Is Monit no longer emailing you, or even reading /var/log/auth.log to tell you when somebody logs in?

Well, I deleted everything in /var/lib/monit/. Still wasn’t working, but there was no events folder. So, try deleting everything in /var/lib/monit/events.

If deleting the contents of the events folder doesn’t work, then just delete everything, and remake the events folder.

rm -fr /var/lib/monit/*
mkdir /var/lib/monit/events
chmod 700 /var/lib/monit/events

And, if you don’t have the ssh-logins file:

cat ssh-logins
check file ssh_logins with path /var/log/auth.log
  if match "Accepted publickey" then alert

That was stolen from some other site, that I’m too lazy to find.

Update 9/19/20
It happened again, after my server rebooted for an unknown reason. Maybe the server lost power. Guess their backup power didn’t work.

I had to delete everything in /var/lib/monit.

Or they did a hard reboot of my VM for some reason.

Probably something got corrupted that caused monit to fail.

Categories:

Updated: