file_change.monitor - watch for changes in files
file_change.monitor -d -r -b base_directory file1 file2 ... fileN
file_change.monitor will watch specified files in a directory and trigger an alert when any monitored file changes, or is missing. File changes can optionally be logged using RCS.
This monitor was designed to monitor copies of the actual files. The files will often be copies of files mirrored from remote systems such as firewalls, routers, mail gateways, etc.
File changes are detected using MD5 checksums. Current file information is stored in the mon state directory in a file that corresponds to the base directory (with '/' replaced by '_'). The file contains a time stamp (in UNIX seconds), the MD5 checksum (in hexadecimal) and the name of the file. This file is generated automatically if it does not already exist.
The base directory for the files. All filenames are relative to this directory.
Log file changes using RCS. Each directory containing files to be checked should have an RCS subdirectory. The mon user needs access (possibly both file permissions and RCS authorization) to the RCS files. file_change.monitor will leave the file locked so that it will be able to check in the next revision.
This option should NOT be used when the original files are being monitored directly since there will be permission issues and because the current checkin process re-writes the original file (via ci -l).
Provide debugging information.
hostgroup fw_configs pr-ifw/pr-ifw1.html pt-ifw/pt-ifw.html
rd-ifw/rd-ifw1.html rd-ifw/rd-ifw2.html
watch fw_configs
service file_change
interval 5m
monitor file_change.monitor -r -b /home/httpd/html/sys_status
period wd {Sun-Sat}
alert mail.alert meekj@ieee.org
file_change.monitor does not currently recognize any file locking mechanism. There could be a problem if a file is being modified when the monitor runs. Using a program like rsync to copy files to the monitor directory should nearly eliminate this problem since copies are usually made to a temporary file and the rename is an atomic operation.
Jon Meek <meekj@ieee.org>
