mk_oracle
has been added. mk_oracle
+usually reads mk_oracle.cfg
. Now, it also reads all files with *.cfg
from
+$MK_CONFDIR/mk_oracle.d
. This feauture is needed for setups with bakery and
local changes on the database server. It is possible to configure through
-the bakery and add custom SQLs in configuration directory.
+the bakery and add custom SQLs in configuration directory mk_oracle.d
.
-All variables in files from mk_oracle.d will oerwrite possible entries from
-mk_oracle.cfg.
+All variables defined in files from the mk_oracle.d
directory will overwrite entries with the same name from
+mk_oracle.cfg
. Further, all variables defined in *.cfg
files within the mk_oracle.d
, must be unique, otherwise the last
+read file wins.
diff --git a/.werks/14237.md b/.werks/14237.md
new file mode 100644
index 00000000000..825aa8cabe7
--- /dev/null
+++ b/.werks/14237.md
@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# Fixed performance problems for various command line operations
+
+key | value
+---------- | ---
+date | 2024-09-27T10:40:03+00:00
+version | 2.4.0b1
+class | fix
+edition | cre
+component | checks
+level | 1
+compatible | yes
+
+With larger setups (>10000 hosts), loading the host configuration took considerably longer ( **O(n^2)** ) than normal.
+The ‘Parameters for this service’ page, for example, requires the complete host configuration.
diff --git a/.werks/16251.md b/.werks/16251.md
new file mode 100644
index 00000000000..fd2afb3d182
--- /dev/null
+++ b/.werks/16251.md
@@ -0,0 +1,14 @@
+[//]: # (werk v2)
+# Update monitoring-plugins to 2.4.0
+
+key | value
+---------- | ---
+date | 2024-09-04T14:11:06+00:00
+version | 2.4.0b1
+class | feature
+edition | cre
+component | checks
+level | 1
+compatible | yes
+
+
diff --git a/.werks/16254.md b/.werks/16254.md
new file mode 100644
index 00000000000..0cc7cf63f7e
--- /dev/null
+++ b/.werks/16254.md
@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# Add metric translations mrpe based windows checks
+
+key | value
+---------- | ---
+date | 2024-10-07T08:14:51+00:00
+version | 2.4.0b1
+class | feature
+edition | cre
+component | checks
+level | 1
+compatible | yes
+
+Metrics provided by `check_ping.exe` or `check_tcp.exe` have now a metric translation and are
+displayed in a correct manner.
diff --git a/.werks/16255.md b/.werks/16255.md
new file mode 100644
index 00000000000..f5bd0330153
--- /dev/null
+++ b/.werks/16255.md
@@ -0,0 +1,17 @@
+[//]: # (werk v2)
+# Stop shipping check_ircd from monitoring-plugins
+
+key | value
+---------- | ---
+date | 2024-10-10T11:13:32+00:00
+version | 2.4.0b1
+class | fix
+edition | cre
+component | checks
+level | 1
+compatible | no
+
+Since the update of monitoring-plugins to 2.4.0, `check_ircd` requires the perl module `IO::Socket::IP`.
+As we cannot guarantee that the required perl version is available under all distros supported by Checkmk, we decided to stop shipping the plugin.
+
+In case you need this plugin, you can install it manually to the local hierarchy of your site.
diff --git a/.werks/16557.md b/.werks/16557.md
new file mode 100644
index 00000000000..b61e15aac0d
--- /dev/null
+++ b/.werks/16557.md
@@ -0,0 +1,19 @@
+[//]: # (werk v2)
+# Distributed agent bakery: cached packages remain on remote site
+
+key | value
+---------- | ---
+date | 2024-10-02T11:56:57+00:00
+version | 2.4.0b1
+class | fix
+edition | cee
+component | agents
+level | 1
+compatible | yes
+
+When using the agent bakery and (automatically) downloading agent packages from a remote site,
+the remote site caches the provided packages until they are invalidated by the central site.
+This happens automatically on every call from the agent updater.
