- Update to 2.15.1
* Security
- CVE-2025-61907: Prevent API users from accessing variables and objects they
don't have access to within filter expressions.
This allowed authenticated API users to learn information they aren't allowed
to access directly.
- CVE-2025-61908: Add a missing null pointer check while evaluating expressions.
This allowed authenticated API users to crash the Icinga 2 daemon by supplying
a crafted filter expression.
- CVE-2025-61909: Don't send signals as root in safe-reload script and logrotate config.
This allowed a limited privilege escalation from the Icinga 2 service user to root.
The scope is limited to sending SIGHUP or SIGUSR1 to an arbitrary process. #10590
- Windows: Update to OpenSSL 3.0.18. #10591
* Bugfixes
- When a reload triggered from Icinga Director (or the /v1/config API) fails,
the corresponding state is cleared, allowing to deploy a new config
without having to restart Icinga 2 manually first. #10584
* Enhancements
- Add JSON-RPC utilization metrics and troubleshooting docs. #10586
- When sending cluster messages to other zones, prefer endpoints in the order
as specified in the zone configuration. #10587
- Track the number of JSON-RPC messages received for each message type per endpoint. #10585
- Add support for building with Boost v1.89 and use it on Windows. #10578
- Drop 76fa0d9e8054f405dc3d1e39a4b48f21e86afdf0.patch because now in upstream.
OBS-URL: https://build.opensuse.org/request/show/1311996
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=200
- Update ot 2.15.0
* Breaking Changes
- API: Fix /v1/objects/* queries with attrs set to [] to return empty attributes instead of all of them. #8169
- Drop the undocumented Checkable#process_check_result and broken System#track_parents DSL functions. #10457
* Enhancements
- Gracefully disconnect all clients on shutdown and prevent from accepting new connections. #10460
- Icinga DB: Send data to Redis® exactly as they're stored in the database to avoid extra value-mapping routines by the Go daemon. #10452
- Add support for Icinga 2 dependencies in Icinga DB. #10290
- Take host/service reachability into account when computing its severity. #10399
- Rework the dependency cycle detection to efficiently handle large configs and provide better error messages. #10360
- Don't log next check timestamp in scientific notation. #10352
- Automatically remove child downtimes when removing parent downtime. #10345
- Ensure compatibility with Boost version up to v1.88. #10278#10419
- Reject infinite performance data values. #10077
- Support host_template and service_template tags in ElasticsearchWriter. #10074
- Icinga DB: Support Redis® username authentication. #10102
- Cluster: Distribute host child objects (e.g. services, notifications, etc.) based on the host's name. #10161
- Icinga DB Check: Report an error if both Icinga DB instances are responsible in a HA setup. #10188
- Windows: upgrade build toolchain to Visual Studio 2022. #9747
* Bugfixes
* Core
- Use Checkable#check_timeout also for rescheduling remote checks. #10443
- Log: Don't unnecessarily buffer log messages that are going to be dropped anyway. #10177
- Don't loose perfdata counter (c) unit when normalizing performance data for Icinga DB. #10432
- Fix broken SELinux policy on Fedora ≥ 41 due to the new /usr/sbin to /usr/bin equivalence. #10429
- Don't load Notification objects before User and UserGroup objects to allow them to be referenced in notifications. #10427
- Ensure consistent DST handling across different platforms. #10422
- Fix Icinga 2 doesn't generate a core dump when it crashes with SIGABRT. #10416
- Don't process concurrent checks for the same checkable. #10372
- Don't process check results after the checker and API listener have been stopped. #10397
- Avoid zombie processes on plugin execution timeout on busy systems. #10375
- Properly restore the notification object state on Recovery notification. #10361
- Fix incorrectly dropped acknowledgement and recovery notifications. #10211
- Prevent checks from always being rescheduled outside the configured check_period. #10070
- Don't send reminder notifications after a Custom notification while interval is set to 0. #7818
- Reset all signal handlers of child processes to their defaults before starting a plugin. #8011
- tests: Fix FormatDateTime test cases with invalid formats on macOS and all BSD-based systems. #10149
- Mark move constructor and assignment operator in String as noexcept to allow optimizations. #10353#10365
* Cluster and API
- Fix an inverted condition in ApiListener#IsHACluster() that caused to always return true in a non-HA setup. #10417
- Don't silently accept authenticated JSON-RPC connections with no valid endpoint. #10415
- Sync Notification#notified_problem_users across the cluster to prevent lost recovery notifications. #10380
- Remove superfluous ) from a HTTP request log message. #9966
- Disable TLS renegotiation (handshake on existing connection) on OpenBSD as well. #9943
- Log also the underlying error message when a HTTP request is closed with No data received by Icinga 2. #9928
