- Update to 2.14.1
* Security
- Automatically renew own root CA and distribute it to all nodes. #9933
- Update OpenSSL shipped on Windows to v3.0.12. #9946
- Disable TLS renegotiation (handshake on existing connection). #9946
* Bugfixes
- Icinga DB feature: fix crash due to missing NULL pointer check. #9946
- Icinga DB feature: fix data written into Redis crashing the Go daemon. #9946
- GelfWriter: fix deadlock on stop/reload caused by busy queue. #9947
- Don't lose notifications due to too long output, truncate it. #9947
* Enhancements
- Discard duplicate problem notifications due to state filtering. #9932
- Speed up API filters targeting specific hosts/services to O(1). #9944
- POST /v1/console/*: return HTTP 503 while Icinga is reloading. #9947
- Update Boost shipped on Windows to v1.83. #9946
- Documentation: several fixes and improvements. #9921
OBS-URL: https://build.opensuse.org/request/show/1134463
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=185
- Update to 2.14.0
* Breaking Changes
- Remove CheckResultReader (which has been deprecated since v2.9). #9714
- Remove StatusDataWriter (which has been deprecated since v2.9). #9715
- ElasticsearchWriter: drop support for Elasticsearch < v7. #9812
- Consider a checkable unreachable once one Dependency fails.
Previously all of them had to fail. (Consult the upgrading docs.) #8218
- API: reject config modifications during reload with HTTP status 503. #9445
- icinga2 daemon: to reduce config load time, write file needed by
icinga2 object list only if --dump-objects is given. #9586#9591
- Default email notification scripts: link to Icinga DB Web,
not the monitoring module. (Consult the upgrading docs.) #9742#9757
- API: for security reasons hide TicketSalt in /v1/variables. #7863
* Icinga 2 Config DSL
- Disallow global variable modification after config commit start (i.e.
inside object/apply T "x" { ... }) to reduce config load time. #9740
- Forbid Dependency cycles at config load time. #8389
- Allow only strings in the arrays Host#groups, Service#groups and
User#groups. Needed for consistency, especially by the IDO. #9057
- Disallow empty object names. (They worked only partially anyway.) #9409
* Enhancements
- Significantly reduce config load time of large setups.
#8118#9555#9557#9572#9577#9603#9608#9627#9648#9657#9662
- Allow to connect dependencies via redundancy groups. Only parents within
one group are assumed to provide redundancy for each other. #8218
- Built-in check command ifw-api, communicates directly with the Icinga for
Windows REST API. (Doesn't spawn a PowerShell process for that.) #9062
- JournaldLogger which logs to systemd journal. #9000
- API: POST /v1/objects: allow to discard some previously modified attributes,
i.e. to restore the config files' values. #9783
- ElasticsearchWriter: support Elasticsearch v8. #9812
- Support $env.ENV_VAR_NAME$ macros. #8302
- Speed up Icinga DB config dump. #9524
- Default mail notification scripts: also print $host.notes$ and $service.notes$. #9713
- Enable built-in OpenSSL DH parameters to allow DHE TLS ciphers. #9811
- Clean up global default TLS cipher list to improve security. #9809
- Influxdb(2)Writer: write more precise timestamps (nanoseconds). #9599
* Bugfixes
- Icinga DB feature: normalize several Redis data not to crash the Go daemon.
#9772#9775#9792#9793#9794#9805
- Fix parsing of perfdata across multiple lines in plugin output. #8969
- icinga check: fix last reload failure time. #8429#9827
- Resolve macros inside custom vars of IcingaApplication. #9779
- SELinux: allow Icinga and its plugins to write to syslog. #9688
- ElasticsearchWriter: fix data buffer flush race condition during stop. #9810
- Trigger flexible downtimes not in the past if checkable is already down. #9726
- Send downtime expiration notifications immediately, not after up to a minute. #9726
* Cluster
- Don't hang in timed out connection attempt. #9711#9725
- Fix lost acknowledgements after re-connect. #9718
- cluster-zone check: don't complain about not connected
other local zone members if there aren't any. #8595
- Allow agent to update executions delegated to it via /v1/actions/execute-command. #8627
* API
- Disallow breaking inter-object relationships by changing
relationship attributes at runtime, e.g. Service#host_name. #9407
- Correct several HTTP response status codes. #7958#9354
- Correct Boolean field types previously reported by /v1/types as Number. #9514
* CLI
- icinga2 daemon: fix -DConfiguration.Concurrency= flag
which now allows to override the number of threads. #9643
- icinga2 node wizard: avoid unnecessary chown(2) which may fail and abort the wizard. #8744
- Correct several log messages. #8895#8965#9663
* ITL
- Add linux_netdev check command. #9045
+ Command Argument Changes
- disk: don't pass -m (disk_megabytes) by default. #9642
- disk: pass -X fuse.portal (disk_exclude_type) by default. #9459
- http: support multiple -k (http_header) as array. #8574
- icmp: double defaults for -w (icmp_wpl) and -c (icmp_cpl). #9041
- logfiles: pass --winwarncrit (logfiles_winwarncrit) without argument. #9056
- nwc_health: pass SNMPv3-only args only when using SNMPv3. #9095
- vmware-esx-dc-runtime-tools and vmware-esx-soap-vm-runtime-tools:
- rename --open-vm-tools to --open_vm_tools_ok (vmware_openvmtools). #9611
OBS-URL: https://build.opensuse.org/request/show/1114137
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=184
- Update to 2.13.8
* Bugfixes
- Icinga DB feature: normalize several Redis data not to crash the Go daemon. #9814
- Don't hang in timed out connection attempt. #9815
- Trigger flexible downtimes not in the past if checkable is already down. #9817
- ElasticsearchWriter: fix data buffer flush race condition during stop. #9818
- SELinux: allow Icinga and its plugins to write to syslog. #9819
- Fix lost acknowledgements after re-connect. #9820
- Fix parsing of perfdata across multiple lines in plugin output. #9821
- cluster-zone check: don't complain about not connected
other local zone members if there aren't any. #9822
* Updates
- Update Boost shipped on Windows to v1.82. #9816
- Update OpenSSL shipped on Windows to v3.0.9. #9816
- Update vendored https://github.com/nlohmann/json to v3.9.1. #9816
- Update vendored https://github.com/nemtrif/utfcpp to v3.2.3. #9816
OBS-URL: https://build.opensuse.org/request/show/1098792
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=182
- Update to 2.13.7
* Security
- Windows: update bundled OpenSSL to v1.1.1t. #9672
* Bugfixes
- SELinux: fix user and domain creation by explicitly setting the role. #9690
- Signal handlers: don't interrupt and break plugins spawning. #9682
- Icinga DB: take check\_period into account during overdue calculation. #9679
- Avoid corrupted files: use fsync(2)/FlushFileBuffers() everywhere. #9681
- Solaris: fix compile error. #9680
* Enhancements
- Windows: update bundled Boost to v1.81. #9678
- Documentation: several fixes and improvements. #9671
- Drop icinga2-boost.patch because now in upstream.
OBS-URL: https://build.opensuse.org/request/show/1066252
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=181
- Update to 2.13.4
* Bugfixes
- Fix a race-condition involving object attribute updates that could result in a crash. #9395
- After a host recovered, only send problem notifications for services after they have been
rechecked afterwards to avoid false - notifications. #9348
- Speed up config validation by avoiding redundant serialization of objects. #9400
- Add a separator attribute to allow using arguments like --key=value as required by some
check plugins. This fixes the --upgrade and --dist-upgrade arguments of check_apt. #9397
- Windows: Update bundled versions of Boost and OpenSSL. #9360#9415
* Icinga DB
- Add an icingadb CheckCommand to allow checking if Icinga DB is healthy. #9417
- Update documentation related to Icinga DB. #9423
- Fix a bug where history events could miss the environment ID. #9396
- Properly serialize attributes of command arguments when explicitly set to null. #9398
- Rename some attributes to make the database schema more consistent. #9399#9419#9421
- Make the error message more helpful if the API isn't set up #9418
OBS-URL: https://build.opensuse.org/request/show/986199
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=177
When upgrading vim to version 8 the syntax file does not work anymore:
line xxx:
E10: \ should be followed by /, ? or &
Reason: The line continuation does not work, as vim is reading
syntax files now in vi-compatible mode. The patch sets the
nocompatible mode manually for that syntax file.
