May the source be with you, but remember the KISS principle ;-)
Contents Bulletin Scripting in shell and Perl Network troubleshooting History Humor

Mon -- King of Simplicity among Unix Monitoring Packages

News Slightly Skeptical View on Enterprise Unix Administration Recommended Links Event correlation Perl Pipes Probe Architecture
Mon Ganglia Spong Nagios Big Sister SAR SSH-based monitoring
Syslog monitoring Enterprise Logs Collection and Analysis Infrastructure Logwatch Syslog Anomaly Detection Analyzers Dell DRAC HP iLO IPMI
HP Operations Manager Unix Configuration Management Tools Baseliners Simple Unix Backup Tools Oracle Enterprise Manager  Tivoli TEC
Filesystem free space monitoring Website monitoring Web log analysis Sample simple monitoring scripts Performance monitoring Humor Etc

Mon ( mon download SourceForge.netand page) is the king of simplicity among monitoring products that we reviewed here. It was written by Jim Trocki and released under GPL.

Active development slowed considerably after 2001. Still there have been several new features added and bugs fixed in mon 1.2.0.

The author wisely resisted the overcomplexity trap and mon remains simple and capable product with the transparent code base, the codebase that can be easily understood by wide audience of system administrators. In one of his posts David Nolan aptly stated:

My best summary of Mon is that its monitoring for sysadmins. Its not pretty, its not designed for management, its designed to allow a sysadmin to automate the performance monitoring that might otherwise be done ad-hoc or with cron jobs.

It doesn't trivially provide the typical statistics gathering that many bean-counters are looking for, but its extensible and scalable in amazing ways. (See recent posts on this list about one company deploying a network of 2400 mon servers and 1200 locations, and my mon site which runs 500K monitoring tests a day, some of those on hostgroups with hundreds of hosts.)

This is really a quintessential monitoring package "by sysadmin for sysadmins" -- simple, very flexible (each probe can be heavily modified to suit your needs without much digging into documentation) but functional enough to provide great value. And in his reply to the David Nolan post the author of the mon stated:

... the design of mon is extremely flexible, and was purposefully built the way it was in order to leverage other tools which already exist. it follows the traditional Unix design philosophy, which i think is the most elegant system design in existence to this very day. it is all about having a mechanism to connect together lots of smaller tools which do one job very well in order to solve larger problems, rather than writing a large tool for each new problem.

you can also think of this design in terms of using natural language, words and grammar to phrase something you want to say. perl itself also follows this model. larry wall is a linguist (a cunning one at that, sorry couldn't resist the pun), and he applied that to perl.

for example, mon leverages fping, the net-snmp tools, traceroute, rrdtool, etc. another example of mon's flexibility is how an on-call notification system with escalation was added without changing anything in mon at all, it was just a matter of writing a custom alert and plugging it in to your mon configuration file with the correct grammar.

in order to get a good idea of how mon works, i would recommend reading the slides from this presentation:

And that fact that is written in "simple Perl" without OO perversions only increases its value. One of the first versions (0.38j) is small enough to get basic ideas without getting headache and I recommend to get it first. You should use the latest version, but to get the ideas and architecture you still need to look at code of 0.38j.

Due to its design philosophy mon remains a rather simple package and by-and-large escaped Christmas Tree effect that hunts other monitoring packages like Nagios. It's still completely written in Perl and you can study what it is doing in debugger. It is also relatively easy to understand how particular checks are programmed and that fact alone constitutes tremendous advantage as it permit easy customarization.

Due to its design philosophy mon remains a rather simple package and by-and-large escaped Christmas Tree effect that hunts other monitoring packages like Nagios.

Mon fundamentally is a scheduler which executes the monitors (each tests a specific condition or report specific data), and calls the appropriate alerts if the monitor fails.

It views resource monitoring as two separate tasks: the testing of a condition, and triggering an action upon failure. It is important to understand that mon implements the testing and action-taking tasks as separate, stand-alone programs: invocation of an alert is governed by logic which offers various "squelch" features and dependencies, configurable by the user.

The current version is available from

mon was developed under Linux, but it is known to work under Solaris. As both the clients and server are written completely in Perl portability should not be an issue. I would be very surprised if there are serious portability issues with mon. It also is included as standard vendor provided package on many Linux distributions such as Suse and Ubuntu.


On startup, mon reads a configuration file and then performs tests as scheduled in the configuration file.

