Monit to restart Unbound

[ciaduck]

I'm trying to write a set of monit instructions to restart unbound if I start to see "SERVFAIL".
This condition seems to happen in my environment when there are WAN issues or there is a Multi-WAN failover.

It appears that "custom" creates a program service checker, but I'm unable to use the "content" keyword to check the output. The "content" rule type is giving an error that the service is not of type "file".

Monit docs say "content" is supported by the "program" service.
https://mmonit.com/monit/documentation/monit.html#PROGRAM-OUTPUT-CONTENT-TEST

In monit, I have a "service" called "dns_resolve_failure" that has the following config:

Code Select Expand

Type   Custom
Path   "/usr/bin/drill google.com"
Start  "/usr/local/sbin/configctl unbound start"
Stop   "/usr/local/sbin/configctl unbound stop"
Tests  "Nothing Selected"
I have a "service test" called "DNS_SERVFAIL" that looks like this:

Code Select Expand

Condition:  content = "SERVFAIL"
Action:     Restart
The services works fine, I can see the output of drill, but I'm unable to assign a "content" test to it.

I'm running OPNsense 25.7.11_9 currently.

I guess I could set up an "advanced" script in "/usr/local/etc/monit.opnsense.d/", but I was hoping I could do it through the GUI.

[OPNenthu]

The services works fine, I can see the output of drill, but I'm unable to assign a "content" test to it.

Not sure I fully understand the issue, but you can assign tests to a service by editing the service.  There's a 'Tests' field with a dropdown box where you can select one or more tests.

Is the issue that the tests aren't being listed?

EDIT: Now I get it.  I tried adding a 'content' type test to a 'custom' service and I see an error message from input validation: "Test <name> with type File Content not allowed for this service type."  It might be a GUI limitation or bug, if the Monit docs say it should be allowed.  You could try submitting a ticket to https://github.com/opnsense/core/issues

[ciaduck]

https://imgur.com/a/opnsense-test-content-not-allowed-RrRdwPn
When clicking "save" I get the error on the field. "Test DNS_SERVFAIL with type File Content not allowed for this service type"

[ciaduck]

I haven't opened a bug ticket, but I took the time to write a custom monit rule file. It wasn't difficult. This suffices for now.

Code Select Expand

root@OPNsense:~ # cat /usr/local/etc/monit.opnsense.d/unbound.conf
check program unbound_servfail with path "/usr/bin/drill google.com" timeout 60 seconds
        start program = "/usr/local/sbin/configctl unbound start" with timeout 30 seconds
        stop program = "/usr/local/sbin/configctl unbound stop"
        if content = "SERVFAIL" then alert
        if content = "SERVFAIL" then restart
        if 5 restarts within 5 cycles then unmonitor
Thanks!

[OPNenthu]

Awesome :)

I tend to shy away from custom files because they aren't carried over in a config restore and can get lost, but when you need them you need them...