check file - if match

[Martin Sebald]

Hello,

I'm having trouble with the check file and there with the if match function.

I try to detect a line like the following from /var/log/auth.log:

Aug  6 00:56:22 server saslauthd[17074]: DEBUG: auth_pam: pam_authenticate
failed: Memory buffer error

The config of monit looks like this:

check file saslauthd_log with path /var/log/auth.log
   group mail
   group saslauthd
   start program = "/etc/init.d/saslauthd start"
   stop  program = "/etc/init.d/saslauthd stop"
   if match "Memory buffer error" then restart
   if 5 restarts with 5 cycles then timeout
   depends on saslauthd_bin
   depends on saslauthd_rc

Nothing happens... I also tried to put in real simple stuff like parts of mail
addresses, no special characters like - oder ., just a-z, nothing else.
Nothing happened there as well.

Is only the very last line of the log analyzed or all lines since the last 
check?

I'm sure I do not understand how to use it and I am looking for help... ;-)

Cheers,
Martin