MONIT(1) MONIT(1) Monit - (SYNOPSIS) monit [options] (DESCRIPTION) Monit . Monit . Monit . Monit (checksum) . Monit (free-format) . Monit syslog . Monit TCP/IP SSL . Monit HTTP(S) Monit . (WHAT TO MONITOR?) Monit localhost . Monit sendmail sshd apache mysql. Monit sendmail Monit sendmail apache ( DoS) Monit apache . Monit (CPU) . Monit localhost . Monit . - md5 sha1 sha256 . SHA256 . Monit localhost . TCP UDP Unix Domain Sockets . Monit HTTP SMTP . Monit . Monit cron (exit value) . Monit . Monit localhost CPU (System Load) . (GENERAL OPERATION) Monit monitrc . .monitrc . monitrc ~/.monitrc . Monit /etc/monitrc . (FILES) . -c monit . $ monit -c /var/monit/monitrc Monit : $ monit -t $ Control file syntax OK Monit . Monit Monit : $ monit . Monit . Monit . (Options) Monit . ( ) .monitrc . -c file -d n Monit n . "set daemon" monitrc. -g name start stop restart monitor unmonitor status summary. -l file . "set log" monitrc. -p pidfile . "set pidfile" monitrc. -s statefile . "set statefile" monitrc. -B ( ). "set terminal batch" monitrc. -I ( init ). "set init" monitrc. -i Monit (ID) -r Monit (ID). -t -v (verbose) ( ) -vv -v (stack-trace) -H [filename] MD5 SHA1 SHA256 (stdin) Monit -V (patch level) -h .SS " (Arguments)" Monit Monit . Monit Monit ( TCP 127.0.0.1:2812) Monit . monit Monit monit Monit . start all . (-g) ( "all" ). start . monitrc . (regex) ( ). stop all . ( "all" ). stop . monitrc . regex ( ). restart all . ( "all" ). restart . monitrc . regex ( ). monitor all . ( "all" ). monitor . monitrc . Monit . regex ( ). unmonitor all . ( "all" ). unmonitor . monitrc . Monit . regex ( ). status [name|pattern] . summary [name|pattern] . report [up | down | initialising | unmonitored | total] . . Monit . up down . reload Monit (log) . quit Monit (kill). validate . Monit . procmatch . . MONIT (THE MONIT CONTROL FILE) Monit monitrc . ~/.monitrc . Monit /etc/monitrc @sysconfdir@/monitrc ./monitrc . Monit @sysconfdir@ ./configure --sysconfdir . ./configure --sysconfdir /var/monit/etc Monit monitrc /var/monit/etc . 0700 (u=xrw,g=,o=) Monit . . Monit (DSL) . () '#' . (token) . (noise keywords) 'if' 'and' 'with(in)' 'has' 'us(ing|e)' 'on(ly)' 'then' 'for' 'of' . . . (token) : (grammar) ( ) . . ( ). / . : 1. Global set-statements set "set" . 2. Global include-statement include "include" (glob) . . 3. One or more service entry statements. "check" . (unique) . Monit . . : (Process) CHECK PROCESS | MATCHING > pid-file . pid-file (ID) . pid-file PID Monit start . PID . (uptime) . pid-file PID . "monit procmatch "regex-pattern"" . regex . (File) CHECK FILE PATH . Monit start ( ) Monit . Monit (passive) start Monit . Fifo () CHECK FIFO PATH fifo . fifo Monit start fifo ( ) Monit . Monit start Monit . (Filesystem) CHECK FILESYSTEM PATH / (mount point) NFS/CIFS/FUSE . Monit start . Monit start Monit . (Directory) CHECK DIRECTORY PATH . Monit start . monit . Monit start Monit . (Remote host) CHECK HOST ADDRESS (hostname) IP "tildeslash.com" "64.87.72.95". (System) CHECK SYSTEM unique name . $HOST . CPU (load average) . unique name M/Monit . (Program) CHECK PROGRAM PATH [TIMEOUT SECONDS] . (exit status) . Monit . (timeout) ( ) . . set limits ). (Network) CHECK NETWORK
| INTERFACE > IPv4 IPv6 . "eth0" ..SH " (LOGGING)" Monit syslog . set log monitrc . Monit set log /var/log/monit.log . set logfile . syslog "-l" set log syslog Monit syslog . log ( -l ). : [date] priority : message : [2020-08-12T16:35:00+0200] info : 'localhost' Monit started (TERMINAL OUTPUT) Monit ANSI UTF-8 . CLI -B monit : SET TERMINAL BATCH (DAEMON MODE) SET DAEMON [[WITH] START DELAY ] Monit . . Monit . "-d" ~/.monitrc set daemon . Monit . monit -d Monit . Monit . "monit" Monit . "monit" quit Monit . (start delay) . Monit . INIT (INIT SUPPORT) "set init" Monit . Monit ( "set daemon" ). Monit init . Monit init Monit Monit . Monit crontab . Monit init crontab ( "monit -t" ). Monit init "set init" Monit "-I" . "/etc/inittab" : # Run Monit in standard run-levels mo:2345:respawn:/usr/local/bin/monit -Ic /etc/monitrc init /etc/inittab Monit : telinit q telinit: kill -1 1 Monit ( rc SYSV init inittab ) (race condition) Monit . FAQ . Monit run-level ..SH " (INCLUDE FILES)" Monit "monitrc" . . Include "monitrc" . : INCLUDE globstring glob(7) . . (whitespace) globstring (') (") . globstring . include . globstring . (wild- card globbing) . : include /etc/monit.d/*.cfg globstring /etc/monit.d .cfg . include . Monit . SSL (SSL OPTIONS) SSL/TLS SSL Monit : SET [OPTIONS] { VERSION: , ... VERIFY: SELFSIGNED: CIPHERS: PEMFILE: PEMCHAIN: PEMKEY: CLIENTPEMFILE: CACERTIFICATEFILE: CACERTIFICATEPATH: } VERSION SSL/TLS . Monit AUTO . AUTO TLS 1.2 1.3 . . "-" . (Exclude): set ssl { version: auto -sslv2 -sslv3 -tlsv1 -tlsv11 } : set ssl { version: tlsv12 tlsv13 } VERIFY SSL . . Monit . SELFSIGNED (self- signed) . . : (man-in- the-middle) (DNS hijacking) . CIPHERS (ciphers) SSL/TLS . PEMFILE " " SSL PEM . HTTP Monit . PEMFILE PEMCHAIN PEMKEY SSL PEM . HTTP Monit . CLIENTPEMFILE SSL PEM . . CACERTIFICATEFILE PEM (CA) . Monit CA OpenSSL ( openssl version -d CA ). SSL CA . CACERTIFICATEPATH (CA) . Monit CA OpenSSL . SSL CA . SSL SSL/TLS Monit . SSL mailserver mmonit . SSL .monitrc : set ssl options {...} SSL : # Enable certificate verification for all SSL connections # Self-signed certificates are not allowed by default set ssl options { verify: enable } # Verify certificate (via global setting) # Allow self-signed certificate for this check check host example with address example.com if failed port 443 protocol https with ssl options {selfsigned: allow} then alert # Do not verify example2.com's certificate (override global setting) check host example2 with address example2.com if failed port 443 protocol https with ssl options {verify: disable} then alert FIPS ( OpenSSL ) Monit : SET FIPS MONIT HTTPD (MONIT HTTPD) Monit HTTP . CLI Monit . HTTP (Unix Socket) TCP Monit . HTTP CLI Monit CLI ( "monit status") Monit HTTP . HTTP . HTTP localhost (bind) Unix Socket Monit . (UNIX SOCKET) Unix Socket: SET HTTPD UNIXSOCKET [UID ] [GID ] [PERMISSION ] ALLOW + : set httpd unixsocket /var/run/monit.sock allow username:password UNIXSOCKET Unix Socket Monit (bind) (listen) . UID ( Monit ). GID ( Monit ). PERMISSION - (octal) ( UMASK ). TCP (TCP PORT) TCP: SET HTTPD PORT [ADDRESS ] [[with] SSL {pemfile: }] ALLOW + PORT Monit . Monit 2812 . : set httpd port 2812 allow username:password Monit . "p@ssw:r#" . ADDRESS Monit . Monit localhost . ADDRESS Monit : set httpd port 2812 use address 127.0.0.1 allow username:password HTTP Monit TCP IP 4 6 . . address : set httpd port 2812 allow ... Monit IPv4 IPv6 2812 . HTTP Monit IP 6 IPv6 : set httpd port 2812 use address "fe80::222:19ff:fe53:6c59" allow ... HTTP Monit IP 4 IPv4 : set httpd port 2812 use address 62.109.39.247 allow ... SSL SSL SSL/TLS Monit . SSL . PEMFILE PEM () . ( 0700). PEMCHAIN PEMKEY PEM . ( 0700). pemfile: set httpd port 2812 with ssl { pemfile: /etc/ssl/certs/monit.pem } allow myuser:mypassword : set httpd port 2812 with ssl { pemchain: /etc/ssl/certs/monit.chain.pem pemkey: /etc/ssl/certs/monit.key.pem } allow myuser:mypassword Monit TLS . (self-signed): CLI Monit - HTTP GUI Monit Monit start/stop . CLI SELFSIGNED: ALLOW : set httpd port 2812 with ssl { pemfile: /etc/ssl/certs/monit.pem selfsigned: allow } allow myuser:mypassword CLIENTPEMFILE PEM . Monit ( clientpemfile) . CA . ( ) SELFSIGNED: ALLOW ( ). . : set httpd port 2812 with SSL { pemfile: /etc/ssl/certs/monit.pem clientpemfile: /etc/ssl/certs/monit-client.pem } SIGNATURE Monit HTTP . : set httpd port 2812 signature disable allow myuser:mypassword (Authentication) Monit ALLOW . Monit (cleartext) ( ) Monit Monit . Monit / IP (log) . (Client certificates) HTTPS . Monit . SSL Monit Monit . Monit CLIENTPEMFILE . . SSL . (Basic Authentication) Monit Basic Authentication RFC 2617 . ( ) ( ) . Basic Authentication ( base64). Monit ssl . ssl Basic Authentication HTTP Basic Authentication . (Cleartext user and password) allow ':' Monit Basic Authentication . : - . : ALLOW : (Host and network allow list) Monit . IP . Monit (name server) . () Monit . : set httpd port 2812 allow localhost allow my.other.work.machine.com allow 10.1.1.1 allow 192.168.1.0/255.255.255.0 allow 10.0.0.0/8 allow Monit IP . PAM PAM PAM ( Linux macOS FreeBSD NetBSD) . : ALLOW @ "group" Monit . Monit PAM monit PAM PAM PAM PAM . PAM Monit macOS ( "/etc/pam.d/monit"): # monit: auth account password session #auth sufficient pam_securityserver.so #auth sufficient pam_unix.so auth sufficient pam_opendirectory.so auth required pam_deny.so account required pam_permit.so password required pam_deny.so session required pam_permit.so PAM Monit Linux ( "/etc/pam.d/monit"): # monit: auth account password session auth sufficient pam_unix2.so auth required pam_deny.so account required pam_permit.so password required pam_deny.so session required pam_permit.so "monitrc" "admin" "staff" PAM : set httpd port 2812 allow @admin allow @staff readonly htpasswd "htpasswd" ( user:passwd ) : allow [cleartext|crypt|md5] /path [users]. . (digest) . Monit allow . . : set httpd port 2812 allow md5 /etc/httpd/htpasswd john paul ringo george HTTP Monit . : set httpd port 2812 allow localhost allow 10.1.1.1 allow hauk:"passw@rd" Basic Authentication allow . (Read-only users) (read-only) . Monit . set httpd port 2812 allow admin:password allow hauk:password read-only allow @admins allow @users read-only read-only username:password . hauk admin ..PP http . read-only . UNIXSOCKET CLI Monit . set httpd port 2812 read-only unixsocket /run/monit.socket allow @users (ALERT MESSAGES) Monit : o ( ) o ( ) o ( start) o ( ) o o Ping o / TCP/UDP o ( cpu) o Checksum ( ) o ( ) o ( ) o ( ) o UID ( ) o GID ( ) o PID Monit o PPID Monit o o o o o (down up ) o o o / o Monit (reload) "set alert" ( ) "alert" ( ) . (Setting an alert recipient) Monit . : . : SET ALERT mail-address [[NOT] {event, ...}] [REMINDER cycles] : set alert foo@bar foo@bar . "set alert 'email'" . : ALERT mail-address [[NOT] {event, ...}] [REMINDER cycles] : check host myhost with address 1.2.3.4 if failed port 3306 protocol mysql then alert if failed port 80 protocol http then alert alert foo@baz # Local service alert . (override) . (Setting an event filter) "{event, ...}" : set alert foo@bar only on { timeout, nonexist } "not" . Monit: set alert foo@bar but not on { instance } Monit . : Event: | Failure state: | Success state: --------------------------------------------------------------------- action | "Action failed" | "Action done" checksum | "Checksum failed" | "Checksum succeeded" bytein | "Download bytes exceeded" | "Download bytes ok" byteout | "Upload bytes exceeded" | "Upload bytes ok" connection | "Connection failed" | "Connection succeeded" content | "Content failed", | "Content succeeded" data | "Data access error" | "Data access succeeded" exec | "Execution failed" | "Execution succeeded" fsflags | "Filesystem flags failed" | "Filesystem flags succeeded" gid | "GID failed" | "GID succeeded" icmp | "Ping failed" | "Ping succeeded" instance | "Monit instance changed" | "Monit instance changed not" invalid | "Invalid type" | "Type succeeded" link | "Link down" | "Link up" nonexist | "Does not exist" | "Exists" packetin | "Download packets exceeded" | "Download packets ok" packetout | "Upload packets exceeded" | "Upload packets ok" permission | "Permission failed" | "Permission succeeded" pid | "PID failed" | "PID succeeded" ppid | "PPID failed" | "PPID succeeded" resource | "Resource limit matched" | "Resource limit succeeded" saturation | "Saturation exceeded" | "Saturation ok" size | "Size failed" | "Size succeeded" speed | "Speed failed" | "Speed ok" status | "Status failed" | "Status succeeded" timeout | "Timeout" | "Timeout recovery" timestamp | "Timestamp failed" | "Timestamp succeeded" uid | "UID failed" | "UID succeeded" uptime | "Uptime failed" | "Uptime succeeded" : set alert foo@bar { nonexist, timeout, resource, icmp, connection } set alert security@bar on { checksum, permission, uid, gid } set alert admin@bar (Setting an error reminder) Monit . reminder : SET ALERT mail-address [WITH] REMINDER [ON] number [CYCLES] : alert foo@bar with reminder on 10 cycles : alert foo@bar with reminder on 1 cycle "noalert" . NOALERT mail-address ( foo@bar p3): set alert foo@bar check process p1 with pidfile /var/run/p1.pid check process p2 with pidfile /var/run/p2.pid check process p3 with pidfile /var/run/p3.pid noalert foo@bar "set mail-format" : SET MAIL-FORMAT {mail-format} : set mail-format { from: Monit Support reply-to: support@domain.com subject: $SERVICE $EVENT at $DATE message: Monit $ACTION $SERVICE at $DATE on $HOST: $DESCRIPTION. Yours sincerely, monit } from: Monit . (<>) . reply-to: reply-to . subject: . message: . mail-format . '}' . . : set mail-format { from: bofh@foo.bar } $NAME Monit . : o $EVENT . o $SERVICE o $DATE ( RFC 822). o $HOST Monit o $ACTION Monit . o $DESCRIPTION Monit "set mailserver" : SET MAILSERVER [PORT number] [USERNAME string] [PASSWORD string] [using SSL [with options {...}] [CERTIFICATE CHECKSUM [MD5|SHA1|SHA256] ], ... [with TIMEOUT X SECONDS] [using HOSTNAME hostname] . Monit . port SMTP (465 SSL 25 TLS ). Monit AUTH PLAIN AUTH LOGIN SMTP . USERNAME PASSWORD . SSL/TLS SSL . . TIMEOUT . ( failover): set mailserver smtp.gmail.com, smtp.other.host Monit SMTP HELO/EHLO Message-ID . HOSTNAME ..SS " (Event queue)" Monit . Monit M/Monit M/Monit . Monit . Monit . : SET EVENTQUEUE BASEDIR [SLOTS ] . slots number . : set eventqueue basedir /var/monit slots 5000 Monit . (SERVICE METHODS) start stop restart Monit . : [PROGRAM] = "program" [[AS] UID ] [[AS] GID ] [[WITH] TIMEOUT SECOND(S)] "program" "#!" "#!