Invalid type when performing a filecheck

[Daniel Tran]

Using monit version 5.22 on RedHat 6. When performing a file check such as:

check file x with path /path/to/x
  if mtime is older than 1 minute then alert

or

check file x with path /path/to/x
  if timestamp is older than 1 minute then alert

or

check file x with path /path/to/x
  if timestamp > 1 minute then alert

Monit status shows the file as invalid-type and therefore the monitoring alert would not work. The file I am trying to monitor is just a log/text file with content that looks like:

Server Time: Thu, 11 May 2017 04:00:01 -0700
Execute scheduled task: OU blog maintenance jobs (mod_oublog\task\cron_task)
... started 04:00:01. Current memory use 15.1MB.
... used 1 dbqueries
... used 0.0048840045928955 seconds
Scheduled task complete: OU blog maintenance jobs (mod_oublog\task\cron_task)
Execute scheduled task: Check for updates (core\task\check_for_updates_task)
... started 04:00:02. Current memory use 16.1MB.
Automatic check for available updates not enabled, skipping.
... used 0 dbqueries
... used 0.00094103813171387 seconds
Scheduled task complete: Check for updates (core\task\check_for_updates_task)

[Tildeslash]

Strange, have you checked that the user running Monit has read-permission on that file? If yes, could you upload the file here so we can take a look?

[Daniel Tran]

The permission on the file is 644 (-rw-r--r--) and I verified that "monit" user can read the file. I'll gzip the text file and will upload it. Thanks for helping

[Tildeslash]

Please can you send output of following commands?:

getfacl /path/to/x
stat /path/to/x

Please also attach the exact error as reported by monit + monit logfile.

[Tildeslash]

Thanks, looks like a perfect fine text/logfile to me. Monit had no problem monitoring and reading the file as the screenshot below shows. Is this something that happens all the time? I.e. try restart Monit. If still a problem, please report more details as we requested above. But first it could be a problem with your disk and or low memory. Use fsck or similar to check that the file does not reside on a bad partition.

[Daniel Tran]

Wow - very strange . Looks like it is working for you like it should. Today is the first time I try to monitor a file to make sure that it is being updated so i created the rule for it. It didn't work with version 5.21 or 5.22. I've restarted monit several time. Monit is working correctly with all the other stuff i'm monitoring except for this one.

• getfacl output:

getfacl moodlecron.out

file: moodlecron.out

owner: moodle

group: moodle

user::rw- group::r-- other::r--

• ls -al output:

-rw-r--r-- 1 moodle moodle 8612747 May 11 14:26 moodlecron.out

• Monit log showing:

[PDT May 11 14:29:43] info : Starting Monit 5.22.0 daemon with http interface at [*]:2812

[PDT May 11 14:29:43] info : 'hostname.x.x' Monit 5.22.0 started

[PDT May 11 14:29:44] error : 'moodlecron.out' is neither a regular file nor a socket

[PDT May 11 14:29:45] info : 'moodlecron.out' trying to restart

[PDT May 11 14:29:45] error : 'rootfs' filesystem flags changed to rw,noatime,barrier=1,data=ordered

• Monit rule:

check file moodlecron.out with path /home/moodle/logs/moodlecron

if mtime is older than 1 minute then alert

[Daniel Tran]

Yikes ... I think it's not working because I configured the filesystem with noatime in /etc/fstab ?

/dev/mapper/VolGroup0-LogVolRoot / ext4 defaults,noatime 1 1

[Daniel Tran]

Well ... I tried on another system without "noatime" and still the same problem

[Tildeslash]

The noatime is not related to this problem - the rootfs related error is due to overlay mount (fixed in next Monit release: https://bitbucket.org/tildeslash/monit/issues/602/monit-repeatedly-detects-filesystem-flags)

Is /home/moodle/logs/moodlecron regular file or symlink? Please can you send the output of:

stat /home/moodle/logs/moodlecron

The output of "ls -la" and "getfacl" show different file name then the one configured in Monit:

moodlecron.out (full path unknown) vs. /home/moodle/logs/moodlecron in monit config file (missing ".out" postfix)

The "check file" requires a regular file - not symlink.

[Daniel Tran]

/home/moodle/logs/moodlecron/moodlecron.out is a regular file. Not symlink.

The file is moodlecron.out. The path is /home/moodle/logs/moodlecron/

stat /home/moodle/logs/moodlecron/moodlecron.out
  File: `/home/moodle/logs/moodlecron/moodlecron.out'
  Size: 1468675     Blocks: 2880       IO Block: 4096   regular file
Device: fd01h/64769d    Inode: 2624953     Links: 1
Access: (0644/-rw-r--r--)  Uid: (  502/  moodle)   Gid: (  502/  moodle)
Access: 2017-05-12 04:10:15.111306852 -0700
Modify: 2017-05-12 07:08:21.819373856 -0700
Change: 2017-05-12 07:08:21.819373856 -0700

stat /home/moodle/logs/moodlecron/
  File: `/home/moodle/logs/moodlecron/'
  Size: 4096        Blocks: 8          IO Block: 4096   directory
Device: fd01h/64769d    Inode: 2624736     Links: 2
Access: (0775/drwxrwxr-x)  Uid: (  502/  moodle)   Gid: (  502/  moodle)
Access: 2016-10-06 11:36:13.385966946 -0700
Modify: 2017-05-12 04:10:15.111306852 -0700
Change: 2017-05-12 04:10:15.111306852 -0700

getfacl home/moodle/logs/moodlecron/moodlecron.out
# file: home/moodle/logs/moodlecron/moodlecron.out
# owner: moodle
# group: moodle
user::rw-
group::r--
other::r--

ls -al home/moodle/logs/moodlecron/moodlecron.out
-rw-r--r-- 1 moodle moodle 2078103 May 12 07:37 home/moodle/logs/moodlecron/moodlecron.out

monit config:

###############################################################################
## Check to see if moodle cron is running
## We do this by checking for changes in file
## /home/moodle/logs/moodlecron/moodlecron.out
##
## read here: https://mmonit.com/monit/documentation/#TIMESTAMP-TEST
###############################################################################
#
check file moodlecron.out with path /home/moodle/logs/moodlecron
#   if timestamp > 1 minute then alert
   if mtime is older than 1 minute then alert

[Tildeslash]

Thanks for data, i see the problem - it's small misunderstanding: the check syntax is as follows:

check file <unique service name> with path <path>

The service name is just custom string used for the service in monit, it doesn't have to be the same as the file name and it's not concatenated to the path.

In your case the configuration checks the parent directory "/home/moodle/logs/moodlecron", not the file "/home/moodle/logs/moodlecron/moodlecron.out" (hence the type error).

The correct configuration will be like this:

check file moodlecron.out with path /home/moodle/logs/moodlecron/moodlecron.out

[Daniel Tran]

Thank you !!!!

[Francisco Murcia]

Thank you for resolving this issue, it is possible to update monit manual with this fix? I tried to resolve this problem during 5 hours until finally I got here!

[Martin Pala]

Francisco, which part of the manual was confusing? The text in the manual more or less corresponds the description above: https://mmonit.com/monit/documentation/monit.html#Service-checks

[Francisco Murcia]

It is now clear, thanks!