---
module: agent.ejournal-db-monitor
title: EJournal DB Monitor — act-without-guessing reference
tab: Claude
order: 40
audience: dev
---

# EJournal DB Monitor (Claude quick-reference)

## Identity

- Module name (`getName()`): `ejournal-db-monitor`
- Entry class: `com.hiveops.ejournal.EJournalDbMonitorModule`
- Maven artifact / JAR: `hiveops-module-ejournal-db-monitor.jar` (module version `1.0.0`)
- Log package / thread name: `com.hiveops.ejournal` / `ejournal-db-monitor`
- Dependencies: none (`getDependencies()` empty)
- Purpose: poll Hyosung EJournal DB file size, alert before the **2 GB** write limit

## Config property keys (exact) — defaults from code

| Key | Default |
|-----|---------|
| `ejournal.db.monitor.enabled` | `true` |
| `ejournal.db.monitor.dir` | `D:\EJOURNAL` |
| `ejournal.db.monitor.filename` | *(blank → auto-pick largest DB file)* |
| `ejournal.db.monitor.warn.mb` | `1536` |
| `ejournal.db.monitor.critical.mb` | `2048` |
| `ejournal.db.monitor.interval.min` | `15` |
| `ejournal.db.monitor.cooldown.hours` | `24` |

Endpoint resolution (not module-specific keys, but required): uses `agent.endpoint`
if set, else `incident.endpoint`. Neither set → module is a silent no-op.

## Event types emitted (exact strings)

- `EJOURNAL_DB_WARNING` — size ≥ `warn.mb` (default 1.5 GB)
- `EJOURNAL_DB_CRITICAL` — size ≥ `critical.mb` (default 2.0 GB)

Both defined in `com.hiveops.events.EventType`. Sent via
`IncidentEventClient.sendEvent()` → `POST {endpoint}/api/journal-events`.

## Event payload fields

`CreateJournalEventRequest` with: `agentAtmId` = ATM name, `eventType` = one of the
two above (`.name()`), `eventDetails` = formatted string (filename, MB, % of 2 GB),
`eventSource` = `HIVEOPS_AGENT_EJDB` (constant — use to filter these events).

## Auto-detect file rule

If `ejournal.db.monitor.filename` is blank, picks the **largest** file in
`ejournal.db.monitor.dir` matching extensions: `.mdb`, `.sdf`, `.db`, `.sqlite`.

## Alert de-dup logic

- Fire only if level escalated (Warning→Critical) OR cooldown elapsed.
- Size dropping below warning threshold resets state (treated as DB cleared).
- State is in-memory only → resets on agent restart.

## Deploy / disable

- Deploy: fleet `INSTALL_MODULE` task (artifact `task.paths` or legacy
  `configPatch.url`+`filename`, must end `.jar`) → lands in agent `modules/` →
  agent restarts. Handler: `ProcessInstallModule`.
- Disable: `ejournal.db.monitor.enabled=false` OR add `ejournal-db-monitor` to
  `modules.disabled` (push via `CONFIG_UPDATE`).

## Do NOT

- Do NOT assume events go to a dedicated endpoint — they use the shared
  `/api/journal-events`, same as the `journal-events` module.
- Do NOT expect a numeric `atmId` from the module — it sends `agentAtmId` (name);
  the server resolves the ATM.
- Do NOT expect persisted alert state across restarts — it is in-memory only.
- Do NOT expect Linux path defaults — default dir is `D:\EJOURNAL` (Hyosung/Windows);
  set `ejournal.db.monitor.dir` for other layouts.
- Do NOT expect alert spam — one alert per level per cooldown (default 24 h) unless
  escalating.
- Do NOT rely on it detecting DBs with extensions outside
  `.mdb/.sdf/.db/.sqlite` unless you pin `ejournal.db.monitor.filename`.
- Do NOT count on any `PlatformService` use inside the module — it uses plain
  `java.io.File` only.