/bin/sh". "program" ( 0755). program : stop = "/bin/sh -c 'kill -s SIGTERM `cat /var/run/process.pid`'" Monit . Monit (root) UID GID . : check process mmonit with pidfile /usr/local/mmonit/mmonit/logs/mmonit.pid start program = "/usr/local/mmonit/bin/mmonit" as uid "mmonit" and gid "mmonit" stop program = "/usr/local/mmonit/bin/mmonit stop" as uid "mmonit" and gid "mmonit" Monit start/stop . TIMEOUT set limits . : check process foobar with pidfile /var/run/foobar.pid start program = "/etc/init.d/foobar start" with timeout 60 seconds stop program = "/etc/init.d/foobar stop" (SERVICE POLL TIME) "set daemon n" . ".monitrc" . "every" . : . (A poll cycle multiple) EVERY [number] CYCLES . (Cron-style) EVERY [cron] . (Negative Cron-style) NOT EVERY [cron] (cron-style) . : : | : | : --------------------------------------------------------------- Minutes | 0-59 | * - , / Hours | 0-23 | * - , / Day of month | 1-31 | * - , / Month | 1-12 (1=jan, 12=dec) | * - , / Day of week | 0-6 (0=sunday, 6=saturday) | * - , / : : | : --------------------------------------------------------------- * (asterisk) | | | () << >> . - (hyphen) | . | 8-9 8AM 9AM . | | 8AM 10AM . | 1-5 | ( ) . , (comma) | . | 17,18 | . | 1-5,0 | . / (slash) | (step) . | . | */5 << >> (0,5,10,15...) | . N-M/S << S- N | M>> 10-30/5 | 10,15,20,25,30. : check process nginx with pidfile /var/run/nginx.pid every 2 cycles : () 08:15 check program weekly_report with path /var/monit/programs/weekly_report.sh every "15 8 * * 1" if status != 0 then alert : check process app with pidfile /var/run/app.pid every "*/5 * * * *" : ( ) check process webapp with pidfile /var/run/webapp.pid every "*/15 9-17 * * 1-5" : ( ). : "not every" / . check process mysqld with pidfile /var/run/mysqld.pid not every "* 0-3 * * 0" : "every" crontab : Monit . "every '15 8 * * 1'" 08:15 . -- ..PP "not every" (poll cycle) . "not every '* 2-5 * * *'" . cron . cron: "every" cron "every [number] cycles" . cron Monit . "every "* * * * *"" ( ) Monit "every 10 cycles" . "every" "every" cron . (SERVICE GROUPS) monitrc group . ( ): GROUP groupname . Monit (start) (stop) (restart) (monitor) (unmonitor) : : monit -g start : monit -g stop : monit -g restart group : group www group filesystem (SERVICE MONITORING MODE) Monit : active passive. : MODE active Monit . Active . passive active monit . (SYSTEM REBOOT AND SERVICE STARTUP) Monit : start nostart laststate. : ONREBOOT start Monit . onreboot . nostart . (HA) active/passive . HA IP H1 H2 (heartbeat) . HA . H1 H2 HA . H1 HA H1 HA H2 . laststate . . ONREBOOT START : SET ONREBOOT (SERVICE RESTART LIMIT) Monit . . x y ( x <= y) Monit ( ). (timeout) Monit . timeout ( ): IF RESTART CYCLE(S) THEN action TIMEOUT ( UNMONITOR ). Monit : if 2 restarts within 3 cycles then unmonitor Monit "monit monitor servicename" . (exec) : if 5 restarts within 5 cycles then exec "/foo/bar" : if 7 restarts within 10 cycles then stop Monit (start) (stop) (monitoring) (unmonitoring) . Monit . depend : DEPENDS on service[, service [,...]] service ".monitrc" apache datafs. depend . depend stop/start/monitor/unmonitor . . . . (restart) . apache apache . apache . Monit apache . (1) check process apache with pidfile "/var/run/httpd.pid" (2) depends on httpd (3) ... (4) (5) check file httpd with path /usr/bin/httpd (6) if failed checksum then stop apache . httpd . : . checksum stop apache . apache httpd stop . checksum httpd check file httpd check process apache . ( exec ). . : WEB-SERVER -> APPLICATION-SERVER -> DATABASE -> FILESYSTEM (a) (b) (c) (d) (application server) (mount) . depend . Monit : Monit : d c b a 'monit stop all' : a b c d. 'monit stop d' a b c d d . a Monit a . b Monit a b b a . c Monit a b c b a . d Monit a b c d c b a . . a->b b->a a->b->c->a . Monit . depend . (SERVICE TESTS) (LIMITS) (timeouts) Monit . . Monit . : SET LIMITS { PROGRAMOUTPUT: , SENDEXPECTBUFFER: , FILECONTENTBUFFER: , HTTPCONTENTBUFFER: , NETWORKTIMEOUT: PROGRAMTIMEOUT: STOPTIMEOUT: STARTTIMEOUT: RESTARTTIMEOUT: EXECTIMEOUT: } : unit "B" () "kB" () "MB" () timeunit "MS" () "S" () : --------------------------------------------------------------------------------- | Option | Description | Default | --------------------------------------------------------------------------------- | programOutput | limit for check program output (truncated after) | 512 B | | sendExpectBuffer | limit for send/expect protocol test | 256 B | | fileContentBuffer | limit for file content test (line) | 512 B | | httpContentBuffer | limit for HTTP content test (response body) | 1 MB | | networkTimeout | timeout for network I/O | 5 s | | programTimeout | timeout for check program | 300 s | | stopTimeout | timeout for service stop | 30 s | | startTimeout | timeout for service start | 30 s | | restartTimeout | timeout for service restart | 30 s | | execTimeout | timeout for test action exec | nolimit | --------------------------------------------------------------------------------- Monit if 'check' . (actions) . : IF THEN [ELSE ] (action) . . Monit (recovery alert) . : IF CHANGED THEN . Monit . (ACTION) alert start stop restart unmonitor exec Monit . ignore . : ALERT | IGNORE | START | STOP | RESTART | UNMONITOR : EXEC "program" [[AS] UID ] [[AS] GID ] [[WITH] TIMEOUT SECOND(S)] [REPEAT EVERY [] CYCLE(S)] : o ALERT . o RESTART . restart stop start . o START start . o STOP stop . Monit Monit . . o EXEC . . uid gid . . . : if failed then exec "/usr/local/bin/sms.sh" as uid "nobody" and gid "nobody" repeat every 5 cycles Monit (root) Monit (superuser) uid gid . o UNMONITOR . Monit . . o IGNORE . (FAULT TOLERANCE) . failed . . : FOR CYCLES ... : [TIMES WITHIN] CYCLES ... (failure) (success) . "X" : if failed port 80 for 3 cycles then alert -- -- . (1-0-1-0-1-0-...) "for 2 cycles" . : if failed port 80 for 3 times within 5 cycles then alert : check filesystem rootfs with path /dev/hda1 if space usage > 80% for 5 times within 15 cycles then alert if space usage > 90% for 5 cycles then exec '/try/to/free/the/space' : (cycles) 64 ..SS " (EXISTENCE TESTS)" . process file directory filesystem fifo . Monit . : NON-EXIST . apache . IF [DOES] NOT EXIST THEN action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : : check filesystem disk1 with path /dev/sda1 if does not exist then exec "/sbin/mount..." EXIST : . (kill) . IF [DOES] EXIST THEN action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : : check process vmware matching "vmware" if exist then exec "/usr/bin/pkill -9 vmware" : : check file x with path /some/path/x if exist then alert (RESOURCE TESTS) Monit . system process Monit . . . (Syntax): IF THEN operator "<" ">" "!