limit check file alerts

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

limit check file alerts

Marc Rossi
I have a process that creates a logfile named "/var/log/foo-YYYYMMDD-HHMMSS.log" at startup. To simplify things I create a soft-link to the latest file named "/var/log/foo.log".

Whenever the process is restarted it deletes the soft-link (since it is pointing to a file that is no longer current). I have the following "check file" setup to re-create that soft-link and start monitoring the file. Only problem is it still generates a "file doesn't exist" event after 3 cycles before creating the soft-link and a "file exists" event.

check file foo.log with path /var/log/foo.log
      if not exist for 3 cycles then exec "/bin/bash -c 'ln -s `ls -t /var/log/foo-*.*.log|head -n1` /var/log/foo.log'"
      if content != "\[INFO\]" then alert
      group foo

Any ideas on how to prevent the initial "file doesn't exist" event?

(just to eliminate one of obvious solutions. the soft link cannot be created from the startup script in between unmonitor/monitor commands to foo.log as I don't control the app startup. the foo.log entry stays monitored 24x7 as the soft-link is not deleted at app shutdown which keeps things simple)

Marc

--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general
Reply | Threaded
Open this post in threaded view
|

Re: limit check file alerts

Tino Hendricks
Marc,

just a simple thought: Define this check with a „noalert“ statement and define an additional one with softer criterions (like „… for 5 cycles…“) which does real alerts?

Cheers!

Tino

> Am 22.03.2019 um 22:46 schrieb Marc Rossi <[hidden email]>:
>
> I have a process that creates a logfile named "/var/log/foo-YYYYMMDD-HHMMSS.log" at startup. To simplify things I create a soft-link to the latest file named "/var/log/foo.log".
>
> Whenever the process is restarted it deletes the soft-link (since it is pointing to a file that is no longer current). I have the following "check file" setup to re-create that soft-link and start monitoring the file. Only problem is it still generates a "file doesn't exist" event after 3 cycles before creating the soft-link and a "file exists" event.
>
> check file foo.log with path /var/log/foo.log
>       if not exist for 3 cycles then exec "/bin/bash -c 'ln -s `ls -t /var/log/foo-*.*.log|head -n1` /var/log/foo.log'"
>       if content != "\[INFO\]" then alert
>       group foo
>
> Any ideas on how to prevent the initial "file doesn't exist" event?
>
> (just to eliminate one of obvious solutions. the soft link cannot be created from the startup script in between unmonitor/monitor commands to foo.log as I don't control the app startup. the foo.log entry stays monitored 24x7 as the soft-link is not deleted at app shutdown which keeps things simple)
>
> Marc
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general


--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general
Reply | Threaded
Open this post in threaded view
|

Re: limit check file alerts

Marc Rossi
Thanks for the idea Tino. Unfortunately I don't think that will work as I'm trying to limit the alerts sent to m/monit and I'm not sure what email address to include on the noalert clause to do that (looks like the syntax is "NOALERT <email adddress>".

Seems wrong that in the monit config I can say "if not exists <do something other than alert>" and it still alerts that it doesn't exist.

On Mon, Mar 25, 2019 at 7:10 AM Tino Hendricks <[hidden email]> wrote:
Marc,

just a simple thought: Define this check with a „noalert“ statement and define an additional one with softer criterions (like „… for 5 cycles…“) which does real alerts?

Cheers!

Tino

> Am 22.03.2019 um 22:46 schrieb Marc Rossi <[hidden email]>:
>
> I have a process that creates a logfile named "/var/log/foo-YYYYMMDD-HHMMSS.log" at startup. To simplify things I create a soft-link to the latest file named "/var/log/foo.log".
>
> Whenever the process is restarted it deletes the soft-link (since it is pointing to a file that is no longer current). I have the following "check file" setup to re-create that soft-link and start monitoring the file. Only problem is it still generates a "file doesn't exist" event after 3 cycles before creating the soft-link and a "file exists" event.
>
> check file foo.log with path /var/log/foo.log
>       if not exist for 3 cycles then exec "/bin/bash -c 'ln -s `ls -t /var/log/foo-*.*.log|head -n1` /var/log/foo.log'"
>       if content != "\[INFO\]" then alert
>       group foo
>
> Any ideas on how to prevent the initial "file doesn't exist" event?
>
> (just to eliminate one of obvious solutions. the soft link cannot be created from the startup script in between unmonitor/monitor commands to foo.log as I don't control the app startup. the foo.log entry stays monitored 24x7 as the soft-link is not deleted at app shutdown which keeps things simple)
>
> Marc
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general


--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general

--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general