Re: Monitoring one of two files?

[Martin Pala]

Josh Kelley wrote:
> ClamAV 0.90, from what I can tell, stores its daily updates in one of
> two ways: as a single file, /var/lib/clamav/daily.cvd, or as several
> files under /var/lib/clamav/daily.inc.
>
> How can I instruct Monit to check for both of those files and only
> complain if both are missing?  At first I thought that it might work
> to do something similar to the following:
>
> check file clamav_daily_cvd with path /var/lib/clamav/daily.cvd
>   if failed then exec "/bin/bash -c '/usr/bin/monit unmonitor
> clamav_daily_cvd; /usr/bin/monit monitor clamav_daily_inc'"
>
> check file clamav_daily_inc with path /var/lib/clamav/daily.inc/daily.info
>   if failed then exec "/bin/bash -c '/usr/bin/monit unmonitor
> clamav_daily_inc; /usr/bin/monit monitor clamav_daily_cvd'"
>
> However, I can't find any way to define a custom exec action if the
> file doesn't exist at all, as opposed to existing but failing
> UID/GID/checksum/etc. checks.
>
> Any suggestions?
>
> Josh Kelley

Hi,

the implicit action when the file is missing is to perform restart, 
provided there are start and stop methods defined (otherwise just alert) 
=> you can move the exec body to the start/stop programs.

The implicit event handlers are initialized in p.y. Some of them can be 
overridden already (for example PID, PPID and FSFLAG), others (including 
NONEXIST) are not exposed:

--8<--
  /* Initialize general event handlers */
  addeventaction(&(current)->action_DATA,     ACTION_ALERT, 
ACTION_ALERT);
  addeventaction(&(current)->action_EXEC,     ACTION_ALERT, 
ACTION_ALERT);
  addeventaction(&(current)->action_INVALID,  ACTION_RESTART, 
ACTION_ALERT);
  addeventaction(&(current)->action_NONEXIST, ACTION_RESTART, 
ACTION_ALERT);
  addeventaction(&(current)->action_TIMEOUT,  ACTION_UNMONITOR, 
ACTION_ALERT);
  addeventaction(&(current)->action_PID,      ACTION_ALERT, 
ACTION_IGNORE);
  addeventaction(&(current)->action_PPID,     ACTION_ALERT, 
ACTION_IGNORE);
  addeventaction(&(current)->action_FSFLAG,   ACTION_ALERT, 
ACTION_IGNORE);
--8<--


It could be possible to allow the user to change the default behavior 
when needed, the change could be quite simple (just the configuration 
parser hack).

We can implement it in the future - currently it is important for us to 
release the M/Monit which we are working on.

If anybody want's to try to implement it, patches are welcomed :)


Martin