=" "==" C "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). value . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . resource : (System resource tests) LOADAVG([1min|5min|15min]) [PER CORE] (load average) . CPU . : if loadavg (1min) per core > 2 for 15 cycles then alert if loadavg (5min) per core > 1.5 for 10 cycles then alert if loadavg (15min) per core > 1 for 8 cycles then alert per core CPU . CPU([user|system|wait|nice|hardirq|softirq|steal|guest|guestnice]) : user (CPU) (user space) . system . / . wait / (I/O wait) CPU / . nice nice ( ) . hardirq . . softirq . . steal . steal CPU . . guest . CPU . "user" . guestnice . CPU . "nice" . user/system/wait/nice/hardirq/softirq/steal/guest/guestnice ( 2.6.33 ): ------------------------------------------------------------------------------------------------- | Platform | user | nice | system | wait | hardirq | softirq | steal | guest | guest nice | ------------------------------------------------------------------------------------------------- | AIX | X | | X | X | | | | | | | DragonFlyBSD | X | X | X | | X | | | | | | FreeBSD | X | X | X | | X | | | | | | Linux | X | X | X | X | X | X | X | X | X | | MacOS | X | X | X | | | | | | | | NetBSD | X | X | X | | X | | | | | | OpenBSD | X | X | X | | X | | | | | | Solaris | X | | X | X | | | | | | ------------------------------------------------------------------------------------------------- : if cpu usage > 95% for 10 cycles then alert MEMORY [%] [B, kB, MB, GB] . : if memory usage > 75% for 5 cycles then alert SWAP swap [%] [B, kB, MB, GB] . : if swap usage > 20% for 10 cycles then alert PAGEIN PAGEOUT swap (memory pressure) . swap . / swap RAM . : 0 pages/sec: (Healthy) 1-10 pages/sec: >100 pages/sec sustained: >1000 pages/sec: (Thrashing) : if pageout > 50 per second for 20 cycles then alert if pageout > 100 per second for 10 cycles then alert (Process resource tests) CPU CPU [ ]. Monit CPU (threads) CPU . CPU CPU . CPU CPU . CPU CPU CPU . : if cpu > 10% for 5 cycles then restart TOTAL CPU CPU ( ). Apache (master) (worker) TOTAL CPU . : if total cpu > 50% for 10 cycles then restart THREADS . : if threads > 3 then alert CHILDREN . : if children > 10 then alert MEMORY [%] [B, kB, MB, GB]. - Linux: Monit PSS ( - Proportional Set Size) RSS ( - Resident Set Size) . PSS . RSS . PSS . - MacOS: ActivityMonitor RSS . ( ). : if memory usage > 8 MB then alert TOTAL MEMORY [B, kB, MB, GB]. : if total memory usage > 1% for 10 cycles then alert / (PROCESS I/O ACTIVITY TEST) Monit . (process) . Monit (root) . (OS) I/O . I/O I/O (cache) . I/O I/O . I/O : ----------------------------------------------------------------- | Platform | Operation | Byte (physical) | Byte (generic) | ----------------------------------------------------------------- | AIX | X | | | | DragonFlyBSD | X | | | | FreeBSD | X | | | | Linux | X | X | X | | MacOS | | X | | | NetBSD | X | | | | OpenBSD | X | | | | Solaris | X | | | ----------------------------------------------------------------- : () : IF READ [ACTIVITY] /S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit "B" "KB" "MB" "GB" "byte" "kilobyte" "megabyte" "gigabyte" "percent". action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check process p... if read activity > 1 MB/s then alert : ( ) : IF DISK READ [ACTIVITY] /S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit "B" "KB" "MB" "GB" "byte" "kilobyte" "megabyte" "gigabyte" "percent". action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check process p... if disk read activity > 1 MB/s then alert : : IF DISK READ [ACTIVITY] operations/S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check process p... if disk read activity > 500 operations/s then alert : () : IF WRITE [ACTIVITY] /S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit "B" "KB" "MB" "GB" "byte" "kilobyte" "megabyte" "gigabyte" "percent". action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check process p... if write activity > 1 MB/s then alert : ( ) : IF DISK WRITE [ACTIVITY] /S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit "B" "KB" "MB" "GB" "byte" "kilobyte" "megabyte" "gigabyte" "percent" . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check process p... if disk write activity > 1 MB/s then alert : : IF DISK WRITE [ACTIVITY] operations/S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check process p... if disk write activity > 500 operations/s then alert (FILE CHECKSUM TEST) MD5 SHA1 SHA256 . : IF FAILED [MD5|SHA1|SHA256] CHECKSUM [EXPECT checksum] THEN action : IF CHANGED [MD5|SHA1|SHA256] CHECKSUM THEN action MD5 SHA1 SHA256 . MD5 ( ) SHA1 ( ) SHA256 ( ) . Monit EXPECT MD5 . SHA256 . "expect" md5 sha1 sha256 Monit . Monit . : if failed checksum expect 8f7f419955cefa0b33a2ba316cba3659 then alert GNU md5sum(1) sha1sum(1) sha256sum(1) expect . : check file apache_conf with path /etc/apache/httpd.conf if changed checksum then exec "/usr/bin/apachectl graceful" action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . (TIMESTAMP TEST) fifo . : IF [unit] THEN : IF CHANGED THEN action : ACCESS (ATIME) ( ) . mount atime atime . CHANGE (CTIME) . MODIFICATION (MTIME) . (truncate) . . DEFAULT (LATEST OF CHANGE AND MODIFICATION TIMES) . ( ) . operator "<" ">" "!=" "==" C "GT" "LT" "EQ" "NE" sh "NEWER" "OLDER" "GREATER" "LESS" "EQUAL" "NOTEQUAL" ( EQUAL ). value (watermark) . unit "SECOND(S)" "MINUTE(S)" "HOUR(S)" "DAY(S)" . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . apache : check file apache_conf with path /etc/apache/httpd.conf if changed timestamp then exec "/usr/bin/apachectl graceful" : check directory bar path /foo/bar if changed timestamp then alert : if timestamp is older than 1 hour then alert size check file . Monit . : IF SIZE [[operator] value [unit]] THEN action : IF CHANGED SIZE THEN action operator "<" ">" "!=" "==" C "GT" "LT" "EQ" "NE" sh "GREATER" "LESS" "EQUAL" "NOTEQUAL" ( EQUAL ). value (watermark) . unit "B" "KB" "MB" "GB" "byte" "kilobyte" "megabyte" "gigabyte" . "byte" . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check file mydb with path /data/mydatabase.db if size > 1 GB then alert (FILE CONTENT TEST) content (regular expressions) . (Syntax): IF CONTENT THEN action operator "=" "!=" . regex . : regex(7). path . : regex(7). