[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Monitoring one of two files?

From: Martin Pala
Subject: Re: Monitoring one of two files?
Date: Fri, 23 Feb 2007 13:52:55 +0100
User-agent: Thunderbird (Windows/20061207)

Josh Kelley wrote:
ClamAV 0.90, from what I can tell, stores its daily updates in one of
two ways: as a single file, /var/lib/clamav/daily.cvd, or as several
files under /var/lib/clamav/

How can I instruct Monit to check for both of those files and only
complain if both are missing?  At first I thought that it might work
to do something similar to the following:

check file clamav_daily_cvd with path /var/lib/clamav/daily.cvd
  if failed then exec "/bin/bash -c '/usr/bin/monit unmonitor
clamav_daily_cvd; /usr/bin/monit monitor clamav_daily_inc'"

check file clamav_daily_inc with path /var/lib/clamav/
  if failed then exec "/bin/bash -c '/usr/bin/monit unmonitor
clamav_daily_inc; /usr/bin/monit monitor clamav_daily_cvd'"

However, I can't find any way to define a custom exec action if the
file doesn't exist at all, as opposed to existing but failing
UID/GID/checksum/etc. checks.

Any suggestions?

Josh Kelley


the implicit action when the file is missing is to perform restart, provided there are start and stop methods defined (otherwise just alert) => you can move the exec body to the start/stop programs.

The implicit event handlers are initialized in p.y. Some of them can be overridden already (for example PID, PPID and FSFLAG), others (including NONEXIST) are not exposed:

  /* Initialize general event handlers */
addeventaction(&(current)->action_DATA, ACTION_ALERT, ACTION_ALERT); addeventaction(&(current)->action_EXEC, ACTION_ALERT, ACTION_ALERT); addeventaction(&(current)->action_INVALID, ACTION_RESTART, ACTION_ALERT); addeventaction(&(current)->action_NONEXIST, ACTION_RESTART, ACTION_ALERT); addeventaction(&(current)->action_TIMEOUT, ACTION_UNMONITOR, ACTION_ALERT); addeventaction(&(current)->action_PID, ACTION_ALERT, ACTION_IGNORE); addeventaction(&(current)->action_PPID, ACTION_ALERT, ACTION_IGNORE); addeventaction(&(current)->action_FSFLAG, ACTION_ALERT, ACTION_IGNORE);

It could be possible to allow the user to change the default behavior when needed, the change could be quite simple (just the configuration parser hack).

We can implement it in the future - currently it is important for us to release the M/Monit which we are working on.

If anybody want's to try to implement it, patches are welcomed :)


reply via email to

[Prev in Thread] Current Thread [Next in Thread]