[Xymon] How to use Xymon to monitor if a file has not been updated in the last 24 hours

[Josh Luthman]

This has worked for me for the last few months.  This tells me if the
cameras haven't been updated in 10 minutes or if there are any files in
/opt/powermonitor-notices/ (if there is then it tells me there is a power
outages somewhere).

This doesn't help directly, but perhaps consider monitor one directory
which contains the latest backup and then rotates them out of it.

client-local.cfg:
[FOOBAR.imaginenetworksllc.com]
file:/var/www/inxwireless/network/output.png
file:/var/www/inxwireless/BARFF/outage.png
file:/var/www/inxwireless/images/officecam.jpg
file:/var/www/inxwireless/images/gf36cam.jpg
file:`ls -1 /opt/powermonitor-notices/*`

hobbit-clients.cfg:
HOST=FOOBAR.imaginenetworksllc.com
        PROC    httpd 1 -1 red
        PROC    cron 1 -1 red
        PROC    ntpd  1 -1 red
        FILE    /var/www/inxwireless/network/output.png red mtime<600
        FILE    /var/www/inxwireless/BARFF/outage.png red mtime<600
        FILE    /var/www/inxwireless/images/officecam.jpg red mtime<600
        FILE    /var/www/inxwireless/images/gf36cam.jpg red mtime<600
        FILE    %/opt/powermonitor-notices/noticeofpowerfailure.* red
noexist

Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373


On Mon, Oct 8, 2012 at 2:38 PM, Don Kuhlman <Don.Kuhlman at schawk.com> wrote:

> Hi folks. I'm posting this to the list as a summary of what was done so
> that it's all in one place.  Hopefully, this may help others trying to do
> the same thing.  Much thanks to Larry B, Ryan N, Cynthia R, and Jeremy L
> for their input on this problem.
>
> Question:  How do I monitor if a file is less than 24 hours old in a Linux
> Directory and alert if none are found using Xymon?
> Purpose:  To validate that SQL Backups are running by checking for
> existence of a SQL dump file being created daily by a cron job at various
> times.
>
> Description:  We run cron jobs to do mysql dumps on various hosts every
> morning at 00:05 and 00:10 am.
> We also run a cron job at 00:15 to delete files older than 8 days. Not
> doing any monitoring for this event though.
>
> Requirement: We need to have our Xymon server monitor the directories and
> alert/email if there has not been a new file created within the past 24
> hours.  There can be more than one file created since there can be more
> than one database on a host.  This results in us needing to search for
> multiple files in the same directories with the same timestamp requirement
> being < 24 hour old.
>
> Logic - We use the Xymon agent to check a directory for a file that is
> created with a name of ???????_backup.YYYYmmdd.sql
> There may be more than one file created during each dump. So we need to
> look for any file that matches the date value.
> Our logic is that in order to verify our dumps are working, we should
> always see new files that are less than 24 hours old in the target
> directories. We will use Xymon to watch for specific files and alert if
> the file doesn't exist.
> This is done using a combination of a find command in the
> client-local.cfg, a regex in the analysis.cfg, and the corresponding
> alerts.cfg to send the email to the right people.
>
> Here are the values we used in our Xymon configurations to check for files
> and then only return two entries to the analysis engine, and alert if
> either of these two files are older than 24 hours. That would signal to us
> that a dump did not occur the night before.
>
> Client-local.cfg
> # This will cause the Xymon client agent to do a find command on the
> directory /Volumes/MySQL_Backups for any file ending in
> # .sql. It will pipe the output to the sort command to reverse the order
> (eg newest files on top) and then return only the
> # first two lines of the results sorted by the YYYYmmdd values and not the
> first part of the filename.
>
> [hostservernamegoeshere]
> file:`find /Volumes/MySQL_Backups/ -name '*.sql' |sort -r  -t"_" -k3 -k1
> -k2 | head -2`
>
> This returns two files as below because they are the newest files found:
> /Volumes/MySQL_Backups/mysql_backup_20120923.sql - file date/time Sept 23
> 2012 00:10
> /Volumes/MySQL_Backups/othersql_backup_20121008.sql - file date/time Oct 8
> 2012 00:10
>
>
>
> Analysis.cfg
>
>
> # This will cause the Xymon analysis engine to look at the results (from
> above) for this host and
> # if either of the two files returned have a modified time greater than 24
> hours it will create a red alert condition.
> HOST=hostservernamegoeshere
> FILE %/Volumes/MySQL_Backups/.*\.sql red mtime<86400
>
> Alerts.cfg
> # This line will send an email to the recipient when the Xymon analysis
> engine creates a files event for this host
> # it will send it every 5 minutes using a custom perl email script
> HOST=hostservernamegoeshere SERVICE=files
> script /usr/lib64/xymon/server/ext/html_mail.pl alertrecipient at company.com
> FORMAT=TEXT REPEAT=5m
>
>
>
> Here is the resulting xymon webpage alert and email if either of the two
> files does NOT exist:
>
> red Mon Oct  8 11:22:43 CDT 2012 - Files NOT ok
>
>  /Volumes/Backups/MySQL_Backups/mysql_backup_20120923.sql
> CLIENT=hostservernamegoeshere&SECTION=file:/Volumes/MySQL_Backups/mysql_bac
> kup_20120923.sql>
> File was modified 850245 seconds ago - should be <86400
>
>
> Green Mon Oct 8 11:22:43 CDT 2012 - File OK
>  /Volumes/Backups/MySQL_Backups/othersql_backup_20121008.sql
> CLIENT=twist01_dev&SECTION=file:/Volumes/MySQL_Backups/othersql_backup_2012
> 1008.sql>
>
>
>
> Don K
>
>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20121008/f0b04713/attachment.html>