"check file" not working as expected

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

"check file" not working as expected

Tim.Einmahl
Hi,

we use monit to monitor application logfiles for certain strings like that:

check file appl1-log with path /some/where/appl1-log
if match "whatever" then alert

In case of a database maintenance, we set any of these to "unmonitor", e.g. "monit unmonitor appl1-log", so that we don't get flooded unnecessarily with unwanted mails. That works.

But if we monitor them again after maintenance is finished, then we always get a mail for matches that were found in the meantime. I expected the search to be started at the end of the file when running "monit monitor appl1-log". How can I achieve that?

Regards
Tim



--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general
Reply | Threaded
Open this post in threaded view
|

Re: "check file" not working as expected

Guillaume François
Hi,

If I remember well, file content testing is incremental. 

So when you unmonitor when the last read line is set to, let's say line 123
Then alerting content is written in the file to line 1456 and 1754 during its lifetime while it is unmonitored.

When file is at line 2000, you monitor it again then Monit resume to line 1234 and found occurrence at line 1456 and 1754.

I suppose Monit store the line pointer to its state file and I'm not aware of a way to modify its binary content.

Unfortunately, it seems that the default, and only, Monit behavior is not matching your need. Martin could probably confirm it ?

Best is to ask for an improvement to be able to specify where to resume the file content check:
  • last read line
  • end of the file
  • first line
Again, it is based on my memory. It could have changed or be wrong from the start.

Best Regards.


2017-02-23 15:58 GMT+01:00 <[hidden email]>:
Hi,

we use monit to monitor application logfiles for certain strings like that:

check file appl1-log with path /some/where/appl1-log
if match "whatever" then alert

In case of a database maintenance, we set any of these to "unmonitor", e.g. "monit unmonitor appl1-log", so that we don't get flooded unnecessarily with unwanted mails. That works.

But if we monitor them again after maintenance is finished, then we always get a mail for matches that were found in the meantime. I expected the search to be started at the end of the file when running "monit monitor appl1-log". How can I achieve that?

Regards
Tim



--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general



--
-----BEGIN GEEK CODE BLOCK-----
Version: 3.1
GCS/IT d(+) s++:- a C++$ ULC(+)>+++$ !P--- L+>$ !E---? W+++$ !N* !o-- K--? w(+) !O---? !M- !V--? PS+? !PE Y+ PGP++>+++ !t-- !5 !X- R(+)>++* tv-? b(-) DI !D- G(+)>+ e+++ h--() r->$ y?*
------END GEEK CODE BLOCK------

--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general
Reply | Threaded
Open this post in threaded view
|

Re: "check file" not working as expected

martinp@tildeslash.com
In reply to this post by Tim.Einmahl
Hi Tim,

this problem is fixed in the upcoming Monit release (5.21.0): https://bitbucket.org/tildeslash/monit/issues/547/monit-check-file-do-not-read-file-content

Best regards,
Martin


> On 23 Feb 2017, at 15:58, <[hidden email]> <[hidden email]> wrote:
>
> Hi,
>
> we use monit to monitor application logfiles for certain strings like that:
>
> check file appl1-log with path /some/where/appl1-log
> if match "whatever" then alert
>
> In case of a database maintenance, we set any of these to "unmonitor", e.g. "monit unmonitor appl1-log", so that we don't get flooded unnecessarily with unwanted mails. That works.
>
> But if we monitor them again after maintenance is finished, then we always get a mail for matches that were found in the meantime. I expected the search to be started at the end of the file when running "monit monitor appl1-log". How can I achieve that?
>
> Regards
> Tim
>
>
>
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general


--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general