+
+This mechanism recently failed to delete unneeded cached packages from the remote site, leading
+to an increased disk usage.
diff --git a/.werks/16567.md b/.werks/16567.md
new file mode 100644
index 00000000000..91cb2b78936
--- /dev/null
+++ b/.werks/16567.md
@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# Re-add missing "History action type" filter
+
+key | value
+---------- | ---
+date | 2024-10-02T08:34:26+00:00
+version | 2.4.0b1
+class | fix
+edition | cre
+component | ec
+level | 1
+compatible | yes
+
+The "History action type" filter has been added back to the "Recent event
+history" view. It was accidentally removed during the development of 2.3.
diff --git a/.werks/16778.md b/.werks/16778.md
new file mode 100644
index 00000000000..d7b2df9a9b3
--- /dev/null
+++ b/.werks/16778.md
@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# fortisandbox plugin: expand monitored models
+
+key | value
+---------- | ---
+date | 2024-09-26T11:57:53+00:00
+version | 2.4.0b1
+class | feature
+edition | cre
+component | checks
+level | 1
+compatible | yes
+
+Previously, the fortisandbox plugins discovered and monitored only the Fortinet _fsa3000E_ devices.
+With this change, the plugin monitors all available models discoverable under the oid _1.3.6.1.4.1.12356.118.1._.
diff --git a/.werks/16895.md b/.werks/16895.md
new file mode 100644
index 00000000000..f2cfe41e216
--- /dev/null
+++ b/.werks/16895.md
@@ -0,0 +1,20 @@
+[//]: # (werk v2)
+# omd: curl wrapper not used for all supported versions of SLES and EL
+
+key | value
+---------- | ---
+compatible | yes
+version | 2.4.0b1
+date | 2024-09-17T15:13:20+00:00
+level | 1
+class | fix
+component | omd
+edition | cre
+
+Some OMD makefile rules have to be (de-)activated for certain versions of SLES or EL
+(Enterprise Linux), but would not respect all affected versions due to the redundant
+implementation of the check. This led to {{curl}} not being wrapped as needed for SLES15-SP3.
+
+This change makes use of string prefixes rather than explicit listing of all supported
+versions of e.g. SLES15[-sp*], which fixes the mentioned issue and also takes care of
+future releases of SLES15 or EL based distros.
\ No newline at end of file
diff --git a/.werks/16897.md b/.werks/16897.md
new file mode 100644
index 00000000000..d9c6802b579
--- /dev/null
+++ b/.werks/16897.md
@@ -0,0 +1,19 @@
+[//]: # (werk v2)
+# chrony: wrong handling of 'n/a' values for 'Ref time (UTC)' and 'Stratum'
+
+key | value
+---------- | ---
+date | 2024-09-25T11:16:41+00:00
+version | 2.4.0b1
+class | fix
+edition | cre
+component | checks
+level | 1
+compatible | yes
+
+A chrony status without a valid server also contains invalid values for 'Stratum' and 'Ref time',
+resulting in a 'Time since last sync' of 54 years 256 days being reported (which is the difference
+to epoc := 1.1.1970).
+
+This change just skips reporting 'Stratum' and 'Time since last sync' if we don't have a valid
+server (address).
diff --git a/.werks/16898.md b/.werks/16898.md
new file mode 100644
index 00000000000..dffe6aaa0d5
--- /dev/null
+++ b/.werks/16898.md
@@ -0,0 +1,16 @@
+[//]: # (werk v2)
+# active_checks:httpv2: support macros in 'user_agent' field
+
+key | value
+---------- | ---
+date | 2024-10-08T11:32:55+00:00
+version | 2.4.0b1
+class | feature
+edition | cre
+component | checks
+level | 1
+compatible | yes
+
+While the `endpoint.url` element in httpv2 active check configuration support macro replacement,
+`user_agent` doesn't.
+This change adds support for macro replacement also for the `user_agent` field.
diff --git a/.werks/17036.md b/.werks/17036.md
deleted file mode 100644
index d193e06587b..00000000000
--- a/.werks/17036.md
+++ /dev/null
@@ -1,17 +0,0 @@
-[//]: # (werk v2)
-# heartbeat_crm: Handle cases when pacemaker service is not running
-
-key | value
----------- | ---
-date | 2024-09-16T21:35:09+00:00
-version | 2.4.0b1
-class | fix
-edition | cre
-component | checks
-level | 1
-compatible | yes
-
-The creation of the agent section depended on the pacemaker service being running. If this was not the case, the section was left empty, causing the services to become stale.
-From now on, if the pacemaker service is not running, the service will go into CRIT state and the summary will indicate that the connection was not possible/refused.
-
-Also, the agent now checks for the existence of 'crm_mon' on the system, as this is a prerequisite for further command execution.
diff --git a/.werks/17038.md b/.werks/17038.md
new file mode 100644
index 00000000000..0cd33ae4c84
--- /dev/null
+++ b/.werks/17038.md
@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# emka_modules: Fix parsing error
+
+key | value
+---------- | ---
+date | 2024-09-29T23:11:58+00:00
+version | 2.4.0b1
+class | fix
+edition | cre
+component | checks
+level | 1
+compatible | yes
+
+When upgrading from 2.2 to 2.3, a parsing error caused services related to the 'emka_modules' check plugin to receive no data and go to 'UNKN'.