Each mon monitor (called "service monitor" in documentation) is a Perl script located in /etc/mon/mon.d  or any other directory specified in /etc/mon/ configuration file. For example Suse packages uses iether /usr/lib/mon/mod.d or /usr/lib64/mon/mod.d depending on whether you use 64-bit kernel or not.


Mon was designed to be open and extensible in the sense that Mon's monitor programs can be any executable. The relevant quote from the documentations is:

Monitor processes are invoked with the arguments specified in the configuration file, appended by the hosts from the applicable host group.

.... should return an exit status of 0 if it completed successfully (found no problems), or nonzero if a problem was detected. The first line of output from the monitor script has a special meaning: it is used as a brief summary of the exact failure which was detected, and is passed to the alert program. All remaining output is also passed to the alert program, but it has no required interpretation.

There are more then a dozen prepackaged monitors that come with mon and most can be easily customized to your own needs:

If a test fails, Mon calls the alert as specified in the configuration file. For example (taken from version 038j):

use File::Df;

foreach (@ARGV) {
    ($path, $minavail) = split (/:/, $_, 2);

    ($fs_type, $fs_desc, $used, $avail, $fused, $favail) = df ($path);
    if (!defined ($used)) {
	push (@failures, "statfs error for $path: $!");

    if ($avail < $minavail) {
    	push (@failures, sprintf ("%1.1fGB free on %s", $avail / 1024 / 1024,

if (@failures) {
    print join (", ", @failures), "\n";
    exit 1;

exit 0;

Most are simple scripts that notify users about a particular problem via particular communication channel like example SMTP mail or instant messaging. For example mail.alert that channel alerts into SMTP mails is structured as following:

open (MAIL, "| /usr/lib/sendmail -oi -t") ||
    die "could not open pipe to mail: $!\n";
print MAIL ... 	


Mon alerts are also Perl scripts. They are located in /etc/mon/alert.d. Several prepackaged alerts that can be easily adapted to the environment that come with mon:

Web interface

There is also several WEB interfaces for mon.

Top Visited
Past week
Past month


Old News ;-)

[Jan 15, 2010] INSTALL - Mon Wiki

The "mon" daemon uses Perl 5.n, where n >= 005_01.

Mon requires that *.ph be created from the system header files. If you try to
run mon and Perl complains with the "did you run h2ph?" message, then chances
are this step wasn't done, either by your package manager or manually after
Perl installation. You can fix it by doing the following, as root:

cd /usr/include
h2ph -r -l .

You'll need the following modules for the server to function, all of
which are available from your nearest CPAN archive. The listed
CPAN paths relative to /cpan/modules/by-authors/id/ -- versions of
modules on CPAN change quickly, so there may be newer versions available,
but the following are known to work:

Time::Period PRYAN/Period-1.20.tar.gz
Time::HiRes J/JH/JHI/Time-HiRes-1.59.tar.gz


The Perl client module is distributed as a separate package. It is named
"mon-client-*.tar.gz". Refer to that for installation instructions.
It is available on mirrors in the /pub/software/admin/mon directory,
and in CVS on Be sure to match the version of mon-client with
the version of mon you are using. At this time, branch "mon-1-2-branch" of the
mon CVS module matches the "mon-client-1-2-branch" branch of the mon-client CVS
module. See for information on CVS access.

3. COMPILING THE C CODE (optional)

Some of the monitors included with mon are written in C and need to
be compiled for your system. If you want to use the RPC monitor or the
dialin.monitor wrapper,

cd mon.d
(edit Makefile)
make install
cd ..

Keep in mind that although this is known to work on Linux, Solaris, and AIX,
it may not compile on your system. It is not required for the operation of mon


All of the monitor and alert scripts that are packaged with mon are
actually *optional*. However, this is what you'll need for each special
monitor, with CPAN paths relative to /cpan/modules/by-author/id/

freespace.monitor - requires Filesys::Diskspace from CPAN,
in FTASSIN/Filesys-DiskSpace-0.05.tar.gz

fping.monitor - requires the 'fping' binary, from
RPM packages available at

telnet.monitor - requires the Net::Telnet from CPAN,
in J/JR/JROGERS/Net-Telnet-3.03.tar.gz

Use the 'net-snmp' package (formerly UCD SNMP), from
with G.S. Marzot's Perl module G/GS/GSM/SNMP-4.2.0.tar.gz

ldap.monitor - requires Net::LDAPapi from CPAN,
dialin.monitor - requires the Perl Expect module from CPAN,

dns.monitor - requires Net::DNS from CPAN,

requires the MSQL/MySQL DBD module and DBI front-end.