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . Monit . inode . (newline) . . set limits . IGNORE CONTENT IGNORE . IGNORE CONTENT IF CONTENT . IGNORE CONTENT . IF CONTENT . : check file syslog with path /var/log/syslog ignore content = "monit" if content = "^mrcoffee" then alert (FILESYSTEM MOUNT FLAGS TEST) Monit (mount flags) . Monit . ( ) ( nosuid) . fsflags : IF CHANGED FSFLAGS THEN action action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check filesystem rootfs with path / if changed fsflags then exec "/my/script" (SPACE USAGE TEST) Monit . filesystem . (root) ( -) . . CLI HTTP Monit . (Syntax): IF SPACE operator value unit THEN action : IF SPACE FREE operator value unit THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit "B" "KB" "MB" "GB" "%" "byte" "kilobyte" "megabyte" "gigabyte" "percent" . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check filesystem rootfs with path / if space usage > 90% then alert Monit inode . (context) filesystem . : IF INODE(S) operator value [unit] THEN action : IF INODE(S) FREE operator value [unit] THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit . inode . "%" "percent" . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check filesystem rootfs with path / if inode usage > 90% then alert / (DISK I/O TEST) Monit . filesystem . I/O . I/O . (block devices). I/O Monit: --------------------------------------------------------------------------------------- | Platform | Granularity | Supported filesystems | TBD | --------------------------------------------------------------------------------------- | AIX | per-disk | Disk io monitoring currently not supported | JFSx | | DragonFlyBSD | per-disk | UFS | HAMMER | | FreeBSD | per-disk | UFS, ZFS | | | Linux | per-filesystem | EXTx, XFS, BTRFS, ZFS, NFS, CIFS | | | MacOS | per-disk | HFS | | | NetBSD | per-disk | FFS | NFS | | OpenBSD | per-disk | FFS | | | Solaris | per-filesystem | ZFS, UFS, NFS | | --------------------------------------------------------------------------------------- : (Read: bytes per second) : IF READ [RATE] /S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit "B" "KB" "MB" "GB" "byte" "kilobyte" "megabyte" "gigabyte" "percent". action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check filesystem disk1... if read rate > 1 MB/s then alert : (Read: operations per second) : IF READ [RATE] operations/S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check filesystem disk1... if read rate > 500 operations/s then alert : (Write: bytes per second) : IF WRITE [RATE] /S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit "B" "KB" "MB" "GB" "byte" "kilobyte" "megabyte" "gigabyte" "percent". action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check filesystem disk1... if write rate > 1 MB/s then alert : (Write: operations per second) : IF WRITE [RATE] operations/S THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check filesystem disk1... if write rate > 500 operations/s then alert (Service time per operation) (Service Time) . . . M/Monit . : IF SERVICE TIME THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit "MS" () "S" () . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : if service time > 10 milliseconds for 3 times within 5 cycles then alert Monit . file fifo directory filesystem . : IF FAILED PERM(ISSION) octalnumber THEN action : IF CHANGED PERM(ISSION) THEN action octalnumber (0-7) . 0000 - 7777 ( Monit . "640" "0640" ). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check file shadow with path /etc/shadow if failed permission 0640 then alert (UID TEST) Monit (uid) file fifo directory . : IF FAILED [E]UID THEN action value . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check file shadow with path /etc/shadow if failed uid "root" then alert (GID TEST) Monit (gid) file fifo directory . : IF FAILED GID THEN action value . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check file shadow with path /etc/shadow if failed gid "shadow" then alert (HARDLINK TEST) hardlink check file fifo directory . Monit file fifo directory . : IF HARDLINK [[operator] value] THEN action : IF CHANGED HARDLINK THEN action operator "<" ">" "!=" "==" C "GT" "LT" "EQ" "NE" sh "GREATER" "LESS" "EQUAL" "NOTEQUAL" ( EQUAL ). value (watermark) . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check directory upload with path /data/upload if hardlink > 32000 then alert (PID TEST) Monit PID . PID Monit . : IF CHANGED PID THEN action action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". Monit . sshd sshd Monit : check process sshd with pidfile /var/run/sshd.pid if changed pid then alert Monit PID (PPID) . PPID Monit Monit . ppid : IF CHANGED PPID THEN action action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check process myproc with pidfile /var/run/myproc.pid if changed ppid then exec "/my/script" UPTIME uptime . : IF UPTIME [[operator] value [unit]] THEN action operator "<" ">" "!=" "==" C "GT" "LT" "EQ" "NE" sh "GREATER" "LESS" "EQUAL" "NOTEQUAL" ( EQUAL ). value uptime . unit "SECOND" "MINUTE" "HOUR" "DAY" ( "SECONDS" "MINUTES" "HOURS" "DAYS" ). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check process myapp with pidfile /var/run/myapp.pid start program = "/etc/init.d/myapp start" stop program = "/etc/init.d/myapp stop" if uptime > 3 days then restart (SECURITY ATTRIBUTE) (security attribute) . : IF SECURITY ATTRIBUTE THEN operator : "=" "!=" "=~" "!=~" . regex . regex(7) . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : IF FAILED SECURITY ATTRIBUTE THEN string . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . SELinux: check process ntpd matching "ntpd" if security attribute != "system_u:system_r:ntpd_t:s0" then alert AppArmor: check process ntpd matching "ntpd" if security attribute != "/usr/sbin/ntpd (enforce)" then alert Monit . . . : IF FILEDESCRIPTORS [%] THEN action . : IF TOTAL FILEDESCRIPTORS THEN action operator "<" ">" "!=" "==" C "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). number (). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check system $HOST if filedescriptors >= 90% then alert check process myproc with pidfile /var/run/myproc.pid if filedescriptors >= 90% then alert if filedescriptors >= 99% then restart if total filedescriptors > 5000 then alert (exit status) . check program Monit . : IF STATUS operator value THEN action : IF CHANGED STATUS THEN action operator "<" ">" "!=" "==" C "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check program myscript with path /usr/local/bin/myscript.sh if status != 0 then alert (/usr/local/bin/myscript.sh): #!/bin/sh echo test exit $? : check program list-files with path "/bin/ls -lrt /tmp/" if status != 0 then alert (whitespace) . '-lrt' '/tmp/' '/bin/ls' . " . : . . Monit (superuser) / . ls www staff : check program ls with path "/bin/ls /tmp" as uid "www" and gid "staff" if status != 0 then alert Monit Monit . 0 Monit . 0 . (asynchronous) Monit monitrc . Monit . Monit (stderr) . Monit . 