Re: Monitoring /dev/log?

[mad]

I tried monitoring rsyslog with the following syntax

===============================================================================
check process rsyslog with pidfile /var/run/syslogd.pid
    start program = "/sbin/service rsyslog start"
    stop  program = "/sbin/service rsyslog stop"
    if failed unixsocket /dev/log type udp then restart
    [...]
===============================================================================

and I restarted monit several times. Still I got the strace output from
below.

Following is the output of starting monit with the above configuration
with "monit -I -v". It tries to use protocol "DEFAULT".

===============================================================================
The service list contains the following entries:

Process Name          = rsyslog
 Group                = system
 Pid file             = /var/run/syslogd.pid
 Monitoring mode      = active
 Start program        = '/sbin/service rsyslog start' timeout 30 second(s)
 Stop program         = '/sbin/service rsyslog stop' timeout 30 second(s)
 Depends on Service   = rsyslog_conf
 Depends on Service   = rsyslog_bin
 Depends on Service   = rsyslog_init
 Pid                  = if changed 1 times within 1 cycle(s) then alert
 Ppid                 = if changed 1 times within 1 cycle(s) then alert
 Unix Socket          = if failed /dev/log [protocol DEFAULT] with
timeout 5 seconds 1 times within 1 cycle(s) then restart else if
succeeded 1 times within 1 cycle(s) then alert
 Timeout              = If restarted 5 times within 5 cycle(s) then
unmonitor

File Name             = rsyslog_init
 Group                = system
 Path                 = /etc/init.d/rsyslog
 Monitoring mode      = active

File Name             = rsyslog_bin
 Group                = system
 Path                 = /sbin/rsyslogd
 Monitoring mode      = active

File Name             = rsyslog_conf
 Group                = system
 Path                 = /etc/rsyslog.conf
 Monitoring mode      = active

System Name           = XXX
 Monitoring mode      = active

-------------------------------------------------------------------------------
monit: pidfile '/var/run/monit.pid' does not exist
Starting monit HTTP server at [*:19100]
monit HTTP server started
'scp-test-sl60' Monit started
'rsyslog_init' file existence check succeeded
'rsyslog_init' is a regular file
'rsyslog_bin' file existence check succeeded
'rsyslog_bin' is a regular file
'rsyslog_conf' file existence check succeeded
'rsyslog_conf' is a regular file
'rsyslog' zombie check succeeded [status_flag=0000]
'rsyslog' failed, cannot open a connection to UNIX[/dev/log]
'rsyslog' trying to restart
===============================================================================

The monit version is: monit-5.1.1-2.el6.i686

Regards,
Marc

Am 18.07.2011 16:44, schrieb Martin Pala:
> The STREAM socket is still tried ... you need to add the mentioned "type udp" 
> option to the "if failed unixsocket ..." test and reload monit to reflect the 
> new configuration:
> 
>     monit reload
> 
> 
> Regards,
> Martin
> 
> 
> 
> On Jul 18, 2011, at 3:59 PM, mad wrote:
> 
>> Am 18.07.2011 15:23, schrieb Aleksandrov Artyom:
>>> Hi, I wrote about same problem with syslog-ng
>>> http://lists.nongnu.org/archive/html/monit-dev/2011-06/msg00026.html
>>> It not works for me, if I use
>>>               if failed unixsocket /dev/log type udp then restart
>>
>> I have the same problem. I now use the line with 'udp' and strace shows
>> a stream connection.
>>
>> gettimeofday({1310997069, 22086}, NULL) = 0
>> socket(PF_FILE, SOCK_STREAM, 0)         = 5
>> fcntl64(5, F_GETFL)                     = 0x2 (flags O_RDWR)
>> fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
>> connect(5, {sa_family=AF_FILE, path="/dev/log"}, 110) = -1 EPROTOTYPE
>> (Protocol wrong type for socket)
>> shutdown(5, 2 /* send and receive */)   = 0
>> close(5)                                = 0
>>
>> BTW, monit is configured to use syslog. There it connects correctly. ;-)
>>
>> socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3
>> connect(3, {sa_family=AF_FILE, path="/dev/log"}, 110) = 0
>> send(3, "<14>Jul 18 13:51:08 monit[28975]"..., 74, MSG_NOSIGNAL) = 74
>>
>> Regards,
>> mad
>>
> 
> 
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general