This release fixes a regression introduced in 2.14.4 that caused the icinga2 node setup; icinga2 node wizard; and icinga2 pki request commands to fail if a certificate was requested from a node that has to forward the request to another node for signing. Additionally; it fixes a small bug in the performance data normalization and includes various documentation improvements.$$$$$$Bug Fixes$$$Dont close anonymous connections before sending the response for a certificate request #10337$$$Performance data: Dont discard min/max values even if crit/warn thresholds aren’t given #10339$$$Fix a failing test case on systems time_t is only 32 bits #10343$$$Documentation$$$Document the -X option for the mail-host-notification and mail-service-notification commands #10335$$$Include Nagios in the migration docs #10324$$$Remove RHEL 7 from installation instructions #10334$$$Add instructions for installing build dependencies on Windows Server #10336

Icinga 2 v2.14.4$$$This bugfix release is focused on improving HA cluster stability and easing$$$troubleshooting of issues in this area. It also addresses several crashes;$$$in the core itself and both in Icinga DB and IDO (numbers out of range).$$$In addition; it fixes several other issues such as lost notifications$$$or TimePeriod/ScheduledDowntime exceeding specified date ranges.$$$$$$Crash Fixes$$$Invalid DateTime#format() arguments in config and console on Windows Server 2016 and older. #10112$$$Downtime scheduling at runtime with non-existent trigger. #10049$$$Object creation at runtime during Icinga DB initialization. #10151$$$Comment on a service of a non-existent host. #9861$$$Miscellaneous Bugfixes$$$Lost notifications after recovery outside the notification time period. #10187$$$TimePeriod/ScheduledDowntime exceeding specified date range. #9983 #10107$$$Clean up failure for obsolete Downtimes. #10062$$$ifw-api check command: use correct process-finished handler. #10140$$$Email notification scripts: strip 0x0D (CR) for a proper Content-Type. #10061$$$Several fixes and improvements of the code quality. #10066 #10214 #10254 #10263 #10264$$$Cluster and API$$$Sync runtime objects in topological order to honor their dependencies. #10000$$$Make parallel config syncs more robust. #10013$$$After object creation via API fails; clean up properly for the next try. #10111$$$Close HTTPS connections properly to prevent leaks. #10005 #10006$$$Reduce the number of cluster messages in memory at the same time. #9991 #9999 #10210$$$Once a cluster connection shall be closed; stop communicating. #10213 #10221$$$Remove unnecessary blocking of semaphores. #9992 #9994$$$Reduce unnecessary cluster messages setting the next check time. #10011$$$Icinga DB and IDO$$$IDO: fix object relations after aborted synchronization. #10065$$$Icinga DB; IDO: limit all timestamps to four year digits. #10058 #10059$$$Icinga DB: limit execution_time and latency (milliseconds) to database schema. #10060$$$Troubleshooting$$$Add /v1/debug/malloc_info which calls malloc_info(3) if available. #10015$$$Add log messages about own network I/O. #9993 #10141 #10207$$$Several fixes and improvements of log messages. #9997 #10021 #10209$$$Windows$$$Update OpenSSL shipped on Windows to v3.0.15. #10170$$$Update Boost shipped on Windows to v1.86. #10114$$$Support CMake v3.29. #10037$$$Dont require to build .msi as admin. #10137$$$Build configuration scripts: allow custom $CMAKE_ARGS. #10312$$$Documentation$$$Distributed Monitoring: add section External CA/PKI. #9825$$$Explain how to enable/disable debug logging on the fly. #9981$$$Update supported OS versions and repository configuration. #10064 #10090 #10120 #10135 #10136 #10205$$$Several fixes and improvements. #9960 #10050 #10071 #10156 #10194$$$Replace broken links. #10115 #10118 #10282$$$Fix typographical and similarly trivial errors. #9953 #9967 #10056 #10116 #10152 #10153 #10204

2.14.3 (2024-11-12)¶$$$This security release fixes a TLS certificate validation bypass. Given the severity of that issue; users are advised to upgrade all nodes immediately.$$$$$$Security: fix TLS certificate validation bypass. CVE-2024-49369$$$Security: update OpenSSL shipped on Windows to v3.0.15.$$$Windows: sign MSI packages with a certificate the OS trusts by default.

Version 2.14.2 is a hotfix release for master nodes that mainly fixes excessive disk usage caused by the InfluxDB writers.$$$$$$InfluxDB: truncate timestamps to whole seconds to save disk space. #9969$$$HttpServerConnection: log request processing time as well. #9970$$$Update Boost shipped on Windows to v1.84. #9970

2.14.0 (2023-07-12)¶$$$Issues and PRs$$$$$$Notes¶$$$Upgrading docs: https://icinga.com/docs/icinga2/snapshot/doc/16-upgrading-icinga-2/#upgrading-to-2-14$$$$$$Thanks to all contributors: atj; atwebm; cspeterson; cycloon; DamianoChini; efuss; fabieins; haxtibal; jaapmarcus; log1-c; lrupp; maggu; mcodato; Napsty; orbison; peteeckel; slalomsk8er; stevie-sy; Tqnsls$$$$$$Breaking Changes¶$$$Remove CheckResultReader (which has been deprecated since v2.9). #9714$$$Remove StatusDataWriter (which has been deprecated since v2.9). #9715$$$ElasticsearchWriter: drop support for Elasticsearch < v7. #9812$$$Consider a checkable unreachable once one Dependency fails. Previously all of them had to fail. (Consult the upgrading docs.) #8218$$$API: reject config modifications during reload with HTTP status 503. #9445$$$icinga2 daemon: to reduce config load time; write file needed by icinga2 object list only if --dump-objects is given. #9586 #9591$$$Default email notification scripts: link to Icinga DB Web; not the monitoring module. (Consult the upgrading docs.) #9742 #9757$$$API: for security reasons hide TicketSalt in /v1/variables. #7863$$$Icinga 2 Config DSL¶$$$Disallow global variable modification after config commit start (i.e. inside object/apply T x { ... }) to reduce config load time. #9740$$$Forbid Dependency cycles at config load time. #8389$$$Allow only strings in the arrays Host#groups; Service#groups and User#groups. Needed for consistency; especially by the IDO. #9057$$$Disallow empty object names. (They worked only partially anyway.) #9409$$$Windows Agent only¶$$$The official MSIs don’t include the following features anymore. They weren’t intended; tested or needed on Windows and only waste build time; bandwidth and disk space. Both new installations and upgrades are affected.$$$$$$ElasticsearchWriter #9704$$$GelfWriter #9704$$$GraphiteWriter #9704$$$InfluxdbWriter and Influxdb2Writer #9704$$$OpenTsdbWriter #9704$$$PerfdataWriter #9704$$$We also don’t ship the following files anymore. (You can still obtain them manually.)$$$$$$NSCP.msi (NSClient++ installer) #9703$$$doc/ (Icinga 2 markdown documentation) #9705$$$On the other hand MSIs are now 75% smaller than before.$$$$$$Enhancements¶$$$Significantly reduce config load time of large setups. #8118 #9555 #9557 #9572 #9577 #9603 #9608 #9627 #9648 #9657 #9662$$$Allow to connect dependencies via redundancy groups. Only parents within one group are assumed to provide redundancy for each other. #8218$$$Built-in check command ifw-api; communicates directly with the Icinga for Windows REST API. (Doesn’t spawn a PowerShell process for that.) #9062$$$JournaldLogger which logs to systemd journal. #9000$$$API: POST /v1/objects: allow to discard some previously modified attributes; i.e. to restore the config files’ values. #9783$$$ElasticsearchWriter: support Elasticsearch v8. #9812$$$Support $env.ENV_VAR_NAME$ macros. #8302$$$Speed up Icinga DB config dump. #9524$$$Default mail notification scripts: also print $host.notes$ and $service.notes$. #9713$$$Enable built-in OpenSSL DH parameters to allow DHE TLS ciphers. #9811$$$Clean up global default TLS cipher list to improve security. #9809$$$Influxdb(2)Writer: write more precise timestamps (nanoseconds). #9599$$$Bugfixes¶$$$Icinga DB feature: normalize several Redis data not to crash the Go daemon. #9772 #9775 #9792 #9793 #9794 #9805$$$Fix parsing of perfdata across multiple lines in plugin output. #8969$$$icinga check: fix last reload failure time. #8429 #9827$$$Resolve macros inside custom vars of IcingaApplication. #9779$$$SELinux: allow Icinga and its plugins to write to syslog. #9688$$$ElasticsearchWriter: fix data buffer flush race condition during stop. #9810$$$Trigger flexible downtimes not in the past if checkable is already down. #9726$$$Send downtime expiration notifications immediately; not after up to a minute. #9726$$$Cluster¶$$$Don’t hang in timed out connection attempt. #9711 #9725$$$Fix lost acknowledgements after re-connect. #9718$$$cluster-zone check: don’t complain about not conne

2.13.7 (2023-02-16)¶$$$This security release updates Boost and OpenSSL libraries bundled on Windows and repairs broken SELinux policies. By the way it fixes several other bugs.$$$$$$Security¶$$$Windows: update bundled OpenSSL to v1.1.1t. #9672$$$Bugfixes¶$$$SELinux: fix user and domain creation by explicitly setting the role. #9690$$$Signal handlers: don’t interrupt and break plugins spawning. #9682$$$Icinga DB: take check_period into account during overdue calculation. #9679$$$Avoid corrupted files: use fsync(2)/FlushFileBuffers() everywhere. #9681$$$Solaris: fix compile error. #9680$$$Enhancements¶$$$Windows: update bundled Boost to v1.81. #9678$$$Documentation: several fixes and improvements. #9671

The main focus of version 2.13.6 is improved performance of Icinga DB and apply rules.$$$Additionally; it includes bug fixes related to config loading and API permissions.$$$$$$Bugfixes$$$Improve the throughput of the Icinga DB feature. #9550$$$Multiple changes to speed up evaluation of apply rules. #9559 #9565 #9558$$$Fix a possible crash on config loading related to ignore_on_error. #9560$$$Check API user permission on objects returned by joins. #9561$$$Windows: update bundled Boost and OpenSSL versions. #9562 #9567

Version 2.13.5 is a maintenance release that fixes some bugs; improves logging and updates the documentation as well as a bundled library.$$$$$$Bugfixes$$$Ensure not to write an incomplete (i.e. corrupt) state file. #9467$$$ITL: Render vars.apt_upgrade=true as –upgrade; not –upgrade=true. #9458$$$Icinga DB: Don’t surprise (and crash) the Go daemon with config types it doesn’t know. #9480$$$Icinga DB: Add missing Redis SELinux policy. #9473$$$Windows: Don’t spam the event log with non-error startup messages. #9457$$$Windows: Update bundled version of OpenSSL. #9460$$$Docs: Update RHEL 8 installation instructions. #9482$$$Docs: Add RHEL 9 installation instructions. #9482