This release contains a number of fixes for various smaller but annoying bugs; including one regression regarding API authentication with certain HTTP client libraries. It also ensures that Icinga 2 is compatible with newer OpenSSL versions.$$$$$$Bugfixes$$$Track objects deleted at runtime to avoid erroneous recreation when processing the replay log $$$Ensure that connecting to endpoints can no longer hang indefinitely; which had stopped it from initiating further connection attempts until Icinga 2 was restarted$$$Fix a regression introduced with v2.16.0; that broke API authentication for clients that only send HTTP Basic Auth credentials after the server requested them $$$Improve locking of performance data arrays to prevent possible deadlocks$$$Fix high response latency with multiple API requests targeting non-existent hosts or services$$$Enhancements and Documentation$$$Add support for OpenSSL 4.0$$$Remove Amazon Linux 2 from the documentation after it has reached its end of life

Icinga 2 v2.16.3 Latest$$$@jschmidt-icinga jschmidt-icinga released this 2 days ago$$$ v2.16.3 $$$ a55fdbd $$$This is a hotfix release that fixes a regression with the Json.decode() DSL function that was introduced in v2.16.2: The addition of a second argument to the internal JsonDecode() function unintentionally leaked into the DSL as a required argument. This version restores the old and intended behavior of Json.decode().$$$$$$Changes$$$Restore single-argument Json.decode() in the DSL (#10921)$$$Add the upgrading documentation for v2.15.1 again; which went missing with the v2.16.0 release (#10916)

This release fixes some critical security vulnerabilities in Icinga 2. Users are advised to upgrade immediately; as two of them allow an unauthenticated attacker to take over or crash the Icinga 2 process over the network. The other security fixes only affect authenticated API users.$$$$$$In addition; a new permission named filter-expression is introduced; which allows specifying if individual API users are allowed to use DSL filter expressions in API queries. This allows further restricting some API users that dont need this capability; for example; those only submitting individual check results. Due to the incompatibility of this change; enforcement of this permission is opt-in until v2.17; see the upgrading docs for details.$$$$$$Verify that certificate update requests come from an authorized endpoint (GHSA-vj39-ww8j-vvx5)$$$Fix stack overflow due to deeply nested data structures (GHSA-wh38-wg57-5w7g)$$$Prevent arbitrary config injection on object creation via the API (GHSA-jgqj-x5j9-vgcm)$$$Fix that /v1/config/files could send uninitialized memory in case of file I/O errors (#10871)$$$Add filter-expression permission to make it possible to prevent API users from using DSL filter expressions$$$Windows: Update bundled OpenSSL to v3.5.7 (#10893)

Icinga 2 v2.16.1$$$This is a small release mostly to fix the issues some users were encountering in connection with perfdata writers; mostly Graphite and InfluxDB. The only significant change is that the changes from #10668 and #10799 are being reverted. This affects ElasticsearchWriter; GraphiteWriter; GelfWriter; InfluxdbWriter; Influxdb2Writer and OpenTsdbWriter.$$$$$$Changes$$$Revert adding PerfdataWriterConnection: #10851$$$Docs: Note OTLP metrics package limitation on Debian 11 and Ubuntu 22.04 and Amazon Linux 2: #10837

Icinga 2 v2.16.1$$$This is a small release mostly to fix the issues some users were encountering in connection with perfdata writers; mostly Graphite and InfluxDB. The only significant change is that the changes from #10668 and #10799 are being reverted. This affects ElasticsearchWriter; GraphiteWriter; GelfWriter; InfluxdbWriter; Influxdb2Writer and OpenTsdbWriter.$$$$$$Changes$$$Revert adding PerfdataWriterConnection: #10851$$$Docs: Note OTLP metrics package limitation on Debian 11 and Ubuntu 22.04 and Amazon Linux 2: #10837

