https://lists.nongnu.org/mailman/listinfo/monit-general >>>>>> >>>>> >>>>> >>>> >>> -- >>> To unsubscribe: >>> https://lists.nongnu.org/mailman/listinfo/monit-general >>> >>> >>> >>> -- >>> To unsubscribe: >>> https://lists.nongnu.org/mailman/listinfo/monit-general >>> >> >> -- >> To unsubscribe: >> https://lists.nongnu.org/mailman/listinfo/monit-general >> >> >> >> -- >> To unsubscribe: >> https://lists.nongnu.org/mailman/listinfo/monit-general >> > > -- > To unsubscribe: > https://lists.nongnu.org/mailman/listinfo/monit-general > > > > -- > To unsubscribe: > https://lists.nongnu.org/mailman/listinfo/monit-general >
-- To unsubscribe: https://lists.nongnu.org/mailman/listinfo/monit-general