- Fix a deadlock triggered by concurrent /v1/actions/add-comment and /v1/actions/acknowledge-problem requests
on the same checkable, as well as a crash that might occur when running perfectly timed /v1/actions/add-comment
and /v1/actions/remove-comment requests targeting the same comment. #9924
* Icinga DB
- Fix missing acknowledgement and flapping history entries due to a number overflow. #10467
- Send downtime cancel_time only if it is cancelled. #10379
- Send only the necessary data to the icinga:stats Redis® stream. #10359
- Remove a spin lock in RedisConnection#Connect() to avoid busy waiting. #10265
* Writers
- Serialize all required metrics before queueing them to a WorkQueue. #10420
- OpenTsdbWriter: Include checkable name in log messages to ease troubleshooting. #10009
- OpenTsdbWriter: Don't send custom empty tags. #7928
- InfluxDBWriter: Add missing closing quote in validation error message. #10174
* ITL
- Add --maintenance_mode_state ($vmware_maintenance_mode_state) argument to vmware-esx-command check command. #10435
- Add -n ($load_procs_to_show$) argument to load check command. #10426
- Add --inode-perfdata ($disk_np_inode_perfdata$) argument to disk check command. #10395
- Add -r ($ssh_remote_version$) and -P ($ssh_remote_protocol$) arguments to ssh check command. #10283
- Add --unplugged_nics_state ($vmware_unplugged_nics_state$) argument to
vmware-esx-soap-host-net and vmware-esx-soap-host-net-nic check commands. #10261
- Add -X ($proc_exclude_process$) argument to procs check command. #10232
- Add --dane ($ssl_cert_dane$) argument to ssl_cert check command. #10196
- Fix check_ssl_cert deprecation warnings. #9758
- Fix check_systemd executable name add add all missing arguments. #10035
- Add -M ($snmp_multiplier$ & $snmpv3_multiplier$) argument to snmp and snmpv3 check commands. #9975
- Add --continue-after-certificate ($http_certificate_continue$) argument to http check command. #9974
- Add --ignore-maximum-validity ($ssl_cert_ignore_maximum_validity$) argument to ssl_cert check command. #10396
- Add --maximum-validity ($ssl_cert_maximum_validity$) argument to ssl_cert check command. #9881
- Add --url ($ssl_cert_http_url$) argument to ssl_cert check command. #9759
- Add fuse.sshfs and fuse.* (supported only by Monitoring Plugins) to the list of default disk exclude types. #9749
- Add check_curl check command. #9205
- Add the --extra-opts argument to various commands that support it. #8010
* Documentation
- Don't use dnf config-manager to configure Fedora repository and mention icingadb-redis-selinux package. #10479
- Update the outdated cold startup duration documentation to reflect the current behavior. #10446
- Indent second-level unordered lists with four spaces to correctly render them in the HTML documentation. #10441
- Add a reference to the check result state documentation from within the Advanced Topics section. #10421
- Improve the documentation of how to generate Icinga 2 core dumps. #10418
- Update Icinga 2 CLI output examples to match the current output. #10323
- Fix incorrect ping_timeout value in the hostalive check command documentation. #10069
* Code Quality
- Simplify deferred SSL shutdown in ApiListener#NewClientHandlerInternal(). #10301
- Don't unnecessarily shuffle configuration items during config load. #10008
- Sort config types by their load dependencies at namespace initialization time to save some round trips during config load. #10148
- Fix livestatus build error on macOS without unity builds. #10176
- Remove unused methods in SharedObject class. #10456
- Remove unused ProcessingResult#NoCheckResult enum value. #10444
- CMake: Drop all third-party cmake modules and use the ones shipped with CMake v3.8+. #10403
- CMake: Raise the minimum required policy to 3.8. #10402#10478
- CMake: Turn on -Wsuggest-override to warn about missing override specifiers. #10225#10356
- Make icinga::Empty a constant to prevent accidental modifications. #10224
- Remove various unused methods in the Registry class. #10222
- Fix missing parent std::atomic<T> constructor call in our Atomic<T> wrapper class. #10215
- Drop unused m_NextHeartbeat member variable from JsonRpcConnection. #10208
- Enhance some of the validation error messages. #10201
- Don't allow Type#GetLoadDependencies() to return non-config object type dependencies. #10169
- Don't allow Type#GetLoadDependencies() to return a set of nullptr type dependencies. #10155
- Remove EOL distros detection code from Utility::ReleaseHelper() function. #10147
- Remove dead code in TLS GetSignatureAlgorithm() function. #9882
- Mark Logger#GetSeverity() as non-virtual to avoid unnecessary vtable lookups. #9851
- Remove unused Stream#Peak() method and unused allow_partial parameter from Stream#Read(). #9734#9736
- Suppress compiler warnings in third-party libraries. #9732
- Fix various compiler warnings. #9731#10442
- Reduce task function allocation overhead by using a per-thread created lambda in WorkQueue. #9575
- Remove redundant trailing empty lines and add missing newlines in some files. #7799
- Drop icinga-pr10278.patch becauise now in upstream.
- Change BuildRequires from yajl to nlohmann_json because yajl is dead.
OBS-URL: https://build.opensuse.org/request/show/1287040
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=197
- Update to 2.14.6
- CVE-2025-48057: Prevent invalid certificates from being renewed with OpenSSL older than v1.1.0.
- Fix use-after-free in VerifyCertificate(): Additionally, a use-after-free was found in the same
function which is fixed as well, but in case it is triggered, typically only a wrong error code
may be shown in a log message.
- Windows: Update OpenSSL shipped on Windows to v3.0.16.
- Rebase icinga-pr10278.patch.
OBS-URL: https://build.opensuse.org/request/show/1280693
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=196
- Update to 2.14.5
* Bug Fixes
- Don't close anonymous connections before sending the response for a certificate request #10337
- Performance data: Don't discard min/max values even if crit/warn thresholds aren’t given #10339
- Fix a failing test case on systems time_t is only 32 bits #10343
* Documentation
- Document the -X option for the mail-host-notification and mail-service-notification commands #10335
- Include Nagios in the migration docs #10324
- Remove RHEL 7 from installation instructions #10334
- Add instructions for installing build dependencies on Windows Server #10336
OBS-URL: https://build.opensuse.org/request/show/1252605
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=192
- Update to 2.14.4
* Crash Fixes
- Invalid DateTime#format() arguments in config and console on Windows Server 2016 and older. #10112
- Downtime scheduling at runtime with non-existent trigger. #10049
- Object creation at runtime during Icinga DB initialization. #10151
- Comment on a service of a non-existent host. #9861
* Miscellaneous Bugfixes
- Lost notifications after recovery outside the notification time period. #10187
- TimePeriod/ScheduledDowntime exceeding specified date range. #9983#10107
- Clean up failure for obsolete Downtimes. #10062
- ifw-api check command: use correct process-finished handler. #10140
- Email notification scripts: strip 0x0D (CR) for a proper Content-Type. #10061
- Several fixes and improvements of the code quality. #10066#10214#10254#10263#10264
* Cluster and API
- Sync runtime objects in topological order to honor their dependencies. #10000
- Make parallel config syncs more robust. #10013
- After object creation via API fails, clean up properly for the next try. #10111
- Close HTTPS connections properly to prevent leaks. #10005#10006
- Reduce the number of cluster messages in memory at the same time. #9991#9999#10210
- Once a cluster connection shall be closed, stop communicating. #10213#10221
- Remove unnecessary blocking of semaphores. #9992#9994
- Reduce unnecessary cluster messages setting the next check time. #10011
* Icinga DB and IDO
- IDO: fix object relations after aborted synchronization. #10065
- Icinga DB, IDO: limit all timestamps to four year digits. #10058#10059
- Icinga DB: limit execution_time and latency (milliseconds) to database schema. #10060
* Troubleshooting
- Add /v1/debug/malloc_info which calls malloc_info(3) if available. #10015
- Add log messages about own network I/O. #9993#10141#10207
- Several fixes and improvements of log messages. #9997#10021#10209
* Windows
- Update OpenSSL shipped on Windows to v3.0.15. #10170
- Update Boost shipped on Windows to v1.86. #10114
- Support CMake v3.29. #10037
- Don't require to build .msi as admin. #10137
- Build configuration scripts: allow custom $CMAKE_ARGS. #10312
* Documentation
- Distributed Monitoring: add section "External CA/PKI". #9825
- Explain how to enable/disable debug logging on the fly. #9981
- Update supported OS versions and repository configuration. #10064#10090#10120#10135#10136#10205
- Several fixes and improvements. #9960#10050#10071#10156#10194
- Replace broken links. #10115#10118#10282
- Fix typographical and similarly trivial errors. #9953#9967#10056#10116#10152#10153#10204
OBS-URL: https://build.opensuse.org/request/show/1240023
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=191
- Update to 2.14.1
* Security
- Automatically renew own root CA and distribute it to all nodes. #9933
- Update OpenSSL shipped on Windows to v3.0.12. #9946
- Disable TLS renegotiation (handshake on existing connection). #9946
* Bugfixes
- Icinga DB feature: fix crash due to missing NULL pointer check. #9946
- Icinga DB feature: fix data written into Redis crashing the Go daemon. #9946
- GelfWriter: fix deadlock on stop/reload caused by busy queue. #9947
- Don't lose notifications due to too long output, truncate it. #9947
* Enhancements
- Discard duplicate problem notifications due to state filtering. #9932
- Speed up API filters targeting specific hosts/services to O(1). #9944
- POST /v1/console/*: return HTTP 503 while Icinga is reloading. #9947
- Update Boost shipped on Windows to v1.83. #9946
- Documentation: several fixes and improvements. #9921
OBS-URL: https://build.opensuse.org/request/show/1134463
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=185
- Update to 2.14.0
* Breaking Changes
- Remove CheckResultReader (which has been deprecated since v2.9). #9714
- Remove StatusDataWriter (which has been deprecated since v2.9). #9715
- ElasticsearchWriter: drop support for Elasticsearch < v7. #9812
- Consider a checkable unreachable once one Dependency fails.
