Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to get an alert from monit if it fails to restart a service 5 times, but I get a syntax error

/etc/monit/monit.d/engine.conf:5: Error: syntax error 'alert'

any idea what's wrong with it?


set daemon  120
set mailserver localhost

set eventqueue
    basedir /var/monit  # set the base directory where events will be stored
    slots 100           # optionaly limit the queue size

set httpd port 2812
  allow localhost

set logfile syslog

set alert root@localhost

include /etc/monit/monit.d/*

/etc/monit/monit.d/engine.conf (The only file in monit.d) :

check process engine with pidfile /var/run/
   group engine
   start program = "/etc/init.d/engine start"
   stop  program = "/etc/init.d/engine stop"
   if 5 restarts within 5 cycles then alert


# monit -V
This is monit version 4.10.1
share|improve this question

It looks like support for this was added in monit 5.1
From the changelog at :

Version 5.1


It is now possible to define any action for the restart timeout rule.
  Multiple restart timeout rules can also be defined. Example:
  if 3 restarts within 5 cycles then exec "/foo/bar"
  if 8 restarts within 10 cycles then unmonitor

I was trying to use the exact same syntax as you (for the exact same reason), and found it was working on one server but another. When I compared versions, I found one was 5.2.5 and the other was 4.10.1

So the answer it seems is to upgrade to at least 5.1

share|improve this answer
I`ll have to try that, thanks. – Omry Aug 11 '11 at 13:07

I think it looks fine. Have you tried re-typing that line to rule out any hidden characters messing up the line?

share|improve this answer
yes, many times. it will accept timeout, but not alert. – Omry Apr 30 '10 at 10:46

Have you got a set alert <email_address> defined prior to this configuration?

share|improve this answer
yes I have it. see updated question. (also added monit version) – Omry May 2 '10 at 13:00

Ok,found the error. alert is not a valid event and you need to specify an event that will generate an alert. Without a specific event monit wouldn't know what to say to you.

List of events from the manpage:

This is the list of events you can use in a mail-filter: uid, gid, size, nonexist, data, icmp, instance, invalid, exec, changed, timeout, resource, checksum, match, timestamp, connection, permission

In your case I'd recommend exec. The full list of messages is:

    Event:    | Failure state:          | Recovery state:
    CHANGED   | "Changed"               | "Changed back"
    CHECKSUM  | "Checksum failed"       | "Checksum passed"
    CONNECTION| "Connection failed"     | "Connection passed"
    DATA      | "Data access error"     | "Data access succeeded"
    EXEC      | "Execution failed"      | "Execution succeeded"
    GID       | "GID failed"            | "GID passed"
    ICMP      | "ICMP failed"           | "ICMP passed"
    INSTANCE  | "Monit instance changed"| "Monit instance changed not"
    INVALID   | "Invalid type"          | "Type passed"
    MATCH     | "Regex match"           | "No regex match"
    NONEXIST  | "Does not exist"        | "Exists"
    PERMISSION| "Permission failed"     | "Permission passed"
    RESOURCE  | "Resource limit matched"| "Resource limit passed"
    SIZE      | "Size failed"           | "Size passed"
    TIMEOUT   | "Timeout"               | "Timeout recovery"
    TIMESTAMP | "Timestamp failed"      | "Timestamp passed"
    UID       | "UID failed"            | "UID passed"
share|improve this answer
Interesting. I tried to change my line to "if 5 restarts within 5 cycles then exec" but it was not accepted. looks like only timeout is accepted there. my problem with timeout is that I will have to manually remonitor the service. what I really want to get get notified if a service fails to start too many times, but have monit keep trying forever. – Omry May 3 '10 at 9:13
Something like "if changed pid 5 times within 5 cycles then alert"? – jneves May 3 '10 at 21:29

I noticed something strange with alert and unmonitor parameter in monit 5.4-2 : If you use unmonitor parameter in the alert config line, it generates a syntax error :

alert on { uid, gid, unmonitor
    } with the mail-format { subject: Alarm! }

When restarting monit, you get :

Error: syntax error 'unmonitor'

I solved this problem removing unmonitor in arguments :

alert on { uid, gid
    } with the mail-format { subject: Alarm! }

I can't see the syntax change... Strange... Isn't it ?

share|improve this answer
How is this relevant to the question? – squillman Nov 26 '13 at 14:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.