beginning of analysis.cfg (emphasis with "^^^" is mine):

Example: Check that the /var/log/messages file is not empty and was updated

                                                         ^^^^^^^^^^^^

within the past 10 minutes, and go yellow if either fails:

FILE /var/log/messages SIZE>0 MTIME<600 yellow

                                     ^^^^^^

So I had this in my analysis.cfg:

FILE /var/backups/mysql.0 SIZE>0 MTIME<86400 yellow

I then did the following on the monitored machine:

mv -i /var/backups/mysql.0 /var/backups/mysql.0.BACKUP

touch /var/backups/mysql.0

service xymon-client restart

The check still stayed green despite /var/backups/mysql.0 clearly was an empty file.

At some point I read the non-example documentation further up and there is written:

- "SIZE<max.size" and "SIZE>min.size" triggers a warning it the file

size is greater than "max.size" or less than "min.size", respectively.

Note that there is written "SIZE>min.size" and "less than" and not "less or equal than" despite the negation of ">" is "?" and not "<".

So I changed "SIZE>0" to "SIZE>1" and I got the expected alert.