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=176
- Update to 2.13.3
* API
- The /v1/config/stages endpoint now immediately rejects parallel config updates
instead of accepting and then later failing to verify and activate them. #9328
* Certificates
- The lifetime of newly issued node certificates is reduced from 15 years to 397 days. #9337
- Compare cluster certificate tickets in constant time. #9333
* Notifications
- Fix a crash that could happen while sending notifications shortly after Icinga 2 started. #9124
- Fix missing or redundant notifications after certain combinations of state changes happened
while notifications were suppressed, for example during a downtime. #9285
* Checks and Commands
- Fix a deadlock when processing check results for checkables with dependencies. #9228
- Fix a message routing loop that can happen for event commands that are executed within a zone
using command_endpoint that resulted in excessive execution of the command. #9260
* Downtimes
- Fix scheduling of downtimes for all services on child hosts. #9159
- Creating fixed downtimes starting immediately now send a corresponding notification. #9158
- Fix some issues involving daylight saving time changes that could result in an hour missing
from scheduled downtimes. This fix applies to time periods as well. #9238
* Configuration
- Fix the evaluation order of default templates when used in combination with apply rules.
Now default templates are imported first as stated in the documentation
and as it already happens for objects defined without using apply. #9290
* IDO
- Fix an issue where contacts were not written correctly to the notification history
if multiple IDO instances are active on the same node. #9242
- Explicitly set the encoding for MySQL connections as a workaround for changed defaults in Debian bullseye. #9312
- Ship a MySQL schema upgrade that fixes inconsistent version information in the full schema file
and upgrade files which could have resulted in inaccurate reports of an outdated schema version. #9139
* Performance Data Writers
- Fix a race condition in the InfluxDB Writers that could result in a crash. #9237
- Fix a log message where Influxdb2Writer logged as InfluxdbWriter. #9315
- All writers no longer send metrics multiple times after HA failovers. #9322
* Build
- Fix the order of linker flags to fix builds on some ARM platforms. #9164
- Fix a regression introduced in 2.13.2 preventing non-unity builds. #9094
- Fix an issue when building within an unrelated Git repository, version information
from that repository could incorrectly be used for Icinga 2. #9155
- Windows: Update bundled Boost version to 1.78.0 and OpenSSL to 1.1.1n #9325
* Internals
- Fix some race conditions due to missing synchronization.
These race conditions should not have caused any practical problems
besides incorrect numbers in debug log message. #9306
- Move the startup.log and status files created when validating incoming cluster config updates
to /var/lib/icinga2/api and always keep the last failed startup.log to ease debugging. #9335
* Icinga DB
- The severity attribute was updated to match the sort order Icinga Web 2 uses for the IDO.
The documentation for this attribute was already incorrect before
and was updated to reflect the current functionality. #9239#9240
- Fix the is_sticky attribute for comments. #9303
- Fix missing updates of is_reachable and severity in the state tables. #9241
- Removing an acknowledgement no longer incorrectly writes comment history. #9302
- Fix multiple issues so that in an HA zone, both nodes now write consistent history. #9157#9182#9190
- Fix that history events are no longer written when state information should be updated. #9252
- Fix an issue where incomplete comment history events were generated. #9301
- Note: when removing comments using the API, the dedicated remove-comment action
should be used instead of the objects API, otherwise no history event will be generated.
- Fix handling of non-integer values for the order attribute of command arguments. #9181
- Note: You should only specify integer values for order, other values are converted to
integer before use so using fractional numbers there has no effect.
- Add a dependency on icingadb-redis.service to the systemd service file
so that Redis is stopped after Icinga 2. #9304
- Buffer history events in memory when the Redis connection is lost. #9271
- Add the previous soft state to the state tables. #9214
- Add missing locking on object runtime updates. #9300
- Changes from 2.13.2
* Icinga DB
- Prefix command_id with command type #9085
- Decouple environment from Icinga 2 Environment constant #9082
- Make icinga:history:stream:*#event_id deterministic #9076
- Add downtime.duration & service_state.host_id to Redis #9084
- Sync checkables along with their states first #9081
- Flush both buffered states and state checksums on initial dump #9079
- Introduce icinga:history:stream:downtime#scheduled_by #9080
- Actually write parent to parent_id of zones #9078
- Set value in milliseconds for program_start in stats/heartbeat #9077
- Clean up vanished objects from icinga:checksum:*:state #9074
- Remove usernotification history stream #9073
- Write IDs of notified users into notification history stream #9071
- Make CheckResult#scheduling_source available to Icinga DB #9072
- Stream runtime state updates only to icinga:runtime:state #9068
- Publish Redis schema version via XADD icinga:schema #9069
- Don't include checkable types in history IDs #9070
- Remove unused Redis key 'icinga:zone:parent' #9075
OBS-URL: https://build.opensuse.org/request/show/972380
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=175
- Update to 2.13.1
* Security
- CVE-2021-37698: Add TLS server certificate validation to ElasticsearchWriter, GelfWriter,
InfluxdbWriter and Influxdb2Writer (GHSA-cxfm-8j5v-5qr2)
Depending on your setup, manual intervention beyond installing the new versions may be required,
so please read the more detailed information in the release blog post carefully.
* Bugfixes
- IDO PgSQL: Fix a string quoting regression introduced in 2.13.0 #8958
- ApiListener: Automatically fall back to IPv4 in default configuration on systems without IPv6 support #8961
OBS-URL: https://build.opensuse.org/request/show/913176
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=171
- Update to 2.13.0
* Enhancements
+ Core
- PerfdataValue: Add units of measurement #7871
- Flapping: Allow to ignore states in flapping detection #8600
+ Cluster
Display log message if two nodes run on incompatible versions #8088
+ API
- /v1/actions/remove-downtime: Also remove child downtimes #8913
- Add API endpoint: /v1/actions/execute-command #8040
- /v1/actions/add-comment: Add param expiry #8035
- API-Event StateChange & CheckResult: Add acknowledgement and downtime_depth #7736
- Implement new API events ObjectCreated, ObjectDeleted and ObjectModified #8083
- Implement scheduling_endpoint attribute to checkable #6326
+ Windows
- Add support for Windows Event Log and write early log messages to it #8710
+ IDO
- MySQL: support larger host and service names #8425
+ ITL
- Add -S parameter for esxi_hardware ITL #8814
- Add CheckCommands for Thola #8683
- Add option ignore-sct for ssl_cert to ITL #8625
- Improve check_dns command when used with monitoring-plugins 2.3 #8589
- Add parameter -f to snmp-process #8569
- Add systemd CheckCommand #8568
- Add new options for ipmi-sensor #8498
- check_snmp_int: support -a #8003
- check_fail2ban: Add parameter fail2ban_jail to monitor a specific jail only #7960
- check_nrpe: Add parameters needed for PKI usage #7907
+ Metrics
- Support InfluxDB 2.0 #8719
- Add support for InfluxDB basic auth #8314
+ Docs
- Add info about ongoing support for IDO #8446
- Improve instructions on how to setup a Windows dev env #8400
- Improve instructions for installing wixtoolset on Windows #8397
- Add section about usage of satellites #8458
- Document command for verifying the parent node's certificate #8221
- Clarify TimePeriod/ScheduledDowntime time zone handling #8001
+ Misc
- Support TLS 1.3 #8718
- Livestatus: append app name to program_version #7931
- sd_notify() systemd about what we're doing right now #7874
* Bugfixes
+ Core
- Fix state not being UNKNOWN after process timeout #8937
- Set a default severity for loggers #8846
- Fix integer overflow when converting large unsigned integers to string #8742
- StartUnixWorker(): don't exit() on fork() failure #8427
- Fix perf data parser not recognizing scientific notation #8492
- Close FDs based on /proc/self/fd #8442
- Fix check source getting overwritten on passive check result #8158
- Clean up temp files #8157
- Improve perf data parser to allow for special output (e.g. ASCII tables) #8008
- On check timeout first send SIGTERM #7918