Icinga 2 v2.16.0$$$With this release the license of the project was updated to GPLv3 or later (#10700).$$$$$$In this release weve added the OTLPMetricsWriter; a new perfdata writer targeting backends that support the OpenTelemetry protocol. We recommend users to replace other perfdata writers with this one if possible; especially ElasticsearchWriter; which is now deprecated and scheduled for removal in v2.18.$$$$$$Another big improvement is the addition of streaming support to our HTTP handlers. Most handlers now use chunked encoding to reduce the amount of the generated JSON document that has to be kept in memory at any one time. Some endpoints; notably v1/objects/query; will also start to stream the response immediately; as the results are processed. This should solve most of the memory issues users were seeing when using the Icinga 2 API on large clusters.$$$$$$Weve also redone our Docker images with this version; with some changes to how the /data directory is mounted and initialized; so make sure you read the new documentation page for installing Icinga 2 in containers.$$$$$$Below is a summary of the changes relevant for our users. For the complete list of issues and PRs; please see the milestone on GitHub.$$$$$$Please also check our upgrading docs to see if your configuration requires any manual steps for this update.$$$$$$Notes$$$Thanks to all contributors: brad0; cjsoftuk; Donien; Egor-OSSRevival; ETES-Stuttgart; freaknils; martialblog; Napsty; RincewindsHat; Tqnsls; w1ll-i-code; ymartin-ovh$$$$$$Deprecations$$$Features newly deprecated in this version:$$$$$$ElasticsearchWriter (please use the new OTLPMetricsWriter instead)$$$User declared namespace objects (i.e. namespace foo {})$$$Weve scheduled these features for removal in v2.18 (#10734).$$$$$$These features have already been deprecated and will also be removed in v2.18:$$$$$$IdoMySqlConnection$$$IdoPgsqlConnection$$$CompatLogger$$$ExternalCommandListener$$$LivestatusListener$$$Windows check-plugins (i.e. check_*) and CheckCommands (please use our PowerShell Plugins instead)$$$We will also no longer provide 32bit Windows MSIs via Chocolatey (#10757).$$$$$$Enhancements$$$OTLPMetricsWriter: A new perfdata writer for the OpenTelemetry protocol: #10685; #10789; and #10800$$$HTTP API-handlers now stream results via chunked encoding where possible: #10554; #10692; #10516; and #10414$$$Rework docker images build: #10505; #10666; and #10738$$$Better debug log messages for dependencies with non-existing parents or children: #10737$$$No longer require the unused queue parameter for v1/events: #10495$$$Allow UID/GID values in ICINGA2_USER and ICINGA2_GROUP environment variables: #10538$$$Add messages_received_per_type attribute to endpoints: #10387$$$Better error messages on Redis® connection errors: #10727$$$New node-setup command option --no-default-global-zones: #10028$$$Warn on problematic object names: #10770$$$New config option http_response_headers for ApiListener that allows to set arbitrary HTTP-headers that will be sent back with responses: #10563; #10664; and #10662$$$Bugfixes$$$Fix a race condition in the v1/console handler: #10681 and #10675$$$InfluxDBWriter: Print full HTTP error body when request fails: #10560$$$Fix a crash when querying objects that are simultaneously deleted: #10698$$$Fix a race condition leading to double notifications: #10628$$$Improve BSD support: #10641; #10640; #10638; and #10635$$$TimePeriod: Properly validate ranges field: #10633$$$Fix recovery notifications outside time period being lost: #10613$$$Prevent worst-case exponential complexity in dependency evaluation: #10523$$$Fix double-free error in posix_error::what(): #10558$$$Fix expiry times not applying correctly to Acknowledgements via ExternalCommandProcessor: #10486$$$Fix dropped or stalled connections blocking Icinga 2 shutdown on all perfdata writers: #10668 and #10799$$$Fix misleading TLS handshake error logging: #10798$$$SELinux: Allow to query attrs of a filesystem: #10726$$$ITL$$$Support for the check_smart plugin: #8041$$$A

Icinga 2 v2.16.0$$$With this release the license of the project was updated to GPLv3 or later (#10700).$$$$$$In this release weve added the OTLPMetricsWriter; a new perfdata writer targeting backends that support the OpenTelemetry protocol. We recommend users to replace other perfdata writers with this one if possible; especially ElasticsearchWriter; which is now deprecated and scheduled for removal in v2.18.$$$$$$Another big improvement is the addition of streaming support to our HTTP handlers. Most handlers now use chunked encoding to reduce the amount of the generated JSON document that has to be kept in memory at any one time. Some endpoints; notably v1/objects/query; will also start to stream the response immediately; as the results are processed. This should solve most of the memory issues users were seeing when using the Icinga 2 API on large clusters.$$$$$$Weve also redone our Docker images with this version; with some changes to how the /data directory is mounted and initialized; so make sure you read the new documentation page for installing Icinga 2 in containers.$$$$$$Below is a summary of the changes relevant for our users. For the complete list of issues and PRs; please see the milestone on GitHub.$$$$$$Please also check our upgrading docs to see if your configuration requires any manual steps for this update.$$$$$$Notes$$$Thanks to all contributors: brad0; cjsoftuk; Donien; Egor-OSSRevival; ETES-Stuttgart; freaknils; martialblog; Napsty; RincewindsHat; Tqnsls; w1ll-i-code; ymartin-ovh$$$$$$Deprecations$$$Features newly deprecated in this version:$$$$$$ElasticsearchWriter (please use the new OTLPMetricsWriter instead)$$$User declared namespace objects (i.e. namespace foo {})$$$Weve scheduled these features for removal in v2.18 (#10734).$$$$$$These features have already been deprecated and will also be removed in v2.18:$$$$$$IdoMySqlConnection$$$IdoPgsqlConnection$$$CompatLogger$$$ExternalCommandListener$$$LivestatusListener$$$Windows check-plugins (i.e. check_*) and CheckCommands (please use our PowerShell Plugins instead)$$$We will also no longer provide 32bit Windows MSIs via Chocolatey (#10757).$$$$$$Enhancements$$$OTLPMetricsWriter: A new perfdata writer for the OpenTelemetry protocol: #10685; #10789; and #10800$$$HTTP API-handlers now stream results via chunked encoding where possible: #10554; #10692; #10516; and #10414$$$Rework docker images build: #10505; #10666; and #10738$$$Better debug log messages for dependencies with non-existing parents or children: #10737$$$No longer require the unused queue parameter for v1/events: #10495$$$Allow UID/GID values in ICINGA2_USER and ICINGA2_GROUP environment variables: #10538$$$Add messages_received_per_type attribute to endpoints: #10387$$$Better error messages on Redis® connection errors: #10727$$$New node-setup command option --no-default-global-zones: #10028$$$Warn on problematic object names: #10770$$$New config option http_response_headers for ApiListener that allows to set arbitrary HTTP-headers that will be sent back with responses: #10563; #10664; and #10662$$$Bugfixes$$$Fix a race condition in the v1/console handler: #10681 and #10675$$$InfluxDBWriter: Print full HTTP error body when request fails: #10560$$$Fix a crash when querying objects that are simultaneously deleted: #10698$$$Fix a race condition leading to double notifications: #10628$$$Improve BSD support: #10641; #10640; #10638; and #10635$$$TimePeriod: Properly validate ranges field: #10633$$$Fix recovery notifications outside time period being lost: #10613$$$Prevent worst-case exponential complexity in dependency evaluation: #10523$$$Fix double-free error in posix_error::what(): #10558$$$Fix expiry times not applying correctly to Acknowledgements via ExternalCommandProcessor: #10486$$$Fix dropped or stalled connections blocking Icinga 2 shutdown on all perfdata writers: #10668 and #10799$$$Fix misleading TLS handshake error logging: #10798$$$SELinux: Allow to query attrs of a filesystem: #10726$$$ITL$$$Support for the check_smart plugin: #8041$$$A

Icinga 2 v2.15.2 $$$This security release fixes a problem in the Icinga 2 Windows MSI that did not set proper permissions for %ProgramData%\icinga2\var. Additionally; it includes two minor bug fixes regarding our SELinux policy and updates the OpenSSL version shipped on Windows.$$$$$$Security$$$CVE-2026-24413: Fix permissions of %ProgramData%\icinga2\var on Windows.$$$SELinux: Fix policy to allow logrotate to execute the icinga2 binary in order to send SIGUSR1 for log rotation. #10643$$$SELinux: Fix policy to allow icinga2 to send SIGTERM to nagios plugins processes on timeout. #10694$$$Other Changes$$$doc: Update Windows development docs to use Visual Studio 2022 instead of 2019. #10695$$$Windows: Update to OpenSSL 3.0.19. #10706

Icinga 2 v2.15.2 $$$This security release fixes a problem in the Icinga 2 Windows MSI that did not set proper permissions for %ProgramData%\icinga2\var. Additionally; it includes two minor bug fixes regarding our SELinux policy and updates the OpenSSL version shipped on Windows.$$$$$$Security$$$CVE-2026-24413: Fix permissions of %ProgramData%\icinga2\var on Windows.$$$SELinux: Fix policy to allow logrotate to execute the icinga2 binary in order to send SIGUSR1 for log rotation. #10643$$$SELinux: Fix policy to allow icinga2 to send SIGTERM to nagios plugins processes on timeout. #10694$$$Other Changes$$$doc: Update Windows development docs to use Visual Studio 2022 instead of 2019. #10695$$$Windows: Update to OpenSSL 3.0.19. #10706

2.15.1 (2025-10-16)$$$This release fixes multiple security issues. Two of them allow authenticated API users to learn restricted information or crash Icinga 2. A third issue affects the scripts provided with Icinga 2 and allows a limited privilege escalation where the Icinga 2 daemon user can trick root into sending signals to arbitrary processes.$$$$$$In addition; this version also includes bug fixes regarding config deployments and improvements to allow for better debugging of problems related to JSON-RPC cluster communication.$$$$$$Note that one fix affects the logrotate configuration. If it was modified locally; it might not be updated automatically by the package manager and applying the changes manually is necessary. For details; please check the upgrading docs.$$$$$$Security$$$CVE-2025-61907: Prevent API users from accessing variables and objects they dont have access to within filter expressions. This allowed authenticated API users to learn information they arent allowed to access directly.$$$CVE-2025-61908: Add a missing null pointer check while evaluating expressions. This allowed authenticated API users to crash the Icinga 2 daemon by supplying a crafted filter expression.$$$CVE-2025-61909: Dont send signals as root in safe-reload script and logrotate config. This allowed a limited privilege escalation from the Icinga 2 service user to root. The scope is limited to sending SIGHUP or SIGUSR1 to an arbitrary process. #10590$$$Windows: Update to OpenSSL 3.0.18. #10591$$$Bugfixes$$$When a reload triggered from Icinga Director (or the /v1/config API) fails; the corresponding state is cleared; allowing to deploy a new config without having to restart Icinga 2 manually first. #10584$$$Enhancements$$$Add JSON-RPC utilization metrics and troubleshooting docs. #10586$$$When sending cluster messages to other zones; prefer endpoints in the order as specified in the zone configuration. #10587$$$Track the number of JSON-RPC messages received for each message type per endpoint. #10585$$$Add support for building with Boost v1.89 and use it on Windows. #10578

2.15.1 (2025-10-16)$$$This release fixes multiple security issues. Two of them allow authenticated API users to learn restricted information or crash Icinga 2. A third issue affects the scripts provided with Icinga 2 and allows a limited privilege escalation where the Icinga 2 daemon user can trick root into sending signals to arbitrary processes.$$$$$$In addition; this version also includes bug fixes regarding config deployments and improvements to allow for better debugging of problems related to JSON-RPC cluster communication.$$$$$$Note that one fix affects the logrotate configuration. If it was modified locally; it might not be updated automatically by the package manager and applying the changes manually is necessary. For details; please check the upgrading docs.$$$$$$Security$$$CVE-2025-61907: Prevent API users from accessing variables and objects they dont have access to within filter expressions. This allowed authenticated API users to learn information they arent allowed to access directly.$$$CVE-2025-61908: Add a missing null pointer check while evaluating expressions. This allowed authenticated API users to crash the Icinga 2 daemon by supplying a crafted filter expression.$$$CVE-2025-61909: Dont send signals as root in safe-reload script and logrotate config. This allowed a limited privilege escalation from the Icinga 2 service user to root. The scope is limited to sending SIGHUP or SIGUSR1 to an arbitrary process. #10590$$$Windows: Update to OpenSSL 3.0.18. #10591$$$Bugfixes$$$When a reload triggered from Icinga Director (or the /v1/config API) fails; the corresponding state is cleared; allowing to deploy a new config without having to restart Icinga 2 manually first. #10584$$$Enhancements$$$Add JSON-RPC utilization metrics and troubleshooting docs. #10586$$$When sending cluster messages to other zones; prefer endpoints in the order as specified in the zone configuration. #10587$$$Track the number of JSON-RPC messages received for each message type per endpoint. #10585$$$Add support for building with Boost v1.89 and use it on Windows. #10578

2.15.1 (2025-10-16)$$$This release fixes multiple security issues. Two of them allow authenticated API users to learn restricted information or crash Icinga 2. A third issue affects the scripts provided with Icinga 2 and allows a limited privilege escalation where the Icinga 2 daemon user can trick root into sending signals to arbitrary processes.$$$$$$In addition; this version also includes bug fixes regarding config deployments and improvements to allow for better debugging of problems related to JSON-RPC cluster communication.$$$$$$Note that one fix affects the logrotate configuration. If it was modified locally; it might not be updated automatically by the package manager and applying the changes manually is necessary. For details; please check the upgrading docs.$$$$$$Security$$$CVE-2025-61907: Prevent API users from accessing variables and objects they dont have access to within filter expressions. This allowed authenticated API users to learn information they arent allowed to access directly.$$$CVE-2025-61908: Add a missing null pointer check while evaluating expressions. This allowed authenticated API users to crash the Icinga 2 daemon by supplying a crafted filter expression.$$$CVE-2025-61909: Dont send signals as root in safe-reload script and logrotate config. This allowed a limited privilege escalation from the Icinga 2 service user to root. The scope is limited to sending SIGHUP or SIGUSR1 to an arbitrary process. #10590$$$Windows: Update to OpenSSL 3.0.18. #10591$$$Bugfixes$$$When a reload triggered from Icinga Director (or the /v1/config API) fails; the corresponding state is cleared; allowing to deploy a new config without having to restart Icinga 2 manually first. #10584$$$Enhancements$$$Add JSON-RPC utilization metrics and troubleshooting docs. #10586$$$When sending cluster messages to other zones; prefer endpoints in the order as specified in the zone configuration. #10587$$$Track the number of JSON-RPC messages received for each message type per endpoint. #10585$$$Add support for building with Boost v1.89 and use it on Windows. #10578

2.15.1 (2025-10-16)$$$This release fixes multiple security issues. Two of them allow authenticated API users to learn restricted information or crash Icinga 2. A third issue affects the scripts provided with Icinga 2 and allows a limited privilege escalation where the Icinga 2 daemon user can trick root into sending signals to arbitrary processes.$$$$$$In addition; this version also includes bug fixes regarding config deployments and improvements to allow for better debugging of problems related to JSON-RPC cluster communication.$$$$$$Note that one fix affects the logrotate configuration. If it was modified locally; it might not be updated automatically by the package manager and applying the changes manually is necessary. For details; please check the upgrading docs.$$$$$$Security$$$CVE-2025-61907: Prevent API users from accessing variables and objects they dont have access to within filter expressions. This allowed authenticated API users to learn information they arent allowed to access directly.$$$CVE-2025-61908: Add a missing null pointer check while evaluating expressions. This allowed authenticated API users to crash the Icinga 2 daemon by supplying a crafted filter expression.$$$CVE-2025-61909: Dont send signals as root in safe-reload script and logrotate config. This allowed a limited privilege escalation from the Icinga 2 service user to root. The scope is limited to sending SIGHUP or SIGUSR1 to an arbitrary process. #10590$$$Windows: Update to OpenSSL 3.0.18. #10591$$$Bugfixes$$$When a reload triggered from Icinga Director (or the /v1/config API) fails; the corresponding state is cleared; allowing to deploy a new config without having to restart Icinga 2 manually first. #10584$$$Enhancements$$$Add JSON-RPC utilization metrics and troubleshooting docs. #10586$$$When sending cluster messages to other zones; prefer endpoints in the order as specified in the zone configuration. #10587$$$Track the number of JSON-RPC messages received for each message type per endpoint. #10585$$$Add support for building with Boost v1.89 and use it on Windows. #10578

Icinga 2 v2.15.0$$$$$$This Icinga 2 release is focused on adding Icinga 2 dependencies support to Icinga DB; but also includes a number of bugfixes; enhancements and code quality improvements. Below is a summary of the most important changes; for the complete list of issues and PRs; please see the milestone on GitHub.$$$$$$Notes$$$Thanks to all contributors: ChrLau; Josef-Friedrich; LordHepipud; OdyX; RincewindsHat; SebastianOpeni; SpeedD3; Tqnsls; botovq; cycloon; legioner0; legna-namor; macdems; mathiasaerts; mcodato; n-rodriguez; netphantm; nicolasberens; oldelvet; peteeckel; tbauriedel; w1ll-i-code; ymartin-ovh$$$$$$Breaking Changes$$$API: Fix /v1/objects/* queries with attrs set to [] to return empty attributes instead of all of them. #8169$$$Drop the undocumented Checkable#process_check_result and broken System#track_parents DSL functions. #10457$$$Enhancements$$$Gracefully disconnect all clients on shutdown and prevent from accepting new connections. #10460$$$Icinga DB: Send data to Redis® exactly as theyre stored in the database to avoid extra value-mapping routines by the Go daemon. #10452$$$Add support for Icinga 2 dependencies in Icinga DB. #10290$$$Take host/service reachability into account when computing its severity. #10399$$$Rework the dependency cycle detection to efficiently handle large configs and provide better error messages. #10360$$$Dont log next check timestamp in scientific notation. #10352$$$Automatically remove child downtimes when removing parent downtime. #10345$$$Ensure compatibility with Boost version up to v1.88. #10278 #10419$$$Reject infinite performance data values. #10077$$$Support host_template and service_template tags in ElasticsearchWriter. #10074$$$Icinga DB: Support Redis® username authentication. #10102$$$Cluster: Distribute host child objects (e.g. services; notifications; etc.) based on the hosts name. #10161$$$Icinga DB Check: Report an error if both Icinga DB instances are responsible in a HA setup. #10188$$$Windows: upgrade build toolchain to Visual Studio 2022. #9747$$$Bugfixes$$$Core$$$Use Checkable#check_timeout also for rescheduling remote checks. #10443$$$Log: Dont unnecessarily buffer log messages that are going to be dropped anyway. #10177$$$Dont loose perfdata counter (c) unit when normalizing performance data for Icinga DB. #10432$$$Fix broken SELinux policy on Fedora = 41 due to the new /usr/sbin to /usr/bin equivalence. #10429$$$Dont load Notification objects before User and UserGroup objects to allow them to be referenced in notifications. #10427$$$Ensure consistent DST handling across different platforms. #10422$$$Fix Icinga 2 doesnt generate a core dump when it crashes with SIGABRT. #10416$$$Dont process concurrent checks for the same checkable. #10372$$$Dont process check results after the checker and API listener have been stopped. #10397$$$Avoid zombie processes on plugin execution timeout on busy systems. #10375$$$Properly restore the notification object state on Recovery notification. #10361$$$Fix incorrectly dropped acknowledgement and recovery notifications. #10211$$$Prevent checks from always being rescheduled outside the configured check_period. #10070$$$Dont send reminder notifications after a Custom notification while interval is set to 0. #7818$$$Reset all signal handlers of child processes to their defaults before starting a plugin. #8011$$$tests: Fix FormatDateTime test cases with invalid formats on macOS and all BSD-based systems. #10149$$$Mark move constructor and assignment operator in String as noexcept to allow optimizations. #10353 #10365$$$Cluster and API$$$Fix an inverted condition in ApiListener#IsHACluster() that caused to always return true in a non-HA setup. #10417$$$Dont silently accept authenticated JSON-RPC connections with no valid endpoint. #10415$$$Sync Notification#notified_problem_users across the cluster to prevent lost recovery notifications. #10380$$$Remove superfluous ) from a HTTP request log message. #9966$$$Disable TLS renegotiation (handshake on existing conne

Icinga 2 v2.15.0$$$$$$This Icinga 2 release is focused on adding Icinga 2 dependencies support to Icinga DB; but also includes a number of bugfixes; enhancements and code quality improvements. Below is a summary of the most important changes; for the complete list of issues and PRs; please see the milestone on GitHub.$$$$$$Notes$$$Thanks to all contributors: ChrLau; Josef-Friedrich; LordHepipud; OdyX; RincewindsHat; SebastianOpeni; SpeedD3; Tqnsls; botovq; cycloon; legioner0; legna-namor; macdems; mathiasaerts; mcodato; n-rodriguez; netphantm; nicolasberens; oldelvet; peteeckel; tbauriedel; w1ll-i-code; ymartin-ovh$$$$$$Breaking Changes$$$API: Fix /v1/objects/* queries with attrs set to [] to return empty attributes instead of all of them. #8169$$$Drop the undocumented Checkable#process_check_result and broken System#track_parents DSL functions. #10457$$$Enhancements$$$Gracefully disconnect all clients on shutdown and prevent from accepting new connections. #10460$$$Icinga DB: Send data to Redis® exactly as theyre stored in the database to avoid extra value-mapping routines by the Go daemon. #10452$$$Add support for Icinga 2 dependencies in Icinga DB. #10290$$$Take host/service reachability into account when computing its severity. #10399$$$Rework the dependency cycle detection to efficiently handle large configs and provide better error messages. #10360$$$Dont log next check timestamp in scientific notation. #10352$$$Automatically remove child downtimes when removing parent downtime. #10345$$$Ensure compatibility with Boost version up to v1.88. #10278 #10419$$$Reject infinite performance data values. #10077$$$Support host_template and service_template tags in ElasticsearchWriter. #10074$$$Icinga DB: Support Redis® username authentication. #10102$$$Cluster: Distribute host child objects (e.g. services; notifications; etc.) based on the hosts name. #10161$$$Icinga DB Check: Report an error if both Icinga DB instances are responsible in a HA setup. #10188$$$Windows: upgrade build toolchain to Visual Studio 2022. #9747$$$Bugfixes$$$Core$$$Use Checkable#check_timeout also for rescheduling remote checks. #10443$$$Log: Dont unnecessarily buffer log messages that are going to be dropped anyway. #10177$$$Dont loose perfdata counter (c) unit when normalizing performance data for Icinga DB. #10432$$$Fix broken SELinux policy on Fedora = 41 due to the new /usr/sbin to /usr/bin equivalence. #10429$$$Dont load Notification objects before User and UserGroup objects to allow them to be referenced in notifications. #10427$$$Ensure consistent DST handling across different platforms. #10422$$$Fix Icinga 2 doesnt generate a core dump when it crashes with SIGABRT. #10416$$$Dont process concurrent checks for the same checkable. #10372$$$Dont process check results after the checker and API listener have been stopped. #10397$$$Avoid zombie processes on plugin execution timeout on busy systems. #10375$$$Properly restore the notification object state on Recovery notification. #10361$$$Fix incorrectly dropped acknowledgement and recovery notifications. #10211$$$Prevent checks from always being rescheduled outside the configured check_period. #10070$$$Dont send reminder notifications after a Custom notification while interval is set to 0. #7818$$$Reset all signal handlers of child processes to their defaults before starting a plugin. #8011$$$tests: Fix FormatDateTime test cases with invalid formats on macOS and all BSD-based systems. #10149$$$Mark move constructor and assignment operator in String as noexcept to allow optimizations. #10353 #10365$$$Cluster and API$$$Fix an inverted condition in ApiListener#IsHACluster() that caused to always return true in a non-HA setup. #10417$$$Dont silently accept authenticated JSON-RPC connections with no valid endpoint. #10415$$$Sync Notification#notified_problem_users across the cluster to prevent lost recovery notifications. #10380$$$Remove superfluous ) from a HTTP request log message. #9966$$$Disable TLS renegotiation (handshake on existing conne

This security release fixes a critical issue in the certificate renewal logic in Icinga 2; which might incorrectly renew an invalid certificate. However; only nodes with access to the Icinga CA private key running with OpenSSL older than version 1.1.0 (released in 2016) are vulnerable. So this typically affects Icinga 2 masters running on operating systems like RHEL 7 and Amazon Linux 2.$$$$$$For details; please check the release announcement (https://icinga.com/blog/cve-2025-48057) and the GitHub security advisory (https://github.com/Icinga/icinga2/security/advisories/GHSA-7vcf-f5v9-3wr6)$$$$$$CVE-2025-48057: Prevent invalid certificates from being renewed with OpenSSL older than v1.1.0.$$$Fix use-after-free in VerifyCertificate(): Additionally; a use-after-free was found in the same$$$function which is fixed as well; but in case it is triggered; typically only a wrong error code$$$may be shown in a log message.$$$Windows: Update OpenSSL shipped on Windows to v3.0.16.

This release fixes a regression introduced in 2.14.4 that caused the icinga2 node setup; icinga2 node wizard; and icinga2 pki request commands to fail if a certificate was requested from a node that has to forward the request to another node for signing. Additionally; it fixes a small bug in the performance data normalization and includes various documentation improvements.$$$$$$Bug Fixes$$$Dont close anonymous connections before sending the response for a certificate request #10337$$$Performance data: Dont discard min/max values even if crit/warn thresholds aren’t given #10339$$$Fix a failing test case on systems time_t is only 32 bits #10343$$$Documentation$$$Document the -X option for the mail-host-notification and mail-service-notification commands #10335$$$Include Nagios in the migration docs #10324$$$Remove RHEL 7 from installation instructions #10334$$$Add instructions for installing build dependencies on Windows Server #10336

Icinga 2 v2.14.4$$$This bugfix release is focused on improving HA cluster stability and easing$$$troubleshooting of issues in this area. It also addresses several crashes;$$$in the core itself and both in Icinga DB and IDO (numbers out of range).$$$In addition; it fixes several other issues such as lost notifications$$$or TimePeriod/ScheduledDowntime exceeding specified date ranges.$$$$$$Crash Fixes$$$Invalid DateTime#format() arguments in config and console on Windows Server 2016 and older. #10112$$$Downtime scheduling at runtime with non-existent trigger. #10049$$$Object creation at runtime during Icinga DB initialization. #10151$$$Comment on a service of a non-existent host. #9861$$$Miscellaneous Bugfixes$$$Lost notifications after recovery outside the notification time period. #10187$$$TimePeriod/ScheduledDowntime exceeding specified date range. #9983 #10107$$$Clean up failure for obsolete Downtimes. #10062$$$ifw-api check command: use correct process-finished handler. #10140$$$Email notification scripts: strip 0x0D (CR) for a proper Content-Type. #10061$$$Several fixes and improvements of the code quality. #10066 #10214 #10254 #10263 #10264$$$Cluster and API$$$Sync runtime objects in topological order to honor their dependencies. #10000$$$Make parallel config syncs more robust. #10013$$$After object creation via API fails; clean up properly for the next try. #10111$$$Close HTTPS connections properly to prevent leaks. #10005 #10006$$$Reduce the number of cluster messages in memory at the same time. #9991 #9999 #10210$$$Once a cluster connection shall be closed; stop communicating. #10213 #10221$$$Remove unnecessary blocking of semaphores. #9992 #9994$$$Reduce unnecessary cluster messages setting the next check time. #10011$$$Icinga DB and IDO$$$IDO: fix object relations after aborted synchronization. #10065$$$Icinga DB; IDO: limit all timestamps to four year digits. #10058 #10059$$$Icinga DB: limit execution_time and latency (milliseconds) to database schema. #10060$$$Troubleshooting$$$Add /v1/debug/malloc_info which calls malloc_info(3) if available. #10015$$$Add log messages about own network I/O. #9993 #10141 #10207$$$Several fixes and improvements of log messages. #9997 #10021 #10209$$$Windows$$$Update OpenSSL shipped on Windows to v3.0.15. #10170$$$Update Boost shipped on Windows to v1.86. #10114$$$Support CMake v3.29. #10037$$$Dont require to build .msi as admin. #10137$$$Build configuration scripts: allow custom $CMAKE_ARGS. #10312$$$Documentation$$$Distributed Monitoring: add section External CA/PKI. #9825$$$Explain how to enable/disable debug logging on the fly. #9981$$$Update supported OS versions and repository configuration. #10064 #10090 #10120 #10135 #10136 #10205$$$Several fixes and improvements. #9960 #10050 #10071 #10156 #10194$$$Replace broken links. #10115 #10118 #10282$$$Fix typographical and similarly trivial errors. #9953 #9967 #10056 #10116 #10152 #10153 #10204

2.14.3 (2024-11-12)¶$$$This security release fixes a TLS certificate validation bypass. Given the severity of that issue; users are advised to upgrade all nodes immediately.$$$$$$Security: fix TLS certificate validation bypass. CVE-2024-49369$$$Security: update OpenSSL shipped on Windows to v3.0.15.$$$Windows: sign MSI packages with a certificate the OS trusts by default.

Version 2.14.2 is a hotfix release for master nodes that mainly fixes excessive disk usage caused by the InfluxDB writers.$$$$$$InfluxDB: truncate timestamps to whole seconds to save disk space. #9969$$$HttpServerConnection: log request processing time as well. #9970$$$Update Boost shipped on Windows to v1.84. #9970

Icinga 2 v2.14.0 Latest$$$Issues and PRs$$$$$$Notes$$$Upgrading docs: https://icinga.com/docs/icinga2/snapshot/doc/16-upgrading-icinga-2/#upgrading-to-2-14$$$$$$Thanks to all contributors: atj; atwebm; cspeterson; cycloon; DamianoChini; efuss; fabieins; haxtibal; jaapmarcus; log1-c; lrupp; maggu; mcodato; Napsty; orbison; peteeckel; slalomsk8er; stevie-sy; Tqnsls$$$$$$Breaking Changes$$$Remove CheckResultReader (which has been deprecated since v2.9). #9714$$$Remove StatusDataWriter (which has been deprecated since v2.9). #9715$$$ElasticsearchWriter: drop support for Elasticsearch < v7. #9812$$$Consider a checkable unreachable once one Dependency fails.$$$Previously all of them had to fail. (Consult the upgrading docs.) #8218$$$API: reject config modifications during reload with HTTP status 503. #9445$$$icinga2 daemon: to reduce config load time; write file needed by$$$icinga2 object list only if --dump-objects is given. #9586 #9591$$$Default email notification scripts: link to Icinga DB Web;$$$not the monitoring module. (Consult the upgrading docs.) #9742 #9757$$$API: for security reasons hide TicketSalt in /v1/variables. #7863$$$Icinga 2 Config DSL$$$Disallow global variable modification after config commit start (i.e.$$$inside object/apply T x { ... }) to reduce config load time. #9740$$$Forbid Dependency cycles at config load time. #8389$$$Allow only strings in the arrays Host#groups; Service#groups and$$$User#groups. Needed for consistency; especially by the IDO. #9057$$$Disallow empty object names. (They worked only partially anyway.) #9409$$$Windows Agent only$$$The official MSIs dont include the following features anymore.$$$They werent intended; tested or needed on Windows and only waste build time;$$$bandwidth and disk space. Both new installations and upgrades are affected.$$$$$$ElasticsearchWriter #9704$$$GelfWriter #9704$$$GraphiteWriter #9704$$$InfluxdbWriter and Influxdb2Writer #9704$$$OpenTsdbWriter #9704$$$PerfdataWriter #9704$$$We also dont ship the following files anymore.$$$(You can still obtain them manually.)$$$$$$NSCP.msi (NSClient++ installer) #9703$$$doc/ (Icinga 2 markdown documentation) #9705$$$On the other hand MSIs are now 75% smaller than before.$$$$$$Enhancements$$$Significantly reduce config load time of large setups.$$$#8118 #9555 #9557 #9572 #9577 #9603 #9608 #9627 #9648 #9657 #9662$$$Allow to connect dependencies via redundancy groups. Only parents within$$$one group are assumed to provide redundancy for each other. #8218$$$Built-in check command ifw-api; communicates directly with the Icinga for$$$Windows REST API. (Doesnt spawn a PowerShell process for that.) #9062$$$JournaldLogger which logs to systemd journal. #9000$$$API: POST /v1/objects: allow to discard some previously modified attributes;$$$i.e. to restore the config files values. #9783$$$ElasticsearchWriter: support Elasticsearch v8. #9812$$$Support $env.ENV_VAR_NAME$ macros. #8302$$$Speed up Icinga DB config dump. #9524$$$Default mail notification scripts: also print $host.notes$ and $service.notes$. #9713$$$Enable built-in OpenSSL DH parameters to allow DHE TLS ciphers. #9811$$$Clean up global default TLS cipher list to improve security. #9809$$$Influxdb(2)Writer: write more precise timestamps (nanoseconds). #9599$$$Bugfixes$$$Icinga DB feature: normalize several Redis data not to crash the Go daemon.$$$#9772 #9775 #9792 #9793 #9794 #9805$$$Fix parsing of perfdata across multiple lines in plugin output. #8969$$$icinga check: fix last reload failure time. #8429 #9827$$$Resolve macros inside custom vars of IcingaApplication. #9779$$$SELinux: allow Icinga and its plugins to write to syslog. #9688$$$ElasticsearchWriter: fix data buffer flush race condition during stop. #9810$$$Trigger flexible downtimes not in the past if checkable is already down. #9726$$$Send downtime expiration notifications immediately; not after up to a minute. #9726$$$Cluster$$$Dont hang in timed out connection attempt. #9711 #9725$$$Fix lost acknowledgements after re-connect. #9718$$$cluster-zone check: dont complain about