+This has now been fixed and the check plugin will behave as it did in 2.2.
diff --git a/.werks/17039.md b/.werks/17039.md
new file mode 100644
index 00000000000..489df193182
--- /dev/null
+++ b/.werks/17039.md
@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# db2_sort_overflow: Fix typo in service summary
+
+key | value
+---------- | ---
+date | 2024-10-06T17:19:11+00:00
+version | 2.4.0b1
+class | fix
+edition | cre
+component | checks
+level | 1
+compatible | yes
+
+There was a typo in the summary. When the state was WARN or CRIT, the summary said "leves at" instead of "levels at".
+This is now fixed.
diff --git a/.werks/17088.md b/.werks/17088.md
new file mode 100644
index 00000000000..2d14089f6a1
--- /dev/null
+++ b/.werks/17088.md
@@ -0,0 +1,18 @@
+[//]: # (werk v2)
+# mk_logwatch: Remove colored output support in debug mode
+
+key | value
+---------- | ---
+date | 2024-09-23T08:58:40+00:00
+version | 2.4.0b1
+class | fix
+edition | cre
+component | checks
+level | 1
+compatible | no
+
+Until now the debug mode ("-d" flag) would color the lines of the mk_logwatch output depending on their log level. This causes problems when processing the output, leading to the e.g. `maxcontextlines` setting no longer being effective.
+To improve the stability of the agent plugin, its output will no longer be colored.
+If you need the output to be colored, you can do so via e.g.
+
+ mk_logwatch.py -d | sed -e 's/^C .*/\x1b[1;31m&\x1b[0m/' -e 's/^W .*/\x1b[1;33m&\x1b[0m/' -e 's/^O .*/\x1b[1;32m&\x1b[0m/' -e 's/^I .*/\x1b[1;34m&\x1b[0m/'
diff --git a/.werks/17095.md b/.werks/17095.md
new file mode 100644
index 00000000000..9d8902aa303
--- /dev/null
+++ b/.werks/17095.md
@@ -0,0 +1,50 @@
+[//]: # (werk v2)
+# Sanitize Host and Folder Credentials in Audit Log
+
+key | value
+---------- | ---
+date | 2024-10-07T05:57:04+00:00
+version | 2.4.0b1
+class | security
+edition | cre
+component | wato
+level | 1
+compatible | no
+
+Before this Werk, adding, changing, or removing SNMP and IMPI credentials in a host or folder's properties would log those credentials in the WATO audit log. Now, credentials are masked before being written to the log.
+
+The affected logs, both via the rendering functionality in WATO as well as the files on the file system, are only accessible to authenticated users.
+
+This issue was found during internal review.
+
+*Affected Versions*:
+
+* 2.3.0
+* 2.2.0
+* 2.1.0
+* 2.0.0 (EOL)
+
+*Recommendations*:
+
+We have marked this Werk incompatible because we recommend taking manual action:
+
+Consider rotating affected credentials.
+If that is not feasible, consider sanitizing the log files.
+Also take into account that log files containing credentials might have been written to backups.
+
+The affected log files can be found in `~/var/check_mk/wato/log`.
+
+Note that, before Checkmk 2.3.0p18, entries in the files were not separated by newlines but by null bytes.
+So they would appear as one long line.
+Entries that might contain credentials are all entries where the `'action'` is `'edit-folder'` or `'edit-host'`, and the `'diff_text'` contains any of the following strings:
+
+ * `Attribute "snmp_community"`
+ * `Value of "snmp_community"`
+ * `Attribute "management_snmp_community"`
+ * `Value of "management_snmp_community"`
+ * `Attribute "management_ipmi_credentials"`
+ * `Value of "management_ipmi_credentials"`
+
+*Vulnerability Management*:
+
+We have rated the issue with a CVSS Score of 5.1 Medium (`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N`) and assigned `CVE-2024-38862`.
diff --git a/.werks/17096.md b/.werks/17096.md
new file mode 100644
index 00000000000..476fd2d3563
--- /dev/null
+++ b/.werks/17096.md
@@ -0,0 +1,35 @@
+[//]: # (werk v2)
+# CSRF token leaked in URL parameters (CVE-2024-38863)
+
+key | value
+---------- | ---
+date | 2024-10-07T05:48:40+00:00
+version | 2.4.0b1
+class | security
+edition | cre
+component | wato
+level | 1
+compatible | yes
+
+Before this Werk, the CSRF token was mistakenly included as a query parameter in certain URLs when navigating Checkmk, which could result in the token being saved in bookmarks.
