Monitoring Files: Is it there? And has it changed?
APM includes several ways to monitor files. For many users, there are business critical files that must be present and unchanged. If the file is changed or deleted, a critical incident has occurred.
How do you know if a file is still there? The File Existence Monitor is a straightforward monitor that will periodically check for the presence of a specific file. If the file is present, the monitor is up. If the file is absent, the monitor is down. You can also use the File Existence Monitor to ensure that a file is not present. You might use this on a system where an application error will generate a log file. You can set the File Existence Monitor to show up if there is no log file, but down if the log file has been generated. This monitor doesn’t report any statistic, just up, down, and response time.
There are actually two ways to monitor for file changes: The File Change Monitor and the File Age Monitor
The more obvious is the File Change Monitor. With this monitor, you identify a file by specifying the path. Next, browse to the target file and take a snapshot of the file by clicking “update checksum”. The checksum is stored in the Orion database and provides a baseline, and each time APM runs the File Change Monitor, it will take a snapshot of the current state of the file and compare it with the checksum in the database. If the checksum matches, the monitor is up. If the checksum doesn’t match the monitor is down. The checksum will fail to match if any change at all has been made. If the file content or security is modified, the monitor will go down. As a statistic, the file change monitor will report the number of hours since the file was changed. So if the file has not been changed, the hours will continue to grow. What happens if the file has been changed intentionally? In that case, you’ll need to update the checksum and restart the clock.
Read the entire article here, Monitoring Files: Is it there? And has it changed?
via the fine folks at SolarWinds