selection-only

Selection: per and only

'only' => array('ssh', 'sshd', 'cron', 'crond') makes the default selection "only these elements": of all the systemd services of a Linux, the SSH server and cron are watched by default, under the names Debian (ssh, cron) and Fedora (sshd, crond) give them.

How to read it

• The collector still returns every service it sees: the poller keeps only those the selection names. The administrator adds others on the probe, by name or by pattern (nginx*).
• ignore and only never go together.
• text.match($line, '([^ ]+).service +[^ ]+ +([^ ]+)'): the name of the service in the first group, its active state in the second. A line that does not match is skipped.
• watch.expect raises on any state but active.
• A refused systemctl (a machine without systemd, such as Alpine) or an answer with no service stops the collector misconfigured: an empty answer would leave the probe green with nothing judged.

To adapt it

• A selection that finds nothing raises nothing: a name the machine does not use (sshd on Debian, cron on Fedora) is not a service that stopped, it is a service nobody watches, and the probe stays green. Write in only the names each distribution gives the service, as here, and check on a first run that the probe shows the services you meant.
• To raise when a named service is not there at all, add watch.missing with its names; only a name every machine of the probe uses belongs in it.