Monit sends email after “sheduled downtime” but shouldnt

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

Monit sends email after “sheduled downtime” but shouldnt

Gabriel Kantelhardt

im testing Monit at the moment for a simple check: monitoring ssh logins. My plan is to monitor ssh logins at the weekend or after the work hours. I created a configuration file for a test check:

check file ssh_logins with path /var/log/messages
not every "* 14 * * *"
if match "Accepted keyboard-interactive/pam" then alert

For the test, im not interested in any ssh logins at 2PM so Monit dont notify me. BUT when the "downtime" ends, Monit send me an email with all ssh logins that happend at 2PM. Is there a way to turn it off ? Monit should start after the "downtime" at the end of the messages log.

Thanks for your help


Shifty



Reply | Threaded
Open this post in threaded view
|

Re: Monit sends email after “sheduled downtime” but shouldnt

Lutz Mader
Hello Gabriel,
it does not work, see
https://mmonit.com/monit/documentation/monit.html#SERVICE-POLL-TIME

The (not) every rule (disables) enables the monitoring for a given time
interval. You disable the file check for a hour, but monit knows the
last checked line and restart the check at this line.

> check file ssh_logins with path /var/log/messages
> not every "* 14 * * *"
> if match "Accepted keyboard-interactive/pam" then alert

Sorry,
Lutz