Previously all of them had to fail. (Consult the upgrading docs.) #8218
- API: reject config modifications during reload with HTTP status 503. #9445
- icinga2 daemon: to reduce config load time, write file needed by
icinga2 object list only if --dump-objects is given. #9586#9591
- Default email notification scripts: link to Icinga DB Web,
not the monitoring module. (Consult the upgrading docs.) #9742#9757
- API: for security reasons hide TicketSalt in /v1/variables. #7863
* Icinga 2 Config DSL
- Disallow global variable modification after config commit start (i.e.
inside object/apply T "x" { ... }) to reduce config load time. #9740
- Forbid Dependency cycles at config load time. #8389
- Allow only strings in the arrays Host#groups, Service#groups and
User#groups. Needed for consistency, especially by the IDO. #9057
- Disallow empty object names. (They worked only partially anyway.) #9409
* Enhancements
- Significantly reduce config load time of large setups.
#8118#9555#9557#9572#9577#9603#9608#9627#9648#9657#9662
- Allow to connect dependencies via redundancy groups. Only parents within
one group are assumed to provide redundancy for each other. #8218
- Built-in check command ifw-api, communicates directly with the Icinga for
Windows REST API. (Doesn't spawn a PowerShell process for that.) #9062
- JournaldLogger which logs to systemd journal. #9000
- API: POST /v1/objects: allow to discard some previously modified attributes,
i.e. to restore the config files' values. #9783
- ElasticsearchWriter: support Elasticsearch v8. #9812
- Support $env.ENV_VAR_NAME$ macros. #8302
- Speed up Icinga DB config dump. #9524
- Default mail notification scripts: also print $host.notes$ and $service.notes$. #9713
- Enable built-in OpenSSL DH parameters to allow DHE TLS ciphers. #9811
- Clean up global default TLS cipher list to improve security. #9809
- Influxdb(2)Writer: write more precise timestamps (nanoseconds). #9599
* Bugfixes
- Icinga DB feature: normalize several Redis data not to crash the Go daemon.