5 Monit (kill ) (timeout) . ( ). : check program hwtest with path /usr/local/bin/hwtest.sh with timeout 500 seconds if status = 1 then alert if status = 3 for 5 cycles then exec "/usr/local/bin/emergency.sh" (PROGRAM OUTPUT CONTENT TEST) content (regular expressions) . : IF CONTENT THEN action IF CONTENT [NOT] CHANGED THEN action operator "=" "!=" . regex (extended regular expression) . regex(7). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . 511 . set limits . : check program disk0_smart with path "/usr/sbin/nvme smart-log /dev/nvme0" if content != "critical_warning[ ]+: 0" then alert check program ip_route with path "/usr/bin/ip route" if content changed then alert Monit : [] [] (Link status) . check network Monit . : IF LINK THEN action action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . DOWN / . "link up" "link down" "check network" . : check network eth0 with interface eth0 if link down then alert check network eth5 with interface eth5 if link up then exec "/usr/bin/monit start backup" start stop . ( ) check network eth0 with interface eth0 start program = '/sbin/ipup eth0' stop program = '/sbin/ipdown eth0' if link down then restart (Link capacity) . check network Monit . : IF CHANGED LINK [CAPACITY] THEN action action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . ( ) (duplex) . : . loopback VMWare speed . : check network eth0 with interface eth0 if changed link capacity then alert (Link saturation) . Monit . check network Monit . : IF SATURATION operator value% THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : speed . LINK SPEED . : check network eth0 with interface eth0 if saturation > 90% then alert [] . check network Monit . ( ): IF UPLOAD operator value unit/S THEN action ( ): IF DOWNLOAD operator value unit/S THEN action : IF TOTAL UPLOADED operator value unit IN LAST number time-unit THEN action : IF TOTAL DOWNLOADED operator value unit IN LAST number time-unit THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). unit "B" "KB" "MB" "GB" "byte" "kilobyte" "megabyte" "gigabyte" . time-unit "MINUTE(S)" "HOUR(S)" "DAY" . : Monit . time-unit . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . : check network eth0 with interface eth0 if upload > 500 kB/s then alert if total downloaded > 1 GB in last 2 hours then alert if total downloaded > 10 GB in last day then alert [] . check network Monit . : IF UPLOAD operator value PACKETS/S THEN action : IF DOWNLOAD operator value PACKETS/S THEN action : IF TOTAL UPLOADED operator value PACKETS IN LAST number time-unit THEN action (Total download): IF TOTAL DOWNLOADED operator value PACKETS IN LAST number time-unit THEN action operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). time-unit "MINUTE(S)" "HOUR(S)" "DAY". : Monit / . time-unit . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR". : check network eth0 with interface eth0 if upload > 1000 packets/s then alert if total uploaded > 900000 packets in last hour then alert (NETWORK PING TEST) Monit echo request ICMP . check host . Monit root ( raw ). : IF PING[4|6] [COUNT number] [SIZE number] [RESPONSETIME operator number ] [TIMEOUT number SECONDS] [ADDRESS string] THEN action DNS check host ( IPv4 IPv6) Monit . Monit PING4 PING6 PING IPv4 IPv6 . COUNT . . SIZE (payload) . . RESPONSETIME . operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). TIMEOUT Monit . . ADDRESS IP . Monit ( ). COUNT . ( ). ISP ICMP . check host Monit . : check host mmonit.com with address mmonit.com if failed ping then alert # IPv4 or IPv6 check host mmonit.com with address 62.109.39.247 if failed ping then alert # Address is IPv4 so IPv4 is preferred IPv4 IPv6 : check host mmonit.com with address mmonit.com if failed ping4 then alert # IPv4 only if failed ping6 then alert # IPv6 only mmonit.com check host mmonit.com with address mmonit.com if failed ping count 5 size 128 with timeout 10 seconds then alert : check host offlinehost with address 192.168.100.50 if succeeded ping then alert (CONNECTION TESTS) Monit Unix . process host . Monit ( TCP UDP) . / Monit . TCP/UDP Monit mysql . TCP/UDP: IF [HOST string] [ADDRESS string] [IPV4 | IPV6] [TYPE ] [ [with options {...}] [CERTIFICATE CHECKSUM [MD5|SHA1|SHA256] string] [CERTIFICATE VALID for number DAYS] [PROTOCOL protocol | "string",...] [RESPONSETIME operator number ] [TIMEOUT number SECONDS] [RETRY number] THEN action Unix: IF [TYPE ] [PROTOCOL protocol | "string",...] [RESPONSETIME operator number ] [TIMEOUT number SECONDS] [RETRY number] THEN action : if failed port 80 then alert if failed port 53 type udp protocol dns then alert if succeeded host example.org port 3306 type tcp protocol mysql then alert if failed unixsocket /var/run/sophie then alert : HOST hostname. . process localhost . remote host . PORT number. UNIXSOCKET path. Unix ( ). ADDRESS string. IP . IPV4 | IPV6 . IP Monit . Monit (IPv4 IPv6) . Monit . TYPE [TCP | UDP]. Monit . : TCP UDP TCP (stream) UDP . TCP ..PP [SSL | TLS] [with options {...}]. SSL/TLS / SSL . SSL/TLS SSL . CERTIFICATE CHECKSUM [MD5|SHA1|SHA256] hash. SSL (checksum) . MD5 SHA1 SHA256 ( Monit ). SHA256 . openssl Monit : openssl x509 -fingerprint -sha256 -in server.crt | head -1 | cut -f2 -d'=' : if failed port 443 protocol https and certificate checksum = "1ED948A6F4258ACAB964227EF4EB19FCC453B0F8" then alert CERTIFICATE VALID for number DAYS. . SSL . : if failed port 443 protocol https and certificate valid > 30 days then alert PROTOCOL protocol. Monit . Monit : APACHE-STATUS DNS DWP FAIL2BAN FTP GPS HTTP HTTPS IMAP IMAPS CLAMAV LDAP2 LDAP3 LMTP MEMCACHE MONGODB MQTT MYSQL MYSQLS NNTP NTP3 PGSQL POP POPS POSTFIX-POLICY RADIUS RDATE REDIS RSYNC SIEVE SIP SMTP SMTPS SPAMASSASSIN SSH TNS WEBSOCKET Monit . RESPONSETIME . operator "<" ">" "!=" "==" c "gt" "lt" "eq" "ne" sh "greater" "less" "equal" "notequal" ( EQUAL ). TIMEOUT number SECONDS. (timeout) . Monit . . RETRY number. . . action "ALERT" "RESTART" "START" "STOP" "EXEC" "UNMONITOR" . GENERIC (SEND/EXPECT) Monit send expect . SEND () EXPECT expect . : [ "string"]+ Monit ( ) CR LF . Monit EXPECT . set limits . SEND . (hex) \0xHEXHEX \0x00-\0xFF ( ) . Quake 3: send "\0xFF\0xFF\0xFF\0xFFgetstatus" expect "sv_floodProtect|sv_maxPing" POSIX EXPECT expect regex(7) . regex (zero-terminated) '\0' EXPECT . '\0' expect "\0" (escape) '\' 0. expect : expect "^[\\]0.*" SMTP : if failed port 25 and expect "^220.*" send "HELO localhost.localdomain\r\n" expect "^250.*" send "QUIT\r\n" then alert SEND/EXPECT TCP UNIX UDP . HTTP : PROTO(COL) HTTP [USERNAME "string"] [PASSWORD "string"] [REQUEST "string"] [METHOD ] [STATUS operator number] [CHECKSUM checksum] [HTTP HEADERS list of headers] [CONTENT < "=" | "!