Suppress Monit message 'Monit instance changed' on stop/start

Question

I have monit installed on some user laptops/desktop so it can make sure a couple processes are always running/get restarted as needed. But since the devices are regularly shutdown/restarted I frequently receive a message like below which I do not want or care about, since they are telling me that the system was restarted. I want to suppress the messages that seem to automatically happen when monit starts/stops.

Subject: monit alert -- Monit instance changed

Service     - system_slaveone
Event       - Monit instance changed
Action      - start
Date        - Thu, 18 Apr 2013 07:53:51
Host        - slaveone.example.local (slaveone)
Description - Monit started.

But once the system is up, I do want to get some alerts about a couple services/resources that I do want to be notified about, so simply disabling email isn't want I want to do.

How can I suppress the message on startup/restart without completely disabling email?

Desirable feature on a server. Not so much on a workstation. — ewwhite, Apr 18 '13 at 20:35

score 8 · Answer 1 · answered Nov 10 '14 at 11:26

To particularly filter out the e-mails when monit starts/stops, you can use the instance event filter:

set alert myaddress@foo.bar not on { instance }

As in the documentation:

Event:     | Failure state:            | Success state:              
---------------------------------------------------------------------
...
INSTANCE   | "Monit instance changed"  | "Monit instance changed not"
...

score 1 · Accepted Answer · answered Apr 29 '13 at 19:54

1

Oh, sure...

To suppress Monit alerts for a particular check, you need to use the noalert directive.

For instance, I can have a check for the cron daemon, which restarts weekly. Maybe I don't want that email in my inbox every Sunday...

check process cron
    noalert zoredache@mdmarra.net
    with pidfile "/var/run/crond.pid"
    start program = "/sbin/service crond start"
    stop program = "/sbin/service crond stop"

This works for any Monit check, so to handle the instance alarms for the system, you can suppress by adding the noalert under the check system localhost entry:

  check system localhost
    noalert zoredache@mdmarra.net

Try it. This still leaves any real services/daemons under Monit protection, but reduces the chatter. Great for misbehaving applications...

check process nslcd
        with pidfile "/var/run/nslcd/nslcd.pid" every 2 cycles
        noalert ewwhite@bra**ers.com
        start program = "/sbin/service nslcd start"
        stop program = "/sbin/service nslcd stop"
        if 10 restarts within 11 cycles then timeout
        if cpu usage > 95% for 11 cycles then restart
        if totalmemory > 128 MB then restart

answered Apr 29 '13 at 19:54

ewwhite

194,921
91
434
799

Applying the alert configuration to the `check system localhost` is what I was looking for. I must have missed that in the man page. – Zoredache Apr 29 '13 at 21:30
1

It's not well documented. I had to experiment on my own 6 months ago to find it. Bummer is that you have to specify the exact mail addresses to be excluded. – ewwhite Apr 29 '13 at 21:34
But won't that disable all cron alerts, not just the expected weekly restart? – Johan Sep 01 '14 at 09:54
@Johan Nope.... – ewwhite Sep 01 '14 at 12:20
How does monit know the noalert only applies to the weekly restart, not an unexpected problem during the week? What've I missed? – Johan Sep 02 '14 at 13:48

Suppress Monit message 'Monit instance changed' on stop/start

2 Answers2

Linked