#9772#9775#9792#9793#9794#9805
- Fix parsing of perfdata across multiple lines in plugin output. #8969
- icinga check: fix last reload failure time. #8429#9827
- Resolve macros inside custom vars of IcingaApplication. #9779
- SELinux: allow Icinga and its plugins to write to syslog. #9688
- ElasticsearchWriter: fix data buffer flush race condition during stop. #9810
- Trigger flexible downtimes not in the past if checkable is already down. #9726
- Send downtime expiration notifications immediately, not after up to a minute. #9726
* Cluster
- Don't hang in timed out connection attempt. #9711#9725
- Fix lost acknowledgements after re-connect. #9718
- cluster-zone check: don't complain about not connected
other local zone members if there aren't any. #8595
- Allow agent to update executions delegated to it via /v1/actions/execute-command. #8627
* API
- Disallow breaking inter-object relationships by changing
relationship attributes at runtime, e.g. Service#host_name. #9407
- Correct several HTTP response status codes. #7958#9354
- Correct Boolean field types previously reported by /v1/types as Number. #9514
* CLI
- icinga2 daemon: fix -DConfiguration.Concurrency= flag
which now allows to override the number of threads. #9643
- icinga2 node wizard: avoid unnecessary chown(2) which may fail and abort the wizard. #8744
- Correct several log messages. #8895#8965#9663
* ITL
- Add linux_netdev check command. #9045
+ Command Argument Changes
- disk: don't pass -m (disk_megabytes) by default. #9642
- disk: pass -X fuse.portal (disk_exclude_type) by default. #9459
- http: support multiple -k (http_header) as array. #8574
- icmp: double defaults for -w (icmp_wpl) and -c (icmp_cpl). #9041
- logfiles: pass --winwarncrit (logfiles_winwarncrit) without argument. #9056
- nwc_health: pass SNMPv3-only args only when using SNMPv3. #9095
- vmware-esx-dc-runtime-tools and vmware-esx-soap-vm-runtime-tools:
- rename --open-vm-tools to --open_vm_tools_ok (vmware_openvmtools). #9611
OBS-URL: https://build.opensuse.org/request/show/1114137
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=184
- Update to 2.13.8
* Bugfixes
- Icinga DB feature: normalize several Redis data not to crash the Go daemon. #9814
- Don't hang in timed out connection attempt. #9815
- Trigger flexible downtimes not in the past if checkable is already down. #9817
- ElasticsearchWriter: fix data buffer flush race condition during stop. #9818
- SELinux: allow Icinga and its plugins to write to syslog. #9819
- Fix lost acknowledgements after re-connect. #9820
- Fix parsing of perfdata across multiple lines in plugin output. #9821
- cluster-zone check: don't complain about not connected
other local zone members if there aren't any. #9822
* Updates
- Update Boost shipped on Windows to v1.82. #9816
- Update OpenSSL shipped on Windows to v3.0.9. #9816
- Update vendored https://github.com/nlohmann/json to v3.9.1. #9816
- Update vendored https://github.com/nemtrif/utfcpp to v3.2.3. #9816
OBS-URL: https://build.opensuse.org/request/show/1098792
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=182
- Update to 2.13.7
* Security
- Windows: update bundled OpenSSL to v1.1.1t. #9672
* Bugfixes
- SELinux: fix user and domain creation by explicitly setting the role. #9690
- Signal handlers: don't interrupt and break plugins spawning. #9682
- Icinga DB: take check\_period into account during overdue calculation. #9679
- Avoid corrupted files: use fsync(2)/FlushFileBuffers() everywhere. #9681
- Solaris: fix compile error. #9680
* Enhancements
- Windows: update bundled Boost to v1.81. #9678
- Documentation: several fixes and improvements. #9671
- Drop icinga2-boost.patch because now in upstream.
OBS-URL: https://build.opensuse.org/request/show/1066252
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=181
- Update to 2.13.4
* Bugfixes
- Fix a race-condition involving object attribute updates that could result in a crash. #9395
- After a host recovered, only send problem notifications for services after they have been
rechecked afterwards to avoid false - notifications. #9348
- Speed up config validation by avoiding redundant serialization of objects. #9400
- Add a separator attribute to allow using arguments like --key=value as required by some
check plugins. This fixes the --upgrade and --dist-upgrade arguments of check_apt. #9397
- Windows: Update bundled versions of Boost and OpenSSL. #9360#9415
* Icinga DB
- Add an icingadb CheckCommand to allow checking if Icinga DB is healthy. #9417
- Update documentation related to Icinga DB. #9423
- Fix a bug where history events could miss the environment ID. #9396
- Properly serialize attributes of command arguments when explicitly set to null. #9398
- Rename some attributes to make the database schema more consistent. #9399#9419#9421
- Make the error message more helpful if the API isn't set up #9418
OBS-URL: https://build.opensuse.org/request/show/986199
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=177
When upgrading vim to version 8 the syntax file does not work anymore:
line xxx:
E10: \ should be followed by /, ? or &
Reason: The line continuation does not work, as vim is reading
syntax files now in vi-compatible mode. The patch sets the
nocompatible mode manually for that syntax file.
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=176
- Update to 2.13.3
* API
- The /v1/config/stages endpoint now immediately rejects parallel config updates
instead of accepting and then later failing to verify and activate them. #9328
* Certificates
- The lifetime of newly issued node certificates is reduced from 15 years to 397 days. #9337
- Compare cluster certificate tickets in constant time. #9333
* Notifications
- Fix a crash that could happen while sending notifications shortly after Icinga 2 started. #9124
- Fix missing or redundant notifications after certain combinations of state changes happened
while notifications were suppressed, for example during a downtime. #9285
* Checks and Commands
- Fix a deadlock when processing check results for checkables with dependencies. #9228
- Fix a message routing loop that can happen for event commands that are executed within a zone
using command_endpoint that resulted in excessive execution of the command. #9260
* Downtimes
- Fix scheduling of downtimes for all services on child hosts. #9159
- Creating fixed downtimes starting immediately now send a corresponding notification. #9158
- Fix some issues involving daylight saving time changes that could result in an hour missing
from scheduled downtimes. This fix applies to time periods as well. #9238
* Configuration
- Fix the evaluation order of default templates when used in combination with apply rules.
