Installation (v 0.7.17)

The best way to get god is via rubygems:

$ sudo gem install god

Contribute

God is open source and accepting pull requests via GitHub!

http://github.com/mojombo/god

Requirements

God currently only works on Linux (kernel 2.6.15+), BSD, and Darwin systems. No support for Windows is planned. Event based conditions on Linux systems require the cn (connector) kernel module loaded or compiled in to the kernel and god must be run as root.

The following systems have been tested. Help us test it on others!

• Darwin 10.4.10
• RedHat Fedora Core 6
• Ubuntu Dapper (no events)
• Ubuntu Feisty
• CentOS 4.5 (no events)

Config Files are Ruby Code!

The easiest way to understand how god will make your life better is by looking at a sample config file. The following configuration file is what I once used at gravatar.com to keep the mongrels running:

# run with: god -c /path/to/mongrel.god -D
# 
# This is the actual config file used to keep the mongrels of
# gravatar.com running.

RAILS_ROOT = "/Users/tom/dev/gravatar2"

%w{8200 8201 8202}.each do |port|
  God.watch do |w|
    w.name = "gravatar2-mongrel-#{port}"
    w.interval = 30.seconds # default      
    w.start = "mongrel_rails start -c #{RAILS_ROOT} -p #{port} \
      -P #{RAILS_ROOT}/log/mongrel.#{port}.pid  -d"
    w.stop = "mongrel_rails stop -P #{RAILS_ROOT}/log/mongrel.#{port}.pid"
    w.restart = "mongrel_rails restart -P #{RAILS_ROOT}/log/mongrel.#{port}.pid"
    w.start_grace = 10.seconds
    w.restart_grace = 10.seconds
    w.pid_file = File.join(RAILS_ROOT, "log/mongrel.#{port}.pid")
    
    w.behavior(:clean_pid_file)

    w.start_if do |start|
      start.condition(:process_running) do |c|
        c.interval = 5.seconds
        c.running = false
      end
    end
    
    w.restart_if do |restart|
      restart.condition(:memory_usage) do |c|
        c.above = 150.megabytes
        c.times = [3, 5] # 3 out of 5 intervals
      end
    
      restart.condition(:cpu_usage) do |c|
        c.above = 50.percent
        c.times = 5
      end
    end
    
    # lifecycle
    w.lifecycle do |on|
      on.condition(:flapping) do |c|
        c.to_state = [:start, :restart]
        c.times = 5
        c.within = 5.minute
        c.transition = :unmonitored
        c.retry_in = 10.minutes
        c.retry_times = 5
        c.retry_within = 2.hours
      end
    end
  end
end

That's a lot to take in at once, so I'll break it down by section and explain what's going on in each.

RAILS_ROOT = "/var/www/gravatar2/current"

Here I've set a constant that is used throughout the file. Keeping the RAILS_ROOT value in a constant makes it easy to adapt this script to other applications. Because the config file is Ruby code, I can set whatever variables or constants I want that make the configuration more concise and easier to work with.

%w{8200 8201 8202}.each do |port|
  ...
end

Because the config file is written in actual Ruby code, we can construct loops and do other intelligent things that are impossible in your every day, run of the mill config file. I need to watch three mongrels, so I simply loop over their port numbers, eliminating duplication and making my life a whole lot easier.

  God.watch do |w|
    w.name = "gravatar2-mongrel-#{port}"
    w.interval = 30.seconds # default      
    w.start = "mongrel_rails start -c #{RAILS_ROOT} -p #{port} \
      -P #{RAILS_ROOT}/log/mongrel.#{port}.pid  -d"
    w.stop = "mongrel_rails stop -P #{RAILS_ROOT}/log/mongrel.#{port}.pid"
    w.restart = "mongrel_rails restart -P #{RAILS_ROOT}/log/mongrel.#{port}.pid"
    w.start_grace = 10.seconds
    w.restart_grace = 10.seconds
    w.pid_file = File.join(RAILS_ROOT, "log/mongrel.#{port}.pid")
        
    ...
  end

A watch represents a single process that has concrete start, stop, and/or restart operations. You can define as many watches as you like. In the example above, I've got some Rails instances running in Mongrels that I need to keep alive. Every watch must have a unique name so that it can be identified later on. The interval option sets the default poll interval (this can be overridden in each condition). The start and stop attributes specify the commands to start and stop the process. If no restart attribute is set, restart will be represented by a call to stop followed by a call to start. The optional grace attribute sets the amount of time following a start/stop/restart command to wait before resuming normal monitoring operations. To be more specific, I can set just start_grace, stop_grace, and/or restart_grace. If the process you're watching runs as a daemon (as mine does), you'll need to set the pid_file attribute.

    w.behavior(:clean_pid_file)