+This increased the risk of unintentional exposure, such as when sharing bookmarks with other users.
+The issue has been resolved.
+
+While storing or unintentionally exposing the token doesn't present an immediate security threat, it could potentially enable phishing attacks targeting the specific user for the duration of the token's validity.
+In Checkmk, CSRF tokens remain valid for the session's duration (configured under Global settings > Session management).
+
+This issue was found during internal review.
+
+*Affected Versions*:
+
+* 2.3.0
+* 2.2.0
+* 2.1.0
+
+*Mitigations*:
+
+Avoid sharing or exposing URLs that contain the query parameter `csrf_token=`.
+
+*Vulnerability Management*:
+
+We have rated the issue with a CVSS Score of 2.0 Low (`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L`) and assigned `CVE-2024-38863`.
diff --git a/.werks/17124.md b/.werks/17124.md
new file mode 100644
index 00000000000..a33934a1b6e
--- /dev/null
+++ b/.werks/17124.md
@@ -0,0 +1,17 @@
+[//]: # (werk v2)
+# mk_postgres: Fix 'Argument list too long'
+
+key | value
+---------- | ---
+date | 2024-07-04T07:22:11+00:00
+version | 2.4.0b1
+class | fix
+edition | cre
+component | checks
+level | 1
+compatible | yes
+
+The execution of large queries might run into an OS specific restriction
+regarding the length of arguments. In order to bypass the above error we use
+`psql -f + + | +||
+ + Additional details + | +
+
|
+
+
---|
+
|
+
+
+ Checkmk GmbH |
+
+ Host + | ++ Service + | ++ Event + | ++ Event date + | +|||
---|---|---|---|---|---|---|
+ {{ entry.LINKEDHOSTNAME | safe }} + | ++ {% if bulk_service_notification %} + {{ entry.LINKEDSERVICEDESC | safe }} + {% endif %} + | +
+
|
+ + {{ entry.LONGDATETIME }} + | +
+ + View event history + + | +
+ + | +
+ + | +|
+ + Contact groups + | +|
---|---|
+ {% for item in data.HOSTCONTACTGROUPNAMES.split(',') %} + + • {{ item }} + + {% endfor %} + | +
+ + | ++ + Event overview + | +
---|---|
+ Event date: + | ++ {{ data.LONGDATETIME }} + | +
+ Address: + | ++ {{ data.HOSTADDRESS }} + | +
+ Site: + | ++ {{ data.OMD_SITE }} + | +
+ Summary: + | + ++ {% if service_notification %} + {{ macros.replace_statemarker(data.SERVICEOUTPUT_HTML) }} + {% else %} + {{ macros.replace_statemarker(data.HOSTOUTPUT_HTML) }} + {%endif %} + | +
+ Service details: + | +
+ + {% if data.LONGSERVICEOUTPUT_HTML %} + {{ macros.replace_statemarker(data.LONGSERVICEOUTPUT_HTML) }} + {% else %} + No details available + {%endif %} + + |
+
+ + | +
+ + Graph + | +
+ {% for graph in graphs %} + + {% endfor %} + | +
+ + View graph to inspect + + | +
+ + | +|
+ + Host labels + | +|
---|---|
+ {% for key, value in data.items() %} {% if + key.startswith('HOSTLABEL_') %} + + {{ key[10:] }}:{{ value }} + + {% endif %} {% endfor %} + | +
+ + | +|
+ + Host tags + | +|
---|---|
+ {% for tag_with_id in data.HOSTTAGS.split(' ') %} + + {{ tag_with_id }} + + {% endfor %} + | +
+ + + + View issue + + + | +
+ + | +|
+ + Service labels + | +|
---|---|
+ {% set ns = namespace(has_labels = false) %}
+ {% for key, value in data.items() %}
+ {% if key.startswith('SERVICELABEL_')%}
+ {% set ns.has_labels = true %}
+
+ {{ key[13:] }}:{{ value }}
+
+ {% endif %}
+ {% endfor %}
+ {% if not ns.has_labels %}
+ + No Service labels + + {% endif %} + |
+
+
|
+ |||||||||
+ {% if href %} + {{ macros.view_issue_button(href) }} + {% endif %} + | +