Now default templates are imported first as stated in the documentation
and as it already happens for objects defined without using apply. #9290
* IDO
- Fix an issue where contacts were not written correctly to the notification history
if multiple IDO instances are active on the same node. #9242
- Explicitly set the encoding for MySQL connections as a workaround for changed defaults in Debian bullseye. #9312
- Ship a MySQL schema upgrade that fixes inconsistent version information in the full schema file
and upgrade files which could have resulted in inaccurate reports of an outdated schema version. #9139
* Performance Data Writers
- Fix a race condition in the InfluxDB Writers that could result in a crash. #9237
- Fix a log message where Influxdb2Writer logged as InfluxdbWriter. #9315
- All writers no longer send metrics multiple times after HA failovers. #9322
* Build
- Fix the order of linker flags to fix builds on some ARM platforms. #9164
- Fix a regression introduced in 2.13.2 preventing non-unity builds. #9094
- Fix an issue when building within an unrelated Git repository, version information
from that repository could incorrectly be used for Icinga 2. #9155
- Windows: Update bundled Boost version to 1.78.0 and OpenSSL to 1.1.1n #9325
* Internals
- Fix some race conditions due to missing synchronization.
These race conditions should not have caused any practical problems
besides incorrect numbers in debug log message. #9306
- Move the startup.log and status files created when validating incoming cluster config updates
to /var/lib/icinga2/api and always keep the last failed startup.log to ease debugging. #9335
* Icinga DB
- The severity attribute was updated to match the sort order Icinga Web 2 uses for the IDO.
The documentation for this attribute was already incorrect before
and was updated to reflect the current functionality. #9239#9240
- Fix the is_sticky attribute for comments. #9303
- Fix missing updates of is_reachable and severity in the state tables. #9241
- Removing an acknowledgement no longer incorrectly writes comment history. #9302
- Fix multiple issues so that in an HA zone, both nodes now write consistent history. #9157#9182#9190
- Fix that history events are no longer written when state information should be updated. #9252
- Fix an issue where incomplete comment history events were generated. #9301
- Note: when removing comments using the API, the dedicated remove-comment action
should be used instead of the objects API, otherwise no history event will be generated.
- Fix handling of non-integer values for the order attribute of command arguments. #9181
- Note: You should only specify integer values for order, other values are converted to
integer before use so using fractional numbers there has no effect.
- Add a dependency on icingadb-redis.service to the systemd service file
so that Redis is stopped after Icinga 2. #9304
- Buffer history events in memory when the Redis connection is lost. #9271
- Add the previous soft state to the state tables. #9214
- Add missing locking on object runtime updates. #9300
- Changes from 2.13.2
* Icinga DB
- Prefix command_id with command type #9085
- Decouple environment from Icinga 2 Environment constant #9082
- Make icinga:history:stream:*#event_id deterministic #9076
- Add downtime.duration & service_state.host_id to Redis #9084
- Sync checkables along with their states first #9081
- Flush both buffered states and state checksums on initial dump #9079
- Introduce icinga:history:stream:downtime#scheduled_by #9080
- Actually write parent to parent_id of zones #9078
- Set value in milliseconds for program_start in stats/heartbeat #9077
- Clean up vanished objects from icinga:checksum:*:state #9074
- Remove usernotification history stream #9073
- Write IDs of notified users into notification history stream #9071
- Make CheckResult#scheduling_source available to Icinga DB #9072
- Stream runtime state updates only to icinga:runtime:state #9068
- Publish Redis schema version via XADD icinga:schema #9069
- Don't include checkable types in history IDs #9070
- Remove unused Redis key 'icinga:zone:parent' #9075
OBS-URL: https://build.opensuse.org/request/show/972380
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=175
- Update to 2.13.1
* Security
- CVE-2021-37698: Add TLS server certificate validation to ElasticsearchWriter, GelfWriter,
InfluxdbWriter and Influxdb2Writer (GHSA-cxfm-8j5v-5qr2)
Depending on your setup, manual intervention beyond installing the new versions may be required,
so please read the more detailed information in the release blog post carefully.
