We've been using etckeeper (/etc is a git repo so you can track changes) plus an after-commit hook to post to a chatbot.

We alert on uncommitted changes after one hour via nagios and track authors with GIT_COMMITTER_* env variables.

This is deployed to about 6000 machines. Works well.

Mmm, PyPi doesn't seem to want to surface this package at all when searching for it through its web interface. I can't find anything actually named canaryd when searching.

However, running a pip install does find it:

  Collecting canaryd
  Downloading canaryd-0.dev0.tar.gz

Unfortunately it fails to build on my system:

  Building wheels for collected packages: canaryd
  Running setup.py bdist_wheel for canaryd ... error

It seems the package is entirely empty and only declares a single dependency, ipdb.

A hypothetical repository which could (will?) contain the code seems to live here: https://github.com/Oxygem/canaryd. It was set up 3 months ago but nothing since then.

According to GitHub they detect the license as MIT.

The package on pypi is just a placeholder currently (although it should install OK, I'll check that). We're working on the full client right now which should be ready in the coming weeks :)

Why on earth would you post a website with a 'coming soon' email form and also broken instructions which interested people are presumably going to try immediately?

Also, why upload a useless placeholder archive to PyPi in the first place?

This appear to be a hybrid IDS w/ some SIEM capability.

Is this like monit?

From my casual browsing, I think that aside from a prettier UI it does a subset of what Monit can do at the moment and Service Canary seems to be based more around network changes than system-local changes. The messaging of Service Canary is not as comprehensive of a monitoring solution as Monit and implies that this kind of monitoring needs a distinct solution although Monit can probably do all of these things (file change detection, network event notification, etc.). Most monitoring systems are based around threshold ranges of measured values. Service Canary, like Monit, seems to be more oriented around event-based monitoring closer to what is done in logging infrastructures similar to an ELK (Elasticsearch, Logstash, Kibana) or Sumologic based stack that will aggregate event / log data and derive numerical values that you can then alert upon.

Monit is able to at least react to an event with a response, I don't really see much about event reactions for Service Canary.

Sounds like it. Wouldn't mind a more full featured monit. Didn't have good luck personally with Nagios

Check out Sensu.

OpenNMS works well.

Is there anything like this that supports windows?

OSSEC has an agent that works on Windows and with configuration can do this stuff.

Tripwire in the cloud?

Oh, because on-call needs _more_ alerts... :3