I finally discovered the cause of this issue. To recap:
Since upgrading several servers from
monit 5.3 to
monit 5.5, all
monit alerts are coming in with "localhost" as the hostname instead of the actual hostname, making it impossible to tell which servers the alerts are originating from.
As it turns out, this seems to be due to a new feature of monit 5.5, whereby if there is a "check system sysname" check defined, then the hostname supplied for "sysname" overrides anything found in /etc/hosts. etc.
This is *hugely* inconvenient, as I have a whole fleet of servers that have a "check system localhost" check defined. After upgrading, they now all report "localhost" as the hostname.
I consider this a compatibility-breaking change, and one which should require an explicit accompanying option be enabled in monit.conf.
All my servers are using an identical configuration for these checks, and requiring them all to now be updated with unique checks is unnecessarily burdonsome. The original method of using the host's actual hostname was working splendidly, so why change that? Especially in a manner that breaks existing installations?
Please consider reverting this feature, or requiring that it be explicitly enabled, in a future release.
Sam