=" > STRING] USERNAME Basic . PASSWORD Basic . REQUEST URL HTTP . request "/" ..PP : if failed port 80 protocol http request "/data/show?a=b&c=d" then restart METHOD HTTP . Monit HTTP GET HEAD . HEAD . STATUS HTTP HTTP . HTTP . status . ( HTTP 404 ): if failed port 80 protocol http request "/non/existent.php" status = 404 then alert CHECKSUM HTTP . MD5, SHA1, SHA256 . SHA256 . HTTP Content-Length Monit . HTTP ( ) . Monit . : if failed port 80 protocol http request "/page.html" checksum 8f7f419955cefa0b33a2ba316cba3659 then alert HTTP HEADERS HTTP HTTP host. host Monit hostname IP-address check host . host (name-based virtual host) . HTTP : http headers [name:value, name:value,..] name:value <<,>> . <<:>> host . http headers [Host: "mmonit.com:443"] check host : check host mmonit.com with address mmonit.com if failed port 80 protocol http with http headers [Host: mmonit.com, Cache-Control: no-cache, Cookie: csrftoken=nj1bI3CnMCaiNv4beqo8ZaCfAQQvpgLH] and request /monit/ with content = "Monit [0-9.]+" then alert HTTP HTTP request . CONTENT . . Monit . . set limits . : if failed port 80 protocol http content = "foobar [0-9.]+" then alert APACHE-STATUS APACHE-STATUS mod_status http://www.example.com/server-status . : PROTOCOL APACHE-STATUS [PATH ] [USERNAME ] [PASSWORD ] [ ]+ PATH ( "/server-status") USERNAME Basic PASSWORD Basic property (child status) : (1) logging (loglimit) (2) closing connections (closelimit) (3) performing DNS lookups (dnslimit) (4) in keepalive with a client (keepalivelimit) (5) replying to a client (replylimit) (6) receiving a request (requestlimit) (7) initialising (startlimit) (8) waiting for incoming connections (waitlimit) (9) gracefully closing down (gracefullimit) (10) performing cleanup procedures (cleanuplimit) operator "<" "=" ">" . number . . . OR . : if failed port 80 protocol apache-status loglimit > 10% or dnslimit > 50% or waitlimit < 20% then alert MQTT : PROTOCOL MQTT [USERNAME string PASSWORD string] USERNAME MQTT PASSWORD MQTT ( ) . Monit (anonymous) => . : check process mosquitto with pidfile /var/run/mosquitto.pid start program = "/sbin/start mosquitto" stop program = "/sbin/stop mosquitto" if failed port 1883 protocol mqtt then alert MYSQL : PROTOCOL MYSQL[S] [USERNAME string PASSWORD string [RSAKEY CHECKSUM [MD5|SHA1|SHA256] string]] USERNAME MySQL. PASSWORD MySQL ( - ). RSAKEY CHECKSUM (MYSQL TLS) MD5, SHA1, SHA256 RSA (man-in-the- middle) . SHA256 . Monit (fingerprint) ..PP ( ) Monit (anonymous login) . MySQL (log) MySQL . Monit . Monit . Monit : CREATE USER 'monit'@'host_from_which_monit_performs_testing' IDENTIFIED BY 'mysecretpassword'; FLUSH PRIVILEGES; : check process mysql with pidfile /var/run/mysqld/mysqld.pid start program = "/sbin/start mysql" stop program = "/sbin/stop mysql" if failed port 3306 protocol mysql username "foo" password "bar" then alert / unix-socket: check process mysql with pidfile /var/run/mysqld/mysqld.pid start program = "/usr/local/mysql/support-files/mysql.server start" stop program = "/usr/local/mysql/support-files/mysql.server stop" if failed unixsocket /tmp/mysql.sock protocol mysql username "foo" password "bar" then alert TLS MYSQLS : if failed port 3306 protocol mysqls username "foo" password "bar" then alert PGSQL : PROTOCOL PGSQL [USERNAME string] [PASSWORD string] [DATABASE string]] USERNAME PostgreSQL. PASSWORD PostgreSQL ( - ). DATABASE PostgreSQL ( ). ( ) Monit user=root database=root PostgreSQL . Monit . Monit . Monit 'password' 'md5' PostgreSQL . Monit ( 'scram-sha-256') Monit ( Monit ). Monit : pg_hba.conf PostgreSQL: # TYPE DATABASE USER ADDRESS METHOD host test monit 127.0.0.1/32 md5 Monit: check process postgresql with pidfile /var/run/postgresql/12-main.pid start program = "/bin/systemctl postgresql start" stop program = "/bin/systemctl postgresql stop" if failed port 5432 protocol pgsql username "monit" password "123456" database "test" then alert RADIUS : PROTOCOL RADIUS [SECRET string] SECRET (secret) "testing123" . : check process radiusd with pidfile /var/run/radiusd.pid start program = "/etc/init.d/freeradius start" stop program = "/etc/init.d/freeradius stop" if failed host 127.0.0.1 port 1812 type udp protocol radius secret pingpong then alert SIP SIP Asterisk FreeSWITCH . : PROTOCOL SIP [TARGET valid@uri] [MAXFORWARD n] TARGET sip uri . MAXFORWARD (gateways) . 0-255 70 . max-forward = 0 200 OK ( ) 483 Too Many Hops ( ). : check host openser_all with address 127.0.0.1 if failed port 5060 type udp protocol sip with target "localhost:5060" and maxforward 6 then alert SMTP : PROTOCOL SMTP[S] [USERNAME string PASSWORD string] USERNAME SMTP. PASSWORD SMTP ( - ). . smtps . Monit . : check process postfix with pidfile /var/spool/postfix/pid/master.pid start program = "/etc/init.d/postfix start" stop program = "/etc/init.d/postfix stop" if failed port 25 protocol smtp then alert STARTTLS/SMTPS: check process postfix with pidfile /var/spool/postfix/pid/master.pid start program = "/etc/init.d/postfix start" stop program = "/etc/init.d/postfix stop" if failed port 25 protocol smtps username "foo" password "bar" then alert WEBSOCKET :.PP PROTOCOL WEBSOCKET [REQUEST string] [HOST string] [ORIGIN string] [VERSION number] HOST Host REQUEST "/" ORIGIN "https://mmonit.com" VERSION "0" : check host websocket.org with address "echo.websocket.org" if failed port 80 protocol websocket host "echo.websocket.org" request "/" origin 'http://websocket.com' version 13 then alert MONIT (MANAGE YOUR MONIT INSTANCES) M/Monit Monit Monit . M/Monit Monit . Monit M/Monit . M/Monit . M/Monit Monit . M/Monit Monit : SET MMONIT [TIMEOUT SECONDS] [REGISTER WITHOUT CREDENTIALS] [[WITH] HOSTGROUPS '[' "name", ... ']' ] : set mmonit https://monit:monit@192.168.1.10:8443/collector Monit M/Monit M/Monit . https Monit M/Monit . URL ":" "?" "@" URL . TIMEOUT . Monit M/Monit M/Monit . REGISTER WITHOUT CREDENTIALS M/Monit . Monit (hostgroup) M/Monit . . : set mmonit https://monit:monit@192.168.1.10:8443/collector with hostgroups [ Oslo, "Mail servers" ] (CONFIGURATION EXAMPLES) check . : check process nginx with pidfile /var/run/nginx.pid Monit start : check process nginx with pidfile /var/run/nginx.pid start program = "/etc/init.d/nginx start" apache HTTP HTTPS . apache Monit . Monit stop- program ( ) start-program ( ) . 