APM includes several ways to monitor files. For many users, there are business critical files that must be present and unchanged. If the file is changed or deleted, a critical incident has occurred.
How do you know if a file is still there? The File Existence Monitor is a straightforward monitor that will periodically check for the presence of a specific file. If the file is present, the monitor is up. If the file is absent, the monitor is down. You can also use the File Existence Monitor to ensure that a file is not present. You might use this on a system where an application error will generate a log file. You can set the File Existence Monitor to show up if there is no log file, but down if the log file has been generated. This monitor doesn’t report any statistic, just up, down, and response time.
There are actually two ways to monitor for file changes: The File Change Monitor and the File Age Monitor
The more obvious is the File Change Monitor. With this monitor, you identify a file by specifying the path. Next, browse to the target file and take a snapshot of the file by clicking “update checksum”. The checksum is stored in the Orion database and provides a baseline, and each time APM runs the File Change Monitor, it will take a snapshot of the current state of the file and compare it with the checksum in the database. If the checksum matches, the monitor is up. If the checksum doesn’t match the monitor is down. The checksum will fail to match if any change at all has been made. If the file content or security is modified, the monitor will go down. As a statistic, the file change monitor will report the number of hours since the file was changed. So if the file has not been changed, the hours will continue to grow. What happens if the file has been changed intentionally? In that case, you’ll need to update the checksum and restart the clock.
In contrast, the File Age Monitor is much simpler. Like the File Change Monitor, you specify a file. But there is no checksum. This monitor checks the Last Modified date of the file and compares the current date and calculates the age of the file in hours. The file age is reported as a statistic.
Why do you need both File Change and File Age? The File Change Monitor would be most useful if you have a file that needs to be in a particular state. Any change from that state is a problem. File Age is a simple check on whether the file has been changed. You could alert on a change, but you might also alert on a lack of change. Imagine that you have a file that should be updated every 5 minutes. You could trigger an alert if the age of the file is greater than 5 minutes.
APM also includes monitors that will check the size of a file, the number of files in a directory, and the size of a directory. How do you monitor files? Are there any common file monitoring scenarios that we’re missing?