Icinga 2 v2.13.7 Latest$$$This security release updates Boost and OpenSSL libraries bundled on Windows$$$and repairs broken SELinux policies. By the way it fixes several other bugs.$$$$$$Security$$$Windows: update bundled OpenSSL to v1.1.1t. #9672$$$Bugfixes$$$SELinux: fix user and domain creation by explicitly setting the role. #9690$$$Signal handlers: dont interrupt and break plugins spawning. #9682$$$Icinga DB: take check_period into account during overdue calculation. #9679$$$Avoid corrupted files: use fsync(2)/FlushFileBuffers() everywhere. #9681$$$Solaris: fix compile error. #9680$$$Enhancements$$$Windows: update bundled Boost to v1.81. #9678$$$Documentation: several fixes and improvements. #9671

The main focus of version 2.13.6 is improved performance of Icinga DB and apply rules.$$$Additionally; it includes bug fixes related to config loading and API permissions.$$$$$$Bugfixes$$$Improve the throughput of the Icinga DB feature. #9550$$$Multiple changes to speed up evaluation of apply rules. #9559 #9565 #9558$$$Fix a possible crash on config loading related to ignore_on_error. #9560$$$Check API user permission on objects returned by joins. #9561$$$Windows: update bundled Boost and OpenSSL versions. #9562 #9567

Version 2.13.5 is a maintenance release that fixes some bugs; improves logging and updates the documentation as well as a bundled library.$$$$$$Bugfixes$$$Ensure not to write an incomplete (i.e. corrupt) state file. #9467$$$ITL: Render vars.apt_upgrade=true as –upgrade; not –upgrade=true. #9458$$$Icinga DB: Don’t surprise (and crash) the Go daemon with config types it doesn’t know. #9480$$$Icinga DB: Add missing Redis SELinux policy. #9473$$$Windows: Don’t spam the event log with non-error startup messages. #9457$$$Windows: Update bundled version of OpenSSL. #9460$$$Docs: Update RHEL 8 installation instructions. #9482$$$Docs: Add RHEL 9 installation instructions. #9482

Version 2.13.5 is a maintenance release that fixes some bugs; improves logging and updates the documentation as well as a bundled library.$$$$$$Bugfixes$$$Ensure not to write an incomplete (i.e. corrupt) state file. #9467$$$ITL: Render vars.apt_upgrade=true as –upgrade; not –upgrade=true. #9458$$$Icinga DB: Don’t surprise (and crash) the Go daemon with config types it doesn’t know. #9480$$$Icinga DB: Add missing Redis SELinux policy. #9473$$$Windows: Don’t spam the event log with non-error startup messages. #9457$$$Windows: Update bundled version of OpenSSL. #9460$$$Docs: Update RHEL 8 installation instructions. #9482$$$Docs: Add RHEL 9 installation instructions. #9482

Version 2.13.5 is a maintenance release that fixes some bugs; improves logging and updates the documentation as well as a bundled library.$$$$$$Bugfixes$$$Ensure not to write an incomplete (i.e. corrupt) state file. #9467$$$ITL: Render vars.apt_upgrade=true as –upgrade; not –upgrade=true. #9458$$$Icinga DB: Don’t surprise (and crash) the Go daemon with config types it doesn’t know. #9480$$$Icinga DB: Add missing Redis SELinux policy. #9473$$$Windows: Don’t spam the event log with non-error startup messages. #9457$$$Windows: Update bundled version of OpenSSL. #9460$$$Docs: Update RHEL 8 installation instructions. #9482$$$Docs: Add RHEL 9 installation instructions. #9482

Version 2.13.5 is a maintenance release that fixes some bugs; improves logging and updates the documentation as well as a bundled library.$$$$$$Bugfixes$$$Ensure not to write an incomplete (i.e. corrupt) state file. #9467$$$ITL: Render vars.apt_upgrade=true as –upgrade; not –upgrade=true. #9458$$$Icinga DB: Don’t surprise (and crash) the Go daemon with config types it doesn’t know. #9480$$$Icinga DB: Add missing Redis SELinux policy. #9473$$$Windows: Don’t spam the event log with non-error startup messages. #9457$$$Windows: Update bundled version of OpenSSL. #9460$$$Docs: Update RHEL 8 installation instructions. #9482$$$Docs: Add RHEL 9 installation instructions. #9482

Version 2.13.5 is a maintenance release that fixes some bugs; improves logging and updates the documentation as well as a bundled library.$$$$$$Bugfixes$$$Ensure not to write an incomplete (i.e. corrupt) state file. #9467$$$ITL: Render vars.apt_upgrade=true as –upgrade; not –upgrade=true. #9458$$$Icinga DB: Don’t surprise (and crash) the Go daemon with config types it doesn’t know. #9480$$$Icinga DB: Add missing Redis SELinux policy. #9473$$$Windows: Don’t spam the event log with non-error startup messages. #9457$$$Windows: Update bundled version of OpenSSL. #9460$$$Docs: Update RHEL 8 installation instructions. #9482$$$Docs: Add RHEL 9 installation instructions. #9482