* Bugfixes
- IDO PgSQL: Fix a string quoting regression introduced in 2.13.0 #8958
- ApiListener: Automatically fall back to IPv4 in default configuration on systems without IPv6 support #8961
OBS-URL: https://build.opensuse.org/request/show/913176
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=171
- Update to 2.13.0
* Enhancements
+ Core
- PerfdataValue: Add units of measurement #7871
- Flapping: Allow to ignore states in flapping detection #8600
+ Cluster
Display log message if two nodes run on incompatible versions #8088
+ API
- /v1/actions/remove-downtime: Also remove child downtimes #8913
- Add API endpoint: /v1/actions/execute-command #8040
- /v1/actions/add-comment: Add param expiry #8035
- API-Event StateChange & CheckResult: Add acknowledgement and downtime_depth #7736
- Implement new API events ObjectCreated, ObjectDeleted and ObjectModified #8083
- Implement scheduling_endpoint attribute to checkable #6326
+ Windows
- Add support for Windows Event Log and write early log messages to it #8710
+ IDO
- MySQL: support larger host and service names #8425
+ ITL
- Add -S parameter for esxi_hardware ITL #8814
- Add CheckCommands for Thola #8683
- Add option ignore-sct for ssl_cert to ITL #8625
- Improve check_dns command when used with monitoring-plugins 2.3 #8589
- Add parameter -f to snmp-process #8569
- Add systemd CheckCommand #8568
- Add new options for ipmi-sensor #8498
- check_snmp_int: support -a #8003
- check_fail2ban: Add parameter fail2ban_jail to monitor a specific jail only #7960
- check_nrpe: Add parameters needed for PKI usage #7907
+ Metrics
- Support InfluxDB 2.0 #8719
- Add support for InfluxDB basic auth #8314
+ Docs
- Add info about ongoing support for IDO #8446
- Improve instructions on how to setup a Windows dev env #8400
- Improve instructions for installing wixtoolset on Windows #8397
- Add section about usage of satellites #8458
- Document command for verifying the parent node's certificate #8221
- Clarify TimePeriod/ScheduledDowntime time zone handling #8001
+ Misc
- Support TLS 1.3 #8718
- Livestatus: append app name to program_version #7931
- sd_notify() systemd about what we're doing right now #7874
* Bugfixes
+ Core
- Fix state not being UNKNOWN after process timeout #8937
- Set a default severity for loggers #8846
- Fix integer overflow when converting large unsigned integers to string #8742
- StartUnixWorker(): don't exit() on fork() failure #8427
- Fix perf data parser not recognizing scientific notation #8492
- Close FDs based on /proc/self/fd #8442
- Fix check source getting overwritten on passive check result #8158
- Clean up temp files #8157
- Improve perf data parser to allow for special output (e.g. ASCII tables) #8008
- On check timeout first send SIGTERM #7918
+ Cluster
- Drop passive check results for unreachable hosts/services #8267
- Fix state timestamps set by the same check result differing across nodes #8101
+ API
- Do not override status codes that are not 200 #8532
- Update the SSL context after accepting incoming connections #8515
- Allow to create API User with password #8321
- Send Content-Type as API response header too #8108
- Display a correct status when removing a downtime #8104
- Display log message if a permission error occurs #8087
- Replace broken package name validation regex #8825#8946
+ Windows
- Fix Windows command escape for " #7092
+ Notifications/Downtimes
- Fix no re-notification for non OK state changes with time delay #8562
- TimePeriod/ScheduledDowntime: Improve DST handling #8921
- Don't send notifications while suppressed by checkable #8513
- Fix a crash while removing a downtime from a disappeared checkable #8229
+ IDO
- Update program status on stop #8730
- Also mark objects inactive in memory on object deactivation #8626
- IdoCheckTask: Don't override checkable critical with warn state #8613
- PostgreSQL: Do not set standard_conforming_strings to off #8123
+ ITL
- check_http: Fix assignment of check_adress blocking check by hostname #8109
- check_mysql: Don't set -H if -s is given #8020
+ Metrics
- OpenTSDB-Writer: Remove incorrect space causing missing tag error #8245
OBS-URL: https://build.opensuse.org/request/show/910005
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=170
- Update to 2.12.5
Version 2.12.5 fixes two security vulnerabilities that may lead
to privilege escalation for authenticated API users.
Other improvements include several bugfixes related to downtimes,
downtime notifications, and more reliable connection handling.
