Icinga 2 v2.15.0$$$$$$This Icinga 2 release is focused on adding Icinga 2 dependencies support to Icinga DB; but also includes a number of bugfixes; enhancements and code quality improvements. Below is a summary of the most important changes; for the complete list of issues and PRs; please see the milestone on GitHub.$$$$$$Notes$$$Thanks to all contributors: ChrLau; Josef-Friedrich; LordHepipud; OdyX; RincewindsHat; SebastianOpeni; SpeedD3; Tqnsls; botovq