monit check file do not read file content when in unmonitor status

[Southbridge]

my config example

check file error_log with path /var/log/httpd/error_log
    if match 'exit signal Aborted' then exec 'httpd-restart.sh'
    if match 'exit signal Aborted' 2 cycles then exec "/bin/bash -c '/usr/bin/monit unmonitor error_log && /bin/sleep 3600 && /usr/bin/monit monitor error_log'"

i check log on keyword, and launch varios scripts... to limit count of alerts i do unmonitor && sleep 1hour && monitor trick ....

but when "check file" in unmonitor state log position is not changed and when state change back to monitor all lines in /var/log/httpd/error_log for last hour processed by monit and monit restart apache again and again (if in last hour line exists matched string)....

may be set check position to end of log file, when monitor action do it ?? and monitor only new events in log files ?

monit version 5.20

[Tildeslash]

Fixed: Issue #547: If the file service is unmonitored or stopped, the read position in the content test is reset to the end of the file if monitoring is enabled again, so the content which is added while the service is not monitored will be ignored.

→ <<cset 407b0d7c4089>>

[Southbridge]

very big senks

[Ulrich Windl]

Actually I consider this as a mis-feature: unmonitor followed by monitor is different from ignoring events that occurred in between. If monit crashed, and I restart monit, I expect it to report any changes since the last monitor status. Maybe a better solution (and more general) would have been to add something like "ignore for <duration>" that would not send alerts, but will update the monitoing status (as if alerts had been sent).

[Tildeslash]

@shortly i think the current behaviour is more clear then the original one and more close to other tests:

For example if the user performs service modifications/updates which are expected to generate file entries that would match the pattern, he can now unmonitor the service without getting these false-positives after the monitoring is enabled again.

It is now equal to other tests behaviour: for example if you unmonitor the process or host and enable monitoring again (let's say in one hour), monit won't send alerts that the process was 3x stopped during that "unmonitored" hour or that the host ping 1x failed.