* Security
- Don't expose the PKI ticket salt via the API. This may lead
to privilege escalation for authenticated API users by them
being able to request certificates for other identities
(CVE-2021-32739)
- Don't expose IdoMysqlConnection, IdoPgsqlConnection, and
ElasticsearchWriter passwords via the API
(CVE-2021-32743)
- Windows: Update bundled OpenSSL to version 1.1.1k #8888
Depending on your setup, manual intervention beyond installing
the new versions may be required, so please read the more
detailed information in the release blog post carefully.
* Bugfixes
- Don't send downtime end notification if downtime hasn't
started #8878
- Don't let a failed downtime creation block the others #8871
- Support downtimes and comments for checkables with long names
#8870
- Trigger fixed downtimes immediately if the current time
matches (instead of waiting for the timer) #8891
- Add configurable timeout for full connection handshake #8872
* Enhancements
- Replace existing downtimes on ScheduledDowntime change #8880
- Improve crashlog #8869
OBS-URL: https://build.opensuse.org/request/show/906462
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=169
- Update to 2.12.4
* Bugfixes
- Fix a crash when notification objects are deleted using the
API #8782
- Fix crashes that might occur during downtime scheduling if
host or downtime objects are deleted using the API #8785
- Fix an issue where notifications may incorrectly be skipped
after a downtime ends #8775
- Don't send reminder notification if the notification is still
suppressed by a time period #8808
- Fix an issue where attempting to create a duplicate object
using the API might result in the original object being
deleted #8787
- IDO: prioritize program status updates #8809
- Improve exceptions handling, including a fix for an uncaught
exception on Windows #8777
- Retry file rename operations on Windows to avoid intermittent
locking issues #8771
* Enhancements
- Support Boost 1.74 (Ubuntu 21.04, Fedora 34) #8792
- Drop icinga2-boost-8185-8184.patch, icinga2-boost-8185-8190.patch
and icinga2-boost-8185-8191.patch because now in upstream.
OBS-URL: https://build.opensuse.org/request/show/895777
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=167
- Update to 2.12.3
* Security
- Fix that revoked certificates due for renewal will
automatically be renewed ignoring the CRL
(Advisory / CVE-2020-29663)
* Bugfixes
- Improve config sync locking - resolves high load issues on
Windows #8511
- Fix runtime config updates being ignored for objects without
zone #8549
- Use proper buffer size for OpenSSL error messages #8542
* Enhancements
- On checkable recovery: re-check children that have a problem
#8506
OBS-URL: https://build.opensuse.org/request/show/856013
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=165
- Update to 2.11.5
Version 2.11.5 fixes file system race conditions
in the config update process occurring in large HA environments
and improves the cluster connection liveness mechanisms.
* Bugfixes
+ Make the config update process mutually exclusive (Prevents file system race conditions) #8093
+ Consider a JsonRpcConnection alive on a single byte of TLS payload, not only on a whole message #8094
+ Send JsonRpcConnection heartbeat every 20s instead of 10s #8103
+ Use JsonRpcConnection heartbeat only to update connection liveness (m_Seen) #8097
OBS-URL: https://build.opensuse.org/request/show/824472
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=151
- Update to 2.11.4
Version 2.11.4 fixes a crash during a heartbeat timeout with
clients not yet signed. It also resolves an issue with endpoints
not reconnecting after a reload/deploy, which caused a lot of
UNKNOWN states.
* Bugfixes
+ Cluster
- Fix segfault during heartbeat timeout with clients not yet signed #7997
- Fix endpoints not reconnecting after reload (UNKNOWN hosts/services after reload) #8043
+ Setup
- Fix exception on trusted cert not readable during node setup #8044
- prepare-dirs: Only set permissions during directory creation #8046
+ DSL
- Fix segfault on missing compare function in Array functions (sort, map, reduce, filter, any, all) #8054
OBS-URL: https://build.opensuse.org/request/show/815706
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=149
- update to 2.10.5
* Core
- Fix crashes with logrotate signals #6737 (thanks Elias Ohm)
* API
- Fix crashes and problems with permission filters from recent
Namespace introduction #6785 (thanks Elias Ohm) #6874 (backported from 2.11)
- Reduce log spam with locked connections (real fix is the network stack rewrite in 2.11) #6877
* Cluster
- Fix problems with replay log rotation and storage #6932 (thanks Peter Eckel)
* IDO DB
- Fix that reload shutdown deactivates hosts and hostgroups (introduced in 2.9) #7157
* Documentation
- Improve the REST API chapter: Unix timestamp handling, filters, unify POST requests with filters in the body
- Better layout for the features chapter, specifically metrics and events
- Split object types into monitoring, runtime, features
- Add technical concepts for cluster messages
OBS-URL: https://build.opensuse.org/request/show/705092
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=132