'timeout' . Monit . check process apache with pidfile /var/run/httpd.pid start program = "/etc/init.d/httpd start" with timeout 60 seconds stop program = "/etc/init.d/httpd stop" if failed port 80 for 2 cycles then restart if failed port 443 for 2 cycles then restart (uid) (gid) . uid gid ( Java) Monit . Servlet Tomcat nobody . Monit uid gid (superuser) Monit Monit uid gid . check process tomcat with pidfile /var/run/tomcat.pid start program = "/etc/init.d/tomcat start" as uid "nobody" and gid "nobody" stop program = "/etc/init.d/tomcat stop" # You can also use id numbers instead and write: as uid 99 and with gid 99 if failed port 8080 then alert udp (name-server) : check process named with pidfile /var/run/named.pid start program = "/etc/init.d/named start" stop program = "/etc/init.d/named stop" if failed port 53 use type udp protocol dns then restart 'sophie' : check process sophie with pidfile /var/run/sophie.pid start program = "/etc/init.d/sophie start" stop program = "/etc/init.d/sophie stop" if failed unix /var/run/sophie then restart apache localhost (vhost) IP host port : check process apache with pidfile /var/run/httpd.pid start "/etc/init.d/httpd start" stop "/etc/init.d/httpd stop" if failed host www.sol.no port 80 then alert if failed host shop.sol.no port 443 then alert if failed host chat.sol.no port 80 then alert Monit HTTP : check process apache with pidfile /var/run/httpd.pid start "/etc/init.d/httpd start" stop "/etc/init.d/httpd stop" if failed host www.sol.no port 80 protocol http then alert send/expect : check process apache with pidfile /var/run/httpd.pid start "/etc/init.d/httpd start" stop "/etc/init.d/httpd stop" if failed host www.sol.no port 80 and send "GET / HTTP/1.1\r\nHost: www.sol.no\r\n\r\n" expect "HTTP/[0-9\.]{3} 200.*" then alert :.PP check host www.tildeslash.com with address www.tildeslash.com if failed ping then alert Monit apache start stop . : check process apache with pidfile /var/run/httpd.pid start program = "/etc/init.d/httpd start" stop program = "/etc/init.d/httpd stop" if failed host www.tildeslash.com port 80 then restart depends on apache_bin check file apache_bin with path /usr/local/apache/bin/httpd if failed checksum then unmonitor Monit . : check host mmonit.com with address mmonit.com if failed port 80 protocol http and request "/monit/dist/monit-5.7.tar.gz" with checksum f9d26b8393736b5dfad837bb13780786 then alert SIP . FreeSWITCH Asterisk . check process freeswitch with pidfile /usr/local/freeswitch/log/freeswitch.pid start program = "/usr/local/freeswitch/bin/freeswitch -nc -hp" stop program = "/usr/local/freeswitch/bin/freeswitch -stop" if total memory > 1000.0 MB for 5 cycles then alert if total memory > 1500.0 MB for 5 cycles then alert if total memory > 2000.0 MB for 5 cycles then restart if cpu > 60% for 5 cycles then alert if failed port 5060 type udp protocol SIP target me@foo.bar and maxforward 10 then restart check process asterisk with pidfile /var/run/asterisk/asterisk.pid start program = "/usr/sbin/asterisk" stop program = "/usr/sbin/asterisk -r -x 'shutdown now'" if total memory > 1000.0 MB for 5 cycles then alert if total memory > 1500.0 MB for 5 cycles then alert if total memory > 2000.0 MB for 5 cycles then restart if cpu > 60% for 5 cycles then alert if failed port 5060 type udp protocol SIP and target me@foo.bar maxforward 10 then restart (Application Servers) Java. (poll-cycle) ( ) every : check process dynamo with pidfile /etc/dynamo.pid every 2 cycles start program = "/etc/init.d/dynamo start" stop program = "/etc/init.d/dynamo stop" if failed port 8840 then alert : 'Monit -g database start all'. mode Monit () : check process sybase with pidfile /var/run/sybase.pid start = "/etc/init.d/sybase start" stop = "/etc/init.d/sybase stop" mode passive group database check process oracle with pidfile /var/run/oracle.pid start program = "/etc/init.d/oracle start" stop program = "/etc/init.d/oracle stop" if failed port 9001 protocol tns then restart group database CPU HTTP . CPU 100Mb Apache : check process apache with pidfile /var/run/httpd.pid start program = "/etc/init.d/httpd start" stop program = "/etc/init.d/httpd stop" if cpu > 40% for 2 cycles then alert if total cpu > 60% for 2 cycles then alert if total cpu > 80% for 5 cycles then restart if mem > 100 MB for 5 cycles then stop timestamp exec apache . check file httpd.conf with path /etc/httpd/httpd.conf if changed timestamp then exec "/etc/init.d/httpd graceful" alert : check process apache with pidfile /var/run/httpd.pid start = "/etc/init.d/httpd start" stop = "/etc/init.d/httpd stop" alert admin@bar on {nonexist, timeout} with mail-format { from: bofh@$HOST subject: apache $EVENT - $ACTION message: This event occurred on $HOST at $DATE. Your faithful employee, monit } if failed host www.tildeslash.com port 80 then restart depend httpd_bin group apache check file httpd_bin with path /usr/local/apache/bin/httpd alert security@bar on {checksum, timestamp, permission, uid, gid} with mail-format {subject: Alaaarrm! on $HOST} if failed checksum and expect 8f7f419955cefa0b33a2ba316cba3659 then unmonitor if failed permission 755 then unmonitor if failed uid "root" then unmonitor if failed gid "root" then unmonitor if changed timestamp then alert group apache depend . oracle apache . apache oracle oracle apache . check process apache with pidfile /var/run/httpd.pid start = "/etc/init.d/httpd start" stop = "/etc/init.d/httpd stop" depends on oracle check process oracle with pidfile /var/run/oracle.pid start = "/etc/init.d/oracle start" stop = "/etc/init.d/oracle stop" if failed port 9001 for 5 cycles then restart oracle-import oracle-export oracle . check process oracle with pidfile /var/run/oracle.pid start = "/etc/init.d/oracle start" stop = "/etc/init.d/oracle stop" if failed port 9001 for 3 cycles then restart check process oracle-import with pidfile /var/run/oracle-import.pid start = "/etc/init.d/oracle-import start" stop = "/etc/init.d/oracle-import stop" depends on oracle check process oracle-export with pidfile /var/run/oracle-export.pid start = "/etc/init.d/oracle-export start" stop = "/etc/init.d/oracle-export stop" depends on oracle ~/.monitrc /etc/monitrc /etc monitrc . ./monitrc monitrc . ~/.monit.pid ( ). /run/monit.pid ( /run). /var/run/monit.pid ( ). /etc/monit.pid ( /var/run). ~/.monit.state Monit . monit . Monit -s Monit . ~/.monit.id Monit . (ENVIRONMENT) Monit . Monit start/stop/restart exec . monit check program : MONIT_SERVICE ( monitrc) . start/stop/restart exec : MONIT_EVENT MONIT_DESCRIPTION MONIT_DATE ( RFC 822) MONIT_HOST start/stop/restart check process exec : MONIT_PROCESS_PID (PID). () 0 MONIT_PROCESS_MEMORY . () 0 MONIT_PROCESS_CHILDREN . () 0 MONIT_PROCESS_CPU_PERCENT (cpu%) . () 0 start/stop/restart check program exec : MONIT_PROGRAM_STATUS ( ). : SSLKEYLOGFILE SSL/TLS Monit SSLKEYLOGFILE= ( -v) . Wireshark SSL/TLS ( "Settings -> Protocols -> TLS -> (Pre)-Master-Secret log filename" Wireshark ). (SIGNALS) Monit SIGUSR1 . SIGTERM SIGINT Monit . Monit quit SIGTERM Monit . SIGHUP Monit . Monit Monit . (NOTES) . Monit -v tail -f . Monit -Iv . Monit monit CTRL^C ( SIGINT) . ( ) fetchmail Eric S. Raymond . ..SH " (COPYRIGHT)" (C) 2001-2026 Tildeslash Ltd. . . (SEE ALSO) GNU text utilities md5sum(1) sha1sum(1) openssl(1) glob(7) regex(7) https://mmonit.com 6.0.0 www.mmonit.com MONIT(1)