Puppet: audit on external file changes? - puppet

Question

In my puppet managed environment, one service needs to be restarted each time a file changes. The file itself is not under puppet's control but part of a package, i.e., may gets updated during (yum) updates.
Thus, I would like to 'subscribe' to this file and trigger a service restart on changes.
Since the file is not managed by Puppet, some audit-like approach does not work
file { '/path/to/foo':
audit => content,
}
notify { 'foo.notify':
subscribe => File['/path/to/foo'],
message => "foo has changed"
}
Is there a way, to realize something like that in Puppet?
Ideally, I would only need to compare on the client the current vs the previous file hash.
But AFAIS within Puppet's structure, it would require to keep the current file hash on the puppet master and compare it again on the client (which may work via a fact but would be clumsy(?)).

Answer 1

It does seem to work with Puppet 4.4.2 and 3.4.3, so it's safe to assume that both Puppet 3.x and 4.x do the right thing here:
$ cd /tmp
$ echo foo >foo
$ puppet apply -e 'file { "/tmp/foo": audit => "content" } ~> exec { "/bin/echo DING": refreshonly => true }'
Notice: Compiled catalog for this-box in environment production in 0.13 seconds
Notice: /Stage[main]/Main/File[/tmp/foo]/content: audit change: newly-recorded value {md5}d3b07384d113edec49eaa6238ad5ff00
Notice: Applied catalog in 0.07 seconds
$ puppet apply -e 'file { "/tmp/foo": audit => "content" } ~> exec { "/bin/echo DING": refreshonly => true }'
Notice: Compiled catalog for this-box in environment production in 0.12 seconds
Notice: Applied catalog in 0.06 seconds
$ echo bar >foo
$ puppet apply -e 'file { "/tmp/foo": audit => "content" } ~> exec { "/bin/echo DING": refreshonly => true }'
Notice: Compiled catalog for this-box in environment production in 0.12 seconds
Notice: /Stage[main]/Main/File[/tmp/foo]/content: audit change: previously recorded value {md5}d3b07384d113edec49eaa6238ad5ff00 has been changed to {md5}c157a79031e1c40f85931829bc5fc552
Notice: /Stage[main]/Main/Exec[/bin/echo DING]: Triggered 'refresh' from 1 events
Notice: Applied catalog in 0.09 seconds
Please note that notify does not work very well with events. Putting the subscribe in an actual service resource should work much better and lead to a service restart.