If I remember well, file content testing is incremental.
So when you unmonitor when the last read line is set to, let's say line 123
Then alerting content is written in the file to line 1456 and 1754 during its lifetime while it is unmonitored.
When file is at line 2000, you monitor it again then Monit resume to line 1234 and found occurrence at line 1456 and 1754.
I suppose Monit store the line pointer to its state file and I'm not aware of a way to modify its binary content.
Unfortunately, it seems that the default, and only, Monit behavior is not matching your need. Martin could probably confirm it ?
Best is to ask for an improvement to be able to specify where to resume the file content check:
- last read line
- end of the file
- first line
Again, it is based on my memory. It could have changed or be wrong from the start.