We can add an option for the tmestamp test, which can allow to restrict the
timestamp test to ctime or mtime only instead of the current ctime||mtime.
=> the syntax could be something like this:
IF CHANGED [CONTENT | INODE] TIMESTAMP THEN <ACTION>
and usage examples:
1.) test ctime or mtime changes (current behavior):
if changed timestamp then …
2.) test mtime only:
if changed content timestamp …
3.) test ctime only:
if changed inode timestamp …
I think the ctime could be changed by some backup program (for example
Veritas/Symantec Netbackup and Legato/EMC Networker can use ctime for backup -
both of them optionally allow to disable the ctime modification). Do you use
some backup program which can use ctime like this? If not, which filesystem do
you use?
Regards,
Martin
On Jan 19, 2012, at 11:58 AM, Nick Upson wrote:
> thank you, I can see that would work but the logrotate is for *.log. I would
> really prefer to implement this within monit.
>
> I'm a little surprised that no-one else has had this requirement before.
>
> Nick Upson
>
>
>
> On 18 January 2012 21:43, Martin Pala <[email protected]> wrote:
> You can add the unmonitor/monitor of the given service to the logrotation
> script, for example:
>
> prerotate
> /usr/bin/monit unmonitor firebirdlog
> endscript
> postrotate
> /usr/bin/monit monitor firebirdlog
> endscript
>
>
> Regards,
> Martin
>
>
> On Jan 18, 2012, at 4:48 PM, Nick Upson wrote:
>
>> This seems to be what I want but is considered a syntax error, is there
>> another way to achieve the same thing
>>
>> check file firebirdlog with path /var/log/firebird/firebird.log
>> if changed timestamp and size > 0 then alert
>>
>> Nick Upson
>>
>>
>>
>> On 18 January 2012 10:01, Nick Upson <[email protected]> wrote:
>> The complication I need to handle is that when this file is logrotated it
>> should not alert me
>> Nick Upson
>>
>>
>>
>>
>> On 18 January 2012 09:51, Nick Upson <[email protected]> wrote:
>> Hi,
>>
>> Access: 2012-01-16 23:55:16.000000000 +0000
>> Modify: 2012-01-16 23:55:16.000000000 +0000
>> Change: 2012-01-18 09:45:01.000000000 +0000
>>
>> That's it then, the ctime is changing, which is wierd because there is no
>> change to the file itself. I need another way to be alerted when the file
>> changes, MD5sum perhaps
>>
>> Nick Upson
>>
>>
>>
>>
>> On 17 January 2012 21:49, Martin Pala <[email protected]> wrote:
>> Hi,
>>
>> can you get the "stat" output for that file? Monit tests the mtime (content
>> modification time) and ctime (inode modification time - owner, permission,
>> etc.), the event is generated if one of them changed. The "ls" won't display
>> ctime by default, to display the ctime with ls, you can use: "ls -lc"
>>
>> Regards,
>> Martin
>>
>>
>>
>> On Jan 17, 2012, at 5:39 PM, Nick Upson wrote:
>>
>> > Hi,
>> >
>> > I continue to get alerts from the config entry below even when the file
>> > hasn't changed, it doesn't happen every cycle either.
>> > The log extract below it changing yet the file hasn't changed since 16:14
>> >
>> > check file firebirdlog with path /var/log/firebird/firebird.log
>> > if changed timestamp then alert
>> >
>> > [GMT Jan 17 16:20:33] debug : 'firebirdlog' file exists check succeeded
>> > [GMT Jan 17 16:20:33] debug : 'firebirdlog' is a regular file
>> > [GMT Jan 17 16:20:33] error : 'firebirdlog' timestamp was changed for
>> > /var/log/firebird/firebird.log
>> > [GMT Jan 17 16:23:05] debug : 'firebirdlog' file exists check succeeded
>> > [GMT Jan 17 16:23:05] debug : 'firebirdlog' is a regular file
>> > [GMT Jan 17 16:23:05] debug : 'firebirdlog' timestamp was not changed
>> > for /var/log/firebird/firebird.log
>> > [GMT Jan 17 16:23:05] info : 'firebirdlog' timestamp was not changed
>> > for /var/log/firebird/firebird.log
>> > [GMT Jan 17 16:25:37] debug : 'firebirdlog' file exists check succeeded
>> > [GMT Jan 17 16:25:37] debug : 'firebirdlog' is a regular file
>> > [GMT Jan 17 16:25:37] error : 'firebirdlog' timestamp was changed for
>> > /var/log/firebird/firebird.log
>> > [GMT Jan 17 16:28:09] debug : 'firebirdlog' file exists check succeeded
>> > [GMT Jan 17 16:28:09] debug : 'firebirdlog' is a regular file
>> > [GMT Jan 17 16:28:09] debug : 'firebirdlog' timestamp was not changed
>> > for /var/log/firebird/firebird.log
>> > [GMT Jan 17 16:28:09] info : 'firebirdlog' timestamp was not changed
>> > for /var/log/firebird/firebird.log
>> > [GMT Jan 17 16:30:41] debug : 'firebirdlog' file exists check succeeded
>> > [GMT Jan 17 16:30:41] debug : 'firebirdlog' is a regular file
>> > [GMT Jan 17 16:30:41] error : 'firebirdlog' timestamp was changed for
>> > /var/log/firebird/firebird.log
>> > [GMT Jan 17 16:33:13] debug : 'firebirdlog' file exists check succeeded
>> > [GMT Jan 17 16:33:13] debug : 'firebirdlog' is a regular file
>> > [GMT Jan 17 16:33:13] debug : 'firebirdlog' timestamp was not changed
>> > for /var/log/firebird/firebird.log
>> > [GMT Jan 17 16:33:13] info : 'firebirdlog' timestamp was not changed
>> > for /var/log/firebird/firebird.log
>> > [GMT Jan 17 16:35:45] debug : 'firebirdlog' file exists check succeeded
>> > [GMT Jan 17 16:35:45] debug : 'firebirdlog' is a regular file
>> > [GMT Jan 17 16:35:45] error : 'firebirdlog' timestamp was changed for
>> > /var/log/firebird/firebird.log
>> >
>> > Nick Upson
>> >
>> > --
>> > To unsubscribe:
>> > https://lists.nongnu.org/mailman/listinfo/monit-general
>>
>>
>> --
>> To unsubscribe:
>> https://lists.nongnu.org/mailman/listinfo/monit-general
>>
>>
>>
>> --
>> To unsubscribe:
>> https://lists.nongnu.org/mailman/listinfo/monit-general
>
>
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general
>
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general
--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general