Behaviors allow you to execute additional commands around start/stop/restart commands. In our case, if the process dies it will leave a PID file behind. The next time a start command is issued, it will fail, complaining about the leftover PID file. We'd like the PID file cleaned up before a start command is issued. The built-in behavior clean_pid_file will do just that.

    w.start_if do |start|
      start.condition(:process_running) do |c|
        c.interval = 5.seconds
        c.running = false
      end
    end

Watches contain conditions grouped by the action to execute should they return true. I start with a start_if block that contains a single condition. Conditions are specified by calling condition with an identifier, in this case :process_running. Each condition can specify a poll interval that will override the default watch interval. In this case, I want to check that the process is still running every 5 seconds instead of the 30 second interval that other conditions will inherit. The ability to set condition specific poll intervals makes it possible to run critical tests (such as :process_running) more often than less critical tests (such as :memory_usage and :cpu_usage).

    w.restart_if do |restart|
      restart.condition(:memory_usage) do |c|
        c.above = 150.megabytes
        c.times = [3, 5] # 3 out of 5 intervals
      end
    
      ...
    end

Similar to start_if there is a restart_if command that groups conditions that should trigger a restart. The memory_usage condition will fail if the specified process is using too much memory. The maximum allowable amount of memory is specified with the above attribute (you can use the kilobytes, megabytes, or gigabytes helpers). The number of times the test needs to fail in order to trigger a restart is set with times. This can be either an integer or an array. An integer means it must fail that many times in a row while an array [x, y] means it must fail x times out of the last y tests.

    w.restart_if do |restart|
      ...
    
      restart.condition(:cpu_usage) do |c|
        c.above = 50.percent
        c.times = 5
      end
    end

To keep an eye on CPU usage, I've employed the cpu_usage condition. When CPU usage for a Mongrel process is over 50% for 5 consecutive intervals, it will be restarted.

    w.lifecycle do |on|
      on.condition(:flapping) do |c|
        c.to_state = [:start, :restart]
        c.times = 5
        c.within = 5.minute
        c.transition = :unmonitored
        c.retry_in = 10.minutes
        c.retry_times = 5
        c.retry_within = 2.hours
      end
    end

Conditions inside a lifecycle section are active as long as the process is being monitored (they live across state changes).

The :flapping condition guards against the edge case wherein god rapidly starts or restarts your application. Things like server configuration changes or the unavailability of external services could make it impossible for my process to start. In that case, god will try to start my process over and over to no avail. The :flapping condition provides two levels of giving up on flapping processes. If I were to translate the options of the code above, it would be something like: If this watch is started or restarted five times withing 5 minutes, then unmonitor it...then after ten minutes, monitor it again to see if it was just a temporary problem; if the process is seen to be flapping five times within two hours, then give up completely.

That's it!

Changing UID/GID for processes

It is possible to have god run your start/stop/restart commands as a specific user/group. This can be done by setting the uid and/or gid attributes of a watch.

  God.watch do |w|
    ...
    
    w.uid = 'tom'
    w.gid = 'devs'
    
    ...
  end

This only works for commands specified as a string. Lambda commands are unaffected.

Lambda commands

In addition to specifying start/stop/restart commands as strings (to be executed via the shell), you can specify a lambda that will be called.

  God.watch do |w|
    ...
    
    w.start = lambda { ENV['APACHE'] ? `apachectl -k graceful` : `lighttpd restart` }
    
    ...
  end

Starting and Controlling God

To start the god monitoring process as a daemon simply run the god executable passing in the path to the config file (you need to sudo if you're using events on Linux or want to use the setuid/setgid functionality):

$ sudo god -c /path/to/config.god

While you're writing your config file, it can be helpful to run god in the foreground so you can see the log messages. You can do that with:

$ sudo god -c /path/to/config.god -D

You can start/restart/stop/monitor/unmonitor your Watches with the same utility like so:

$ sudo god stop gravatar2-mongrel-8200

Grouping Watches

Watches can be assigned to groups. These groups can then be controlled together from the command line.

  God.watch do |w|
    ...
    
    w.group = 'mongrels'
    
    ...
  end

The above configuration now allows you to control the watch (and any others that are in the group) with a single command:

$ sudo god stop mongrels

Advanced Configuration with Transitions and Events

So far you've been introduced to a simple poll-based config file and seen how to run it. Poll-based monitoring works great for simple things, but falls short for highly critical tasks. God has native support for kqueue/netlink events on BSD/Darwin/Linux systems. For instance, instead of using the process_running condition to poll for the status of your process, you can use the process_exits condition that will be notified immediately upon the exit of your process. This means less load on your system and shorter downtime after a crash.

While the configuration syntax you saw in the previous example is very simple, it lacks the power that we need to deal with event based monitoring. In fact, the start_if and restart_if methods are really just calling out to a lower-level API. If we use the low-level API directly, we can harness the full power of god's event based lifecycle system. Let's look at another example config file.

