monit-general
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: file changed timestamp


From: Martin Pala
Subject: Re: file changed timestamp
Date: Fri, 20 Jan 2012 10:10:55 +0100

The combo rule which will consists of multiple tests can be supported in the future - we're refactoring the monit check engine to allow more flexible tests.


On Jan 20, 2012, at 10:01 AM, Nick Upson wrote:

the filesystem I use is ext3 (Centos)

that looks very useful but how about also allowing multiple tests so something like this would work

if changed and size > 0 then alert


Nick Upson



On 20 January 2012 08:41, Martin Pala <address@hidden> wrote:
We can add an option for the tmestamp test, which can allow to restrict the timestamp test to ctime or mtime only instead of the current ctime||mtime.

=> the syntax could be something like this:

    IF CHANGED [CONTENT | INODE] TIMESTAMP THEN <ACTION>

and usage examples: 

1.) test ctime or mtime changes (current behavior):
    if changed timestamp then …

2.) test mtime only:
    if changed content timestamp …

3.) test ctime only:
    if changed inode timestamp … 


I think the ctime could be changed by some backup program (for example Veritas/Symantec Netbackup and Legato/EMC Networker can use ctime for backup - both of them optionally allow to disable the ctime modification). Do you use some backup program which can use ctime like this? If not, which filesystem do you use?

Regards,
Martin


On Jan 19, 2012, at 11:58 AM, Nick Upson wrote:

thank you, I can see that would work but the logrotate is for *.log. I would really prefer to implement this within monit.

I'm a little surprised that no-one else has had this requirement before.
 
Nick Upson



On 18 January 2012 21:43, Martin Pala <address@hidden> wrote:
You can add the unmonitor/monitor of the given service to the logrotation script, for example:

prerotate
/usr/bin/monit unmonitor firebirdlog
endscript
postrotate
/usr/bin/monit monitor firebirdlog
endscript


Regards,
Martin


On Jan 18, 2012, at 4:48 PM, Nick Upson wrote:

This seems to be what I want but is considered a syntax error, is there another way to achieve the same thing

check file firebirdlog with path /var/log/firebird/firebird.log
if changed timestamp and size > 0 then alert

Nick Upson



On 18 January 2012 10:01, Nick Upson <address@hidden> wrote:
The complication I need to handle is that when this file is logrotated it should not alert me
Nick Upson




On 18 January 2012 09:51, Nick Upson <address@hidden> wrote:
Hi,

Access: 2012-01-16 23:55:16.000000000 +0000
Modify: 2012-01-16 23:55:16.000000000 +0000
Change: 2012-01-18 09:45:01.000000000 +0000

That's it then, the ctime is changing, which is wierd because there is no change to the file itself. I need another way to be alerted when the file changes, MD5sum perhaps

Nick Upson




On 17 January 2012 21:49, Martin Pala <address@hidden> wrote:
Hi,

can you get the "stat" output for that file? Monit tests the mtime (content modification time) and ctime (inode modification time - owner, permission, etc.), the event is generated if one of them changed. The "ls" won't display ctime by default, to display the ctime with ls, you can use: "ls -lc"

Regards,
Martin



On Jan 17, 2012, at 5:39 PM, Nick Upson wrote:

> Hi,
>
> I continue to get alerts from the config entry below even when the file hasn't changed, it doesn't happen every cycle either.
> The log extract below it changing yet the file hasn't changed since 16:14
>
> check file firebirdlog with path /var/log/firebird/firebird.log
> if changed timestamp then alert
>
> [GMT Jan 17 16:20:33] debug    : 'firebirdlog' file exists check succeeded
> [GMT Jan 17 16:20:33] debug    : 'firebirdlog' is a regular file
> [GMT Jan 17 16:20:33] error    : 'firebirdlog' timestamp was changed for /var/log/firebird/firebird.log
> [GMT Jan 17 16:23:05] debug    : 'firebirdlog' file exists check succeeded
> [GMT Jan 17 16:23:05] debug    : 'firebirdlog' is a regular file
> [GMT Jan 17 16:23:05] debug    : 'firebirdlog' timestamp was not changed for /var/log/firebird/firebird.log
> [GMT Jan 17 16:23:05] info     : 'firebirdlog' timestamp was not changed for /var/log/firebird/firebird.log
> [GMT Jan 17 16:25:37] debug    : 'firebirdlog' file exists check succeeded
> [GMT Jan 17 16:25:37] debug    : 'firebirdlog' is a regular file
> [GMT Jan 17 16:25:37] error    : 'firebirdlog' timestamp was changed for /var/log/firebird/firebird.log
> [GMT Jan 17 16:28:09] debug    : 'firebirdlog' file exists check succeeded
> [GMT Jan 17 16:28:09] debug    : 'firebirdlog' is a regular file
> [GMT Jan 17 16:28:09] debug    : 'firebirdlog' timestamp was not changed for /var/log/firebird/firebird.log
> [GMT Jan 17 16:28:09] info     : 'firebirdlog' timestamp was not changed for /var/log/firebird/firebird.log
> [GMT Jan 17 16:30:41] debug    : 'firebirdlog' file exists check succeeded
> [GMT Jan 17 16:30:41] debug    : 'firebirdlog' is a regular file
> [GMT Jan 17 16:30:41] error    : 'firebirdlog' timestamp was changed for /var/log/firebird/firebird.log
> [GMT Jan 17 16:33:13] debug    : 'firebirdlog' file exists check succeeded
> [GMT Jan 17 16:33:13] debug    : 'firebirdlog' is a regular file
> [GMT Jan 17 16:33:13] debug    : 'firebirdlog' timestamp was not changed for /var/log/firebird/firebird.log
> [GMT Jan 17 16:33:13] info     : 'firebirdlog' timestamp was not changed for /var/log/firebird/firebird.log
> [GMT Jan 17 16:35:45] debug    : 'firebirdlog' file exists check succeeded
> [GMT Jan 17 16:35:45] debug    : 'firebirdlog' is a regular file
> [GMT Jan 17 16:35:45] error    : 'firebirdlog' timestamp was changed for /var/log/firebird/firebird.log
>
> Nick Upson
>
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general


--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general



--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general


--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general

--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general


--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general

--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general


reply via email to

[Prev in Thread] Current Thread [Next in Thread]