Monit sends email after “sheduled downtime” but shouldnt

[Gabriel Kantelhardt]

im testing Monit at the moment for a simple check: monitoring ssh logins. My plan is to monitor ssh logins at the weekend or after the work hours. I created a configuration file for a test check:

check file ssh_logins with path /var/log/messages
not every "* 14 * * *"
if match "Accepted keyboard-interactive/pam" then alert

For the test, im not interested in any ssh logins at 2PM so Monit dont notify me. BUT when the "downtime" ends, Monit send me an email with all ssh logins that happend at 2PM. Is there a way to turn it off ? Monit should start after the "downtime" at the end of the messages log.

Thanks for your help

Shifty

---

[Lutz Mader]

Hello Gabriel,
it does not work, see
https://mmonit.com/monit/documentation/monit.html#SERVICE-POLL-TIME

The (not) every rule (disables) enables the monitoring for a given time
interval. You disable the file check for a hour, but monit knows the
last checked line and restart the check at this line.

> check file ssh_logins with path /var/log/messages
> not every "* 14 * * *"
> if match "Accepted keyboard-interactive/pam" then alert

Sorry,
Lutz