check program content doesn't notify on success

[Dystopian1]

check program content alerts repeatedly on fail but doesn’t alert on success afterwards.

Repro:

1. Create temp file echo ok >/tmp/test

2. Add this config to monit:

   none check program test path "/bin/cat /tmp/test" if content != "^ok$" then alert

   Reload monit.

3. Trigger alert: echo bad >/tmp/test

4. Wait for alert in mail and log, check out if it’s repeated (alert reminder should be disabled):

   Content match test content match on program output: bad

   Also web status should have Status==Content match.

5. Cancel alert: echo ok >/tmp/test

6. Wait for no-alert message in log but no “ok” email.

Here what I have in log (set daemon 20):

[2023-01-01T14:30:32+0300] error    : 'test' content match on program output:
bad

[2023-01-01T14:30:52+0300] error    : 'test' content match on program output:
bad

[2023-01-01T14:31:12+0300] info     : 'test' content doesn't match on program output:
ok

But only 2 emails with “bad” message. Also it should be mentioned that I make “ok” file right after the 1st email but there are always the 2nd alert email and log message after that and only then “ok” message.

Checked on Debian 11 and FreeBSD 12.

[Lutz Mader]

Hello Dystopian1,
indeed, this is the way how monit use the "if content" test in a "check program" check, see http://mmonit.com/monit/documentation/monit.html#PROGRAM-OUTPUT-CONTENT-TEST.

The "if status" test use an implicit "else if succeeded" success action but the "if content" does not.

With regards,
Lutz

p.s.

The "if content" test in the check "check program" and "check file" work similar, see https://mmonit.com/monit/documentation/monit.html#FILE-CONTENT-TEST also.

[Dystopian1]

It isn't really clear to me from documentation. Also repeating alert makes if content quite useless service for notifying. Anyway if you think this is normal monit behavior I don’t mind closing this issue.

[Lutz Mader]

Hello Dystopian1,
this is an ugly behaviour, from my point of view.

Also repeating alert makes if content quite useless service for notifying.

Someone should spend some time to make the "if content" test more handy in the future, see my Issue #1045.

Do not close your issue, wait until someone from tildeslash have a look to the issue, please.

With regards,
Lutz

[Lutz Mader]

Hello,
based on the question, I plan to provide a/my tests that combines the functions of the "status" and "content" test.
The tests check the program output content according to the "content" test, but will behave like the "status" test.

if string <string> <!=|=> <regex> then <action>
if integer <num> <!=|=|>|>=|<|<=> <regex> then <action>
if float <num> <!=|=|>|>=|<|<=> <regex> then <action>

The "regex" is used in the tests to determine the data to check in the output.
And "string" and "num" are the given data to be checked.

If there is any interest here, I'll create a pull request.

The syntax can also be modified, since these tests are not yet generally available and some few final tests are needed to make these tests generally available. On the other hand, I am not completely satisfied with the used syntax, today.

Have a nice week,
Lutz