Take the 2-minute tour ×

I am trying to get an alert from monit if it fails to restart a service 5 times, but I get a syntax error

/etc/monit/monit.d/engine.conf:5: Error: syntax error 'alert'

any idea what's wrong with it?


set daemon  120
set mailserver localhost

set eventqueue
    slots 100           # optionaly limit the queue size

set httpd port 2812
  allow localhost

set logfile syslog

set alert root@localhost

include /etc/monit/monit.d/*

/etc/monit/monit.d/engine.conf (The only file in monit.d) :

check process engine with pidfile /var/run/engine.pid
   group engine
   start program = "/etc/init.d/engine start"
   stop  program = "/etc/init.d/engine stop"
   if 5 restarts within 5 cycles then alert


# monit -V
This is monit version 4.10.1
share|improve this question

5 Answers 5

It looks like support for this was added in monit 5.1
From the changelog at http://mmonit.com/monit/dist/CHANGES.txt :

Version 5.1


It is now possible to define any action for the restart timeout rule.
  Multiple restart timeout rules can also be defined. Example:
  if 3 restarts within 5 cycles then exec "/foo/bar"
  if 8 restarts within 10 cycles then unmonitor

I was trying to use the exact same syntax as you (for the exact same reason), and found it was working on one server but another. When I compared versions, I found one was 5.2.5 and the other was 4.10.1

So the answer it seems is to upgrade to at least 5.1

share|improve this answer
I`ll have to try that, thanks. –  Omry Aug 11 '11 at 13:07

I think it looks fine. Have you tried re-typing that line to rule out any hidden characters messing up the line?

share|improve this answer
yes, many times. it will accept timeout, but not alert. –  Omry Apr 30 '10 at 10:46

Have you got a set alert <email_address> defined prior to this configuration?

share|improve this answer
yes I have it. see updated question. (also added monit version) –  Omry May 2 '10 at 13:00

Ok,found the error. alert is not a valid event and you need to specify an event that will generate an alert. Without a specific event monit wouldn't know what to say to you.

List of events from the manpage:

This is the list of events you can use in a mail-filter: uid, gid, size, nonexist, data, icmp, instance, invalid, exec, changed, timeout, resource, checksum, match, timestamp, connection, permission

In your case I'd recommend exec. The full list of messages is:

    Event:    | Failure state:          | Recovery state:
    CHANGED   | "Changed"               | "Changed back"
    CHECKSUM  | "Checksum failed"       | "Checksum passed"
    CONNECTION| "Connection failed"     | "Connection passed"
    DATA      | "Data access error"     | "Data access succeeded"
    EXEC      | "Execution failed"      | "Execution succeeded"
    GID       | "GID failed"            | "GID passed"
    ICMP      | "ICMP failed"           | "ICMP passed"
    INSTANCE  | "Monit instance changed"| "Monit instance changed not"
    INVALID   | "Invalid type"          | "Type passed"
    MATCH     | "Regex match"           | "No regex match"
    NONEXIST  | "Does not exist"        | "Exists"
    PERMISSION| "Permission failed"     | "Permission passed"
    RESOURCE  | "Resource limit matched"| "Resource limit passed"
    SIZE      | "Size failed"           | "Size passed"
    TIMEOUT   | "Timeout"               | "Timeout recovery"
    TIMESTAMP | "Timestamp failed"      | "Timestamp passed"
    UID       | "UID failed"            | "UID passed"
share|improve this answer
Interesting. I tried to change my line to "if 5 restarts within 5 cycles then exec" but it was not accepted. looks like only timeout is accepted there. my problem with timeout is that I will have to manually remonitor the service. what I really want to get get notified if a service fails to start too many times, but have monit keep trying forever. –  Omry May 3 '10 at 9:13
Something like "if changed pid 5 times within 5 cycles then alert"? –  jneves May 3 '10 at 21:29

I noticed something strange with alert and unmonitor parameter in monit 5.4-2 : If you use unmonitor parameter in the alert config line, it generates a syntax error :

alert security@foo.bar on { uid, gid, unmonitor
    } with the mail-format { subject: Alarm! }

When restarting monit, you get :

Error: syntax error 'unmonitor'

I solved this problem removing unmonitor in arguments :

alert security@foo.bar on { uid, gid
    } with the mail-format { subject: Alarm! }

I can't see the syntax change... Strange... Isn't it ?

share|improve this answer
How is this relevant to the question? –  squillman Nov 26 '13 at 14:11

Your Answer


