The combo rule which will consists of multiple tests can be supported in the future - we're refactoring the monit check engine to allow more flexible tests.
On Jan 20, 2012, at 10:01 AM, Nick Upson wrote: > the filesystem I use is ext3 (Centos) > > that looks very useful but how about also allowing multiple tests so > something like this would work > > if changed and size > 0 then alert > > > Nick Upson > > > > On 20 January 2012 08:41, Martin Pala <[email protected]> wrote: > We can add an option for the tmestamp test, which can allow to restrict the > timestamp test to ctime or mtime only instead of the current ctime||mtime. > > => the syntax could be something like this: > > IF CHANGED [CONTENT | INODE] TIMESTAMP THEN <ACTION> > > and usage examples: > > 1.) test ctime or mtime changes (current behavior): > if changed timestamp then … > > 2.) test mtime only: > if changed content timestamp … > > 3.) test ctime only: > if changed inode timestamp … > > > I think the ctime could be changed by some backup program (for example > Veritas/Symantec Netbackup and Legato/EMC Networker can use ctime for backup > - both of them optionally allow to disable the ctime modification). Do you > use some backup program which can use ctime like this? If not, which > filesystem do you use? > > Regards, > Martin > > > On Jan 19, 2012, at 11:58 AM, Nick Upson wrote: > >> thank you, I can see that would work but the logrotate is for *.log. I would >> really prefer to implement this within monit. >> >> I'm a little surprised that no-one else has had this requirement before. >> >> Nick Upson >> >> >> >> On 18 January 2012 21:43, Martin Pala <[email protected]> wrote: >> You can add the unmonitor/monitor of the given service to the logrotation >> script, for example: >> >> prerotate >> /usr/bin/monit unmonitor firebirdlog >> endscript >> postrotate >> /usr/bin/monit monitor firebirdlog >> endscript >> >> >> Regards, >> Martin >> >> >> On Jan 18, 2012, at 4:48 PM, Nick Upson wrote: >> >>> This seems to be what I want but is considered a syntax error, is there >>> another way to achieve the same thing >>> >>> check file firebirdlog with path /var/log/firebird/firebird.log >>> if changed timestamp and size > 0 then alert >>> >>> Nick Upson >>> >>> >>> >>> On 18 January 2012 10:01, Nick Upson <[email protected]> wrote: >>> The complication I need to handle is that when this file is logrotated it >>> should not alert me >>> Nick Upson >>> >>> >>> >>> >>> On 18 January 2012 09:51, Nick Upson <[email protected]> wrote: >>> Hi, >>> >>> Access: 2012-01-16 23:55:16.000000000 +0000 >>> Modify: 2012-01-16 23:55:16.000000000 +0000 >>> Change: 2012-01-18 09:45:01.000000000 +0000 >>> >>> That's it then, the ctime is changing, which is wierd because there is no >>> change to the file itself. I need another way to be alerted when the file >>> changes, MD5sum perhaps >>> >>> Nick Upson >>> >>> >>> >>> >>> On 17 January 2012 21:49, Martin Pala <[email protected]> wrote: >>> Hi, >>> >>> can you get the "stat" output for that file? Monit tests the mtime (content >>> modification time) and ctime (inode modification time - owner, permission, >>> etc.), the event is generated if one of them changed. The "ls" won't >>> display ctime by default, to display the ctime with ls, you can use: "ls >>> -lc" >>> >>> Regards, >>> Martin >>> >>> >>> >>> On Jan 17, 2012, at 5:39 PM, Nick Upson wrote: >>> >>> > Hi, >>> > >>> > I continue to get alerts from the config entry below even when the file >>> > hasn't changed, it doesn't happen every cycle either. >>> > The log extract below it changing yet the file hasn't changed since 16:14 >>> > >>> > check file firebirdlog with path /var/log/firebird/firebird.log >>> > if changed timestamp then alert >>> > >>> > [GMT Jan 17 16:20:33] debug : 'firebirdlog' file exists check succeeded >>> > [GMT Jan 17 16:20:33] debug : 'firebirdlog' is a regular file >>> > [GMT Jan 17 16:20:33] error : 'firebirdlog' timestamp was changed for >>> > /var/log/firebird/firebird.log >>> > [GMT Jan 17 16:23:05] debug : 'firebirdlog' file exists check succeeded >>> > [GMT Jan 17 16:23:05] debug : 'firebirdlog' is a regular file >>> > [GMT Jan 17 16:23:05] debug : 'firebirdlog' timestamp was not changed >>> > for /var/log/firebird/firebird.log >>> > [GMT Jan 17 16:23:05] info : 'firebirdlog' timestamp was not changed >>> > for /var/log/firebird/firebird.log >>> > [GMT Jan 17 16:25:37] debug : 'firebirdlog' file exists check succeeded >>> > [GMT Jan 17 16:25:37] debug : 'firebirdlog' is a regular file >>> > [GMT Jan 17 16:25:37] error : 'firebirdlog' timestamp was changed for >>> > /var/log/firebird/firebird.log >>> > [GMT Jan 17 16:28:09] debug : 'firebirdlog' file exists check succeeded >>> > [GMT Jan 17 16:28:09] debug : 'firebirdlog' is a regular file >>> > [GMT Jan 17 16:28:09] debug : 'firebirdlog' timestamp was not changed >>> > for /var/log/firebird/firebird.log >>> > [GMT Jan 17 16:28:09] info : 'firebirdlog' timestamp was not changed >>> > for /var/log/firebird/firebird.log >>> > [GMT Jan 17 16:30:41] debug : 'firebirdlog' file exists check succeeded >>> > [GMT Jan 17 16:30:41] debug : 'firebirdlog' is a regular file >>> > [GMT Jan 17 16:30:41] error : 'firebirdlog' timestamp was changed for >>> > /var/log/firebird/firebird.log >>> > [GMT Jan 17 16:33:13] debug : 'firebirdlog' file exists check succeeded >>> > [GMT Jan 17 16:33:13] debug : 'firebirdlog' is a regular file >>> > [GMT Jan 17 16:33:13] debug : 'firebirdlog' timestamp was not changed >>> > for /var/log/firebird/firebird.log >>> > [GMT Jan 17 16:33:13] info : 'firebirdlog' timestamp was not changed >>> > for /var/log/firebird/firebird.log >>> > [GMT Jan 17 16:35:45] debug : 'firebirdlog' file exists check succeeded >>> > [GMT Jan 17 16:35:45] debug : 'firebirdlog' is a regular file >>> > [GMT Jan 17 16:35:45] error : 'firebirdlog' timestamp was changed for >>> > /var/log/firebird/firebird.log >>> > >>> > Nick Upson >>> > >>> > -- >>> > To unsubscribe: >>> > https://lists.nongnu.org/mailman/listinfo/monit-general >>> >>> >>> -- >>> To unsubscribe: >>> https://lists.nongnu.org/mailman/listinfo/monit-general >>> >>> >>> >>> -- >>> To unsubscribe: >>> https://lists.nongnu.org/mailman/listinfo/monit-general >> >> >> -- >> To unsubscribe: >> https://lists.nongnu.org/mailman/listinfo/monit-general >> >> -- >> To unsubscribe: >> https://lists.nongnu.org/mailman/listinfo/monit-general > > > -- > To unsubscribe: > https://lists.nongnu.org/mailman/listinfo/monit-general > > -- > To unsubscribe: > https://lists.nongnu.org/mailman/listinfo/monit-general
-- To unsubscribe: https://lists.nongnu.org/mailman/listinfo/monit-general
