Monitoring files

With Checkmk you can monitor files for number, size and age, individually or in groups. This function can be used in many different ways, such as monitoring the success of backup strategies for example: Are any of the backups older than X days? Is one of the backups suspiciously large or small? You can also check company-wide file servers to see if users are misusing them as private storage for movies, or keep an eye on classic swap files or volatile files like containers.

The basic procedure is in accordance with the Checkmk standard: A plug-in/configuration is installed in the agent which brings the desired information on files or file groups into the monitoring. There, corresponding rule sets are used to determine which properties lead to which statuses.

The actual filtering, i.e. determining which data actually ends up in the monitoring, takes place in the agent. You can use globbing patterns to recursively include files from entire directories, for example, or only certain file types or even individual files. Using globbing patterns such as /myfiles/*.*, you may end up with enormously large file lists, even though you may only be interested in particularly old or large files. Due to this fact, there are currently two agent and associated monitoring rule sets: The older fileinfo is already built into the agent and filters only by globbing pattern/path, the newer mk_filestats must be installed separately as a plug-in and filters by other properties.

There are other differences between mk_filestats and fileinfo, which we will explain below. The most important difference, however, is that mk_filestats can only monitor Linux hosts, while fileinfo can also monitor Windows hosts. For Linux hosts, you should usually use the more up-to-date mk_filestats.

If you want to see the rule sets for the two variants side by side for the sake of clarity, simply type size age in the Setup menu. The rules for individual files and groups are named (largely) identically, but the mk_filestats rules are explicitly identified as such. Both variants of service rules are additionally available as enforced services.

Differences between the two variants exist at the agent and service levels. To begin with, here are the basic theoretical differences. You will find specific details later in the instructions for the mk_filestats agent plug-in as well as for the agent’s fileinfo.

In the case of the agent, mk_filestats is distinguished by two options that fileinfo lacks: Firstly, mk_filestats offers the additional filtering options already mentioned, namely by file size, number and name, the latter in the form regular expressions. For example, with a /myfiles/* globbing pattern, you could bring only those files into monitoring that are larger than 1 KB and contain backup somewhere in the filename. On the other hand, with mk_filestats, file groups are also specified directly in the plug-in configuration, simply by creating multiple filters, each of which then ends up as its own section in the agent output and which can later be addressed by rules via the section names.

For service monitoring rules, the approaches used by mk_filestats and fileinfo differ more in their details. Both can restrict evaluations to specific time periods, but only fileinfo allows explicit specification of time windows per day directly in the rule. Also exclusively, fileinfo can configure so-called conjunctions for file groups. This associates a set of conditions for each status, so for example: "The status goes to CRIT as soon as the oldest file in the group is exactly 5 hours old and the smallest file is exactly 8 megabytes." In turn, for file groups, mk_filestats provides the option to define outliers: Suppose a file group is supposed to go to CRIT as soon as the group size exceeds 2 gigabytes. However, if the group should not go to CRIT when a certain single file alone exceeds 1 gigabyte (such as a temporary file), you can define this as a special case, overriding the group rule on a case-by-case basis.

An overview of the differences:

In the following chapters you will see the two functions individually in practical examples — the differences and features described should then become clearer. mk_filestats itself also provides detailed information via the call filestats.py --help.

The following example shows the procedure for groups of files. For individual files the procedure is identical, there are simply fewer options. Suppose you want to monitor a group of a certain number of backup files (mybackup_01.zip etc.) and these files should not fall below a minimum size, then you can proceed as follows:

Monitoring files with fileinfo is basically the same as with mk_filestats, so the procedure here is a bit shortened, but is once again for file groups.

As always, all file paths for the Checkmk server are relative to the site directory (e.g. /omd/sites/mysite).