+ Cluster
- Drop passive check results for unreachable hosts/services #8267
- Fix state timestamps set by the same check result differing across nodes #8101
+ API
- Do not override status codes that are not 200 #8532
- Update the SSL context after accepting incoming connections #8515
- Allow to create API User with password #8321
- Send Content-Type as API response header too #8108
- Display a correct status when removing a downtime #8104
- Display log message if a permission error occurs #8087
- Replace broken package name validation regex #8825#8946
+ Windows
- Fix Windows command escape for " #7092
+ Notifications/Downtimes
- Fix no re-notification for non OK state changes with time delay #8562
- TimePeriod/ScheduledDowntime: Improve DST handling #8921
- Don't send notifications while suppressed by checkable #8513
- Fix a crash while removing a downtime from a disappeared checkable #8229
+ IDO
- Update program status on stop #8730
- Also mark objects inactive in memory on object deactivation #8626
- IdoCheckTask: Don't override checkable critical with warn state #8613
- PostgreSQL: Do not set standard_conforming_strings to off #8123
+ ITL
- check_http: Fix assignment of check_adress blocking check by hostname #8109
- check_mysql: Don't set -H if -s is given #8020
+ Metrics
- OpenTSDB-Writer: Remove incorrect space causing missing tag error #8245
OBS-URL: https://build.opensuse.org/request/show/910005
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=170
- Update to 2.12.5
Version 2.12.5 fixes two security vulnerabilities that may lead
to privilege escalation for authenticated API users.
Other improvements include several bugfixes related to downtimes,
downtime notifications, and more reliable connection handling.
* Security
- Don't expose the PKI ticket salt via the API. This may lead
to privilege escalation for authenticated API users by them
being able to request certificates for other identities
(CVE-2021-32739)
- Don't expose IdoMysqlConnection, IdoPgsqlConnection, and
ElasticsearchWriter passwords via the API
(CVE-2021-32743)
- Windows: Update bundled OpenSSL to version 1.1.1k #8888
Depending on your setup, manual intervention beyond installing
the new versions may be required, so please read the more
detailed information in the release blog post carefully.
* Bugfixes
- Don't send downtime end notification if downtime hasn't
started #8878
- Don't let a failed downtime creation block the others #8871
- Support downtimes and comments for checkables with long names
#8870
- Trigger fixed downtimes immediately if the current time
matches (instead of waiting for the timer) #8891
- Add configurable timeout for full connection handshake #8872
* Enhancements
- Replace existing downtimes on ScheduledDowntime change #8880
- Improve crashlog #8869
OBS-URL: https://build.opensuse.org/request/show/906462
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=169
- Update to 2.12.4
* Bugfixes
- Fix a crash when notification objects are deleted using the
API #8782
- Fix crashes that might occur during downtime scheduling if
host or downtime objects are deleted using the API #8785
- Fix an issue where notifications may incorrectly be skipped
after a downtime ends #8775
- Don't send reminder notification if the notification is still
suppressed by a time period #8808
- Fix an issue where attempting to create a duplicate object
using the API might result in the original object being
deleted #8787
- IDO: prioritize program status updates #8809
- Improve exceptions handling, including a fix for an uncaught
exception on Windows #8777
- Retry file rename operations on Windows to avoid intermittent
locking issues #8771
* Enhancements
- Support Boost 1.74 (Ubuntu 21.04, Fedora 34) #8792
- Drop icinga2-boost-8185-8184.patch, icinga2-boost-8185-8190.patch
and icinga2-boost-8185-8191.patch because now in upstream.
OBS-URL: https://build.opensuse.org/request/show/895777
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=167
- Update to 2.12.3
* Security
- Fix that revoked certificates due for renewal will
automatically be renewed ignoring the CRL
(Advisory / CVE-2020-29663)
* Bugfixes
- Improve config sync locking - resolves high load issues on
Windows #8511
- Fix runtime config updates being ignored for objects without
zone #8549
- Use proper buffer size for OpenSSL error messages #8542
* Enhancements
- On checkable recovery: re-check children that have a problem
#8506
OBS-URL: https://build.opensuse.org/request/show/856013
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/icinga2?expand=0&rev=165