There are a good number of useful monitors included which are not listed
above, so please take the time to read doc/README.monitors to get the


-Read the man page for "mon" and "moncmd" in the doc/ directory to get
an overview of the directories involved, i.e. the configuration,
alert, monitors, state, and run directories.

cd doc
nroff -man mon.8 | more

-read the "READMEs" in the doc/ directory for some useful
insight on system configuration.

-Be sure you have the required Perl modules, which are listed in this

-Make your own file, using the suppled "" (located
in the etc/ directory) as a template, or the m4-based "example.m4":

cp etc/


cp etc/example.m4 mon.m4

-Edit the "" file. This file controls which users can perform
what command. The default is pretty restrictive (read-only), but that's
only for safety. Currently, "moncmd", "monshow", and "mon.cgi" are the
only clients which are able to authenticate themselves to the server;
the 2-way pager interface does not yet perform authentication. However,
these programs work fine in read-only mode.

-Add the following lines to /etc/services:

mon 2583/tcp # MON
mon 2583/udp # MON traps

-You may want to make a DNS CNAME entry called "monhost" for your
host that will run "mon". You can then set the environment variable
MONHOST to be this host. "moncmd" uses this variable.

-The Perl scripts look for perl in /usr/bin. You might want to change
this. I'd advise keeping a locally-installed copy of Perl if you're
going to monitor network resources and you expect this stuff to work
when some component of the network is down.

-Test it by starting "mon" from the distribution directory. Use these
arguments if you chose the non-m4 config:

./mon -f -c -b `pwd`

and these arguments for the m4-based config:

./mon -f -M -c mon.m4 -b `pwd`

To see if it's running on your machine:

./clients/moncmd -s localhost list pids

If you get some output, then things are probably OK. Check the
syslog for further diagnostics.

Mon doesn't really need to be installed in any special location. Just
keep it on the local disk of the machine which will be running the server.


This distribution contains two web interfaces: monshow and mon.cgi. monshow is
a simple report-only tool which supports configurable "views" of the mon
configuration. monshow also operates as a textmode report generator.

mon.cgi, however, supports the full functionality of mon, including the ability
to disable/enable groups and hosts and services, acknowledge failed services,
show alert and downtime history, authenticate users, among many other things.

To install monshow, simply copy clients/monshow into your web server's cgi-bin
path and name it "monshow.cgi". You may want to read the man page in the doc/
directory so that you can understand how to configure a "view" to your liking.

To install mon.cgi, follow the instructions found in doc/README.mon.cgi.

[Jan 14, 2010] Monitoring with MON by Muhammad Kamran Azeem

March 17, 2009 | WBITT!

This is an extract from an implementation I did on a heartbeat based system. Mon is an excellent monitoring and reporting tool.

It is assumed that there are two servers connected to each other over multple heartbeat links.

MON for heartbeat monitoring:

both servers:

tar xzf mon-1.2.0.tar.gz
tar xzf mon-client-1.2.0.tar.gz

cd mon-client-1.2.0
perl Makefile.PL
make && make install

[Sept 4, 2007] Letter to the editor from Jim Trocki

Error corrected. Thanks for feedback...
This states "Active development stopped approximately in 2001", which is incorrect. Things slowed down for a bit, but there have been many new features added and bugs fixed in mon 1.2.0 which was released at the end of June this year.

Thank you for the nice write-up, though.

Recommended Links

Softpanorama hot topic of the month

Softpanorama Recommended

Top articles


mon- Service Monitoring Daemon Jim Trocki at

mon - Freshmeat page

FSF page - FSF page

mon maillist Home of mon CGI interface by Ryan Clark. He also started working on a newer version of the mon client. See also


FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in our efforts to advance understanding of environmental, political, human rights, economic, democracy, scientific, and social justice issues, etc. We believe this constitutes a 'fair use' of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit exclusivly for research and educational purposes.   If you wish to use copyrighted material from this site for purposes of your own that go beyond 'fair use', you must obtain permission from the copyright owner. 

ABUSE: IPs or network segments from which we detect a stream of probes might be blocked for no less then 90 days. Multiple types of probes increase this period.  


Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy


War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotesSomerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose BierceBernard Shaw : Mark Twain Quotes


Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law


Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOSProgramming Languages History : PL/1 : Simula 67 : C : History of GCC developmentScripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-MonthHow to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Haterís Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least

Copyright © 1996-2016 by Dr. Nikolai Bezroukov. was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License.

The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to make a contribution, supporting development of this site and speed up access. In case is down you can use the at


The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.

Last modified: September 12, 2017