RAILS_ROOT = "/Users/tom/dev/gravatar2"

God.watch do |w|
  w.name = "local-3000"
  w.interval = 5.seconds # default
  w.start = "mongrel_rails start -c #{RAILS_ROOT} -P #{RAILS_ROOT}/log/mongrel.pid -p 3000 -d"
  w.stop = "mongrel_rails stop -P #{RAILS_ROOT}/log/mongrel.pid"
  w.restart = "mongrel_rails restart -P #{RAILS_ROOT}/log/mongrel.pid"
  w.pid_file = File.join(RAILS_ROOT, "log/mongrel.pid")
  
  # clean pid files before start if necessary
  w.behavior(:clean_pid_file)
  
  # determine the state on startup
  w.transition(:init, { true => :up, false => :start }) do |on|
    on.condition(:process_running) do |c|
      c.running = true
    end
  end
  
  # determine when process has finished starting
  w.transition([:start, :restart], :up) do |on|
    on.condition(:process_running) do |c|
      c.running = true
    end
    
    # failsafe
    on.condition(:tries) do |c|
      c.times = 5
      c.transition = :start
    end
  end

  # start if process is not running
  w.transition(:up, :start) do |on|
    on.condition(:process_exits)
  end
  
  # restart if memory or cpu is too high
  w.transition(:up, :restart) do |on|
    on.condition(:memory_usage) do |c|
      c.interval = 20
      c.above = 50.megabytes
      c.times = [3, 5]
    end
    
    on.condition(:cpu_usage) do |c|
      c.interval = 10
      c.above = 10.percent
      c.times = [3, 5]
    end
  end
  
  # lifecycle
  w.lifecycle do |on|
    on.condition(:flapping) do |c|
      c.to_state = [:start, :restart]
      c.times = 5
      c.within = 5.minute
      c.transition = :unmonitored
      c.retry_in = 10.minutes
      c.retry_times = 5
      c.retry_within = 2.hours
    end
  end
end

A bit longer, I know, but very straighforward once you understand how the transition calls work. The name, interval, start, stop, and pid_file attributes should be familiar. We also specify the clean_pid_file behavior.

Before jumping into the code, it's important to understand the different states that a Watch can have, and how that state changes over time. At any given time, a Watch will be in one of the init, up, start, or restart states. As different conditions are satisfied, the Watch will progress from state to state, enabling and disabling conditions along the way.

When god first starts, each Watch is placed in the init state.

You'll use the transition method to tell god how to transition between states. It takes two arguments. The first argument may be either a symbol or an array of symbols representing the state or states during which the specified conditions should be enabled. The second argument may be either a symbol or a hash. If it is a symbol, then that is the state that will be transitioned to if any of the conditions return true. If it is a hash, then that hash must have both true and false keys, each of which point to a symbol that represents the state to transition to given the corresponding return from the single condition that must be specified.

  # determine the state on startup
  w.transition(:init, { true => :up, false => :start }) do |on|
    on.condition(:process_running) do |c|
      c.running = true
    end
  end

The first transition block tells god what to do when the Watch is in the init state (first argument). This is where I tell god how to determine if my task is already running. Since I'm monitoring a process, I can use the process_running condition to determine whether the process is running. If the process is running, it will return true, otherwise it will return false. Since I sent a hash as the second argument to transition, the return from process_running will determine which of the two states will be transitioned to. If the process is running, the return is true and god will put the Watch into the up state. If the process is not running, the return is false and god will put the Watch into the start state.

  # determine when process has finished starting
  w.transition([:start, :restart], :up) do |on|
    on.condition(:process_running) do |c|
      c.running = true
    end
    
    ...
  end

If god has determined that my process isn't running, the Watch will be put into the start state. Upon entering this state, the start command that I specified on the Watch will be called. In addition, the above transition specifies a condition that should be enabled when in either the start or restart states. The condition is another process_running, however this time I'm only interested in moving to another state once it returns true. A true return from this condition means that the process is running and it's ok to transition to the up state (second argument to transition).

  # determine when process has finished starting
  w.transition([:start, :restart], :up) do |on|
    ...
    
    # failsafe
    on.condition(:tries) do |c|
      c.times = 5
      c.transition = :start
    end
  end

The other half of this transition uses the tries condition to ensure that god doesn't get stuck in this state. It's possible that the process could go down while the transition is being made, in which case god would end up polling forever to see if the process is up. Here I've specified that if this condition is called five times, god should override the normal transition destination and move to the start state instead. If you specify a transition attribute on any condition, that state will be transferred to instead of the normal transfer destination.

