What happens if you just make it a file: entry, even though it's a directory? My guess is that EXISTS simply reports whether the [file://run/log/journal] section has any content matching the "file" name. The fact that it happens to be a directory probably doesn't matter for EXISTS.
There's a chance that the [dir:<dirname>] is significantly different in structure from [file:<filename>] to the point that Xymon gets weirded out and complains that the "file" doesn't look like a file. If that's the case, use backticks to make the dir look like a file. Something like:
file:`D=/run/log/journal; [ -d $D ] && stat --printf "type:100000 (file)\nmode:%a (%A)\nlinkcount:%h\nowner:%u (%U)\ngroup:%g (%G)\nsize:%s\nclock:$(date +'%s (%F %T.%N %z)')\natime:%X (%x)\nctime:%Z (%z)\nmtime:%Y (%y)\n" /run/log/journal`
If the dir exists, this gives me:
type:100000 (file)
mode:2755 (drwxr-sr-x)
linkcount:3
owner:0 (root)
group:190 (systemd-journal)
size:60
clock:1730432083 (2024-11-01 14:34:43.189892664 +1100)
atime:1730392322 (2024-11-01 03:32:02.629206150 +1100)
ctime:1714705493 (2024-05-03 13:04:53.832001476 +1000)
mtime:1714705472 (2024-05-03 13:04:32.778000198 +1000)
so Xymon should see this as a file, and things like EXISTS should work, and show this as OK.
If the dir doesn't exist, this gives me no output, so EXISTS should flag this as an error with an appropriate message.
Ugly, but should work, if you have GNUstat and date. If you like, you could put this (or equivalent) into a script and use file:`testdir /run/log/journal`.
J