Ok, encontrei o erro. alert
não é um evento válido e você precisa especificar um evento que gerará um alerta. Sem um evento específico, o monit não saberia o que dizer para você.
Lista de eventos da página de manual:
This is the list of events you can use
in a mail-filter: uid, gid, size,
nonexist, data, icmp, instance,
invalid, exec, changed, timeout,
resource, checksum, match, timestamp,
connection, permission
No seu caso, eu recomendo exec. A lista completa de mensagens é:
Event: | Failure state: | Recovery state:
---------------------------------------------------------------
CHANGED | "Changed" | "Changed back"
CHECKSUM | "Checksum failed" | "Checksum passed"
CONNECTION| "Connection failed" | "Connection passed"
DATA | "Data access error" | "Data access succeeded"
EXEC | "Execution failed" | "Execution succeeded"
GID | "GID failed" | "GID passed"
ICMP | "ICMP failed" | "ICMP passed"
INSTANCE | "Monit instance changed"| "Monit instance changed not"
INVALID | "Invalid type" | "Type passed"
MATCH | "Regex match" | "No regex match"
NONEXIST | "Does not exist" | "Exists"
PERMISSION| "Permission failed" | "Permission passed"
RESOURCE | "Resource limit matched"| "Resource limit passed"
SIZE | "Size failed" | "Size passed"
TIMEOUT | "Timeout" | "Timeout recovery"
TIMESTAMP | "Timestamp failed" | "Timestamp passed"
UID | "UID failed" | "UID passed"
Boa sorte,
João Miguel Neves