  # start if process is not running
  w.transition(:up, :start) do |on|
    on.condition(:process_exits)
  end

This is where the event based system comes into play. Once in the up state, I want to be notified when my process exits. The process_exits condition registers a callback that will trigger a transition change when it is fired off. Event conditions (like this one) cannot be used in transitions that have a hash for the second argument (as they do not return true or false).

  # restart if memory or cpu is too high
  w.transition(:up, :restart) do |on|
    on.condition(:memory_usage) do |c|
      c.interval = 20
      c.above = 50.megabytes
      c.times = [3, 5]
    end
    
    on.condition(:cpu_usage) do |c|
      c.interval = 10
      c.above = 10.percent
      c.times = [3, 5]
    end
  end

Notice that I can have multiple transitions with the same start state. In this case, I want to have the memory_usage and cpu_usage poll conditions going at the same time that I listen for the process exit event. In the case of runaway CPU or memory usage, however, I want to transition to the restart state. When a Watch enters the restart state it will either call the restart command that you specified, or if none has been set, call the stop and then start commands.

Watching Non-Daemon Processes

Need to watch a script that doesn't have built in daemonization? No problem! God will daemonize and keep track of your process for you. If you don't specify a pid_file attribute for a watch, it will be auto-daemonized and a PID file will be stored for it in /var/run/god. If you'd rather have the PID file stored in a different location, you can set it at the top of your config:

God.pid_file_directory = '/home/tom/pids'

God.watch do |w|
  # watch with no pid_file attribute set
end

The directory you specify must be writable by god.

Loading Other Config Files

You should feel free to separate your god configs into separate files for easier organization. You can load in other configs using Ruby's normal load method, or use the convenience method God.load which allows for glob-style paths:

# load in all god configs
God.load "/usr/local/conf/*.god"

God won't start its monitoring operations until all configurations have been loaded.

Dynamically Loading Config Files Into an Already Running God

God allows you to load or reload configurations into an already running instance. There are a few things to consider when doing this:

• Existng Watches with the same name as the incoming Watches will be overidden by the new config.
• All paths must be either absolute or relative to the path from which god was started.

To load a config into a running god, issue the following command:

$ sudo god load path/to/config.god

Config files that are loaded dynamically can contain anything that a normal config file contains, however, global options such as God.pid_file_directory blocks will be ignored (and produce a warning in the logs).

Getting Logs for a Single Watch

Sifting through the god logs for statements specific to a single Watch can be frustrating when you have many of them. You can get the realtime logs for a single Watch via the command line:

$ sudo god log local-3000

This will display log output for the 'local-3000' Watch and update every second with new log messages.

You can also supply a shorthand to the log command that will match one of your watches. If it happens to match several, the shortest match will be used:

$ sudo god log l3

Notifications

God has an extensible notification framework built in that makes it easy to have notifications sent when conditions are triggered. There are three steps to enabling notifications.

Step 1: Set the options for the notification subsystem(s) that you'll be using. Let's look at how to setup email notifications.

God::Contacts::Email.message_settings = {
  :from => 'god@example.com'
}

God::Contacts::Email.server_settings = {
  :address => "smtp.example.com",
  :port => 25,
  :domain => "example.com",
  :authentication => :plain,
  :user_name => "john",
  :password => "s3kr3ts"
}

Step 2: Configure some contacts.

God.contact(:email) do |c|
  c.name = 'tom'
  c.email = 'tom@example.com'
end

God.contact(:email) do |c|
  c.name = 'vanpelt'
  c.email = 'vanpelt@example.com'
  c.group = 'developers'
end

God.contact(:email) do |c|
  c.name = 'kevin'
  c.email = 'kevin@example.com'
  c.group = 'developers'
end

Step 3: Attach to a condition:

  w.transition(:up, :start) do |on|
    on.condition(:process_exits) do |c|
      c.notify = 'tom'
    end
  end

There are two ways to specify that a notification should be sent. The first, easier way is shown above. Every condition can take an optional notify attribute that specifies which contacts should be notified when the condition is triggered. The value can be a contact name or contact group *or* an array of contact names and/or contact groups.

  w.transition(:up, :start) do |on|
    on.condition(:process_exits) do |c|
      c.notify = {:contacts => ['tom', 'developers'], :priority => 1, :category => 'product'}
    end
  end

The second way allows you to specify the priority and category in addition to the contacts. The extra attributes can be arbitrary integers or strings and will be passed as-is to the notification subsystem.

The above notification will arrive as an email similar to the following.

From: god <god@example.com>
To: tom <tom@example.com>
Subject: [god] mongrel-8600 [trigger] process exited (ProcessExits)

Message: mongrel-8600 [trigger] process exited (ProcessExits)
Host: candymountain.example.com
Priority: 1
Category: product

Extend God with your own Conditions

God was designed from the start to allow you to easily write your own custom conditions, making it simple to add tests that are application specific.

Brought to you by Tom Preston-Werner