|
From: | Martin Pala |
Subject: | Re: Monitoring one of two files? |
Date: | Fri, 23 Feb 2007 13:52:55 +0100 |
User-agent: | Thunderbird 1.5.0.9 (Windows/20061207) |
Josh Kelley wrote:
ClamAV 0.90, from what I can tell, stores its daily updates in one of two ways: as a single file, /var/lib/clamav/daily.cvd, or as several files under /var/lib/clamav/daily.inc. How can I instruct Monit to check for both of those files and only complain if both are missing? At first I thought that it might work to do something similar to the following: check file clamav_daily_cvd with path /var/lib/clamav/daily.cvd if failed then exec "/bin/bash -c '/usr/bin/monit unmonitor clamav_daily_cvd; /usr/bin/monit monitor clamav_daily_inc'" check file clamav_daily_inc with path /var/lib/clamav/daily.inc/daily.info if failed then exec "/bin/bash -c '/usr/bin/monit unmonitor clamav_daily_inc; /usr/bin/monit monitor clamav_daily_cvd'" However, I can't find any way to define a custom exec action if the file doesn't exist at all, as opposed to existing but failing UID/GID/checksum/etc. checks. Any suggestions? Josh Kelley
Hi,the implicit action when the file is missing is to perform restart, provided there are start and stop methods defined (otherwise just alert) => you can move the exec body to the start/stop programs.
The implicit event handlers are initialized in p.y. Some of them can be overridden already (for example PID, PPID and FSFLAG), others (including NONEXIST) are not exposed:
--8<-- /* Initialize general event handlers */addeventaction(&(current)->action_DATA, ACTION_ALERT, ACTION_ALERT); addeventaction(&(current)->action_EXEC, ACTION_ALERT, ACTION_ALERT); addeventaction(&(current)->action_INVALID, ACTION_RESTART, ACTION_ALERT); addeventaction(&(current)->action_NONEXIST, ACTION_RESTART, ACTION_ALERT); addeventaction(&(current)->action_TIMEOUT, ACTION_UNMONITOR, ACTION_ALERT); addeventaction(&(current)->action_PID, ACTION_ALERT, ACTION_IGNORE); addeventaction(&(current)->action_PPID, ACTION_ALERT, ACTION_IGNORE); addeventaction(&(current)->action_FSFLAG, ACTION_ALERT, ACTION_IGNORE);
--8<--It could be possible to allow the user to change the default behavior when needed, the change could be quite simple (just the configuration parser hack).
We can implement it in the future - currently it is important for us to release the M/Monit which we are working on.
If anybody want's to try to implement it, patches are welcomed :) Martin
[Prev in Thread] | Current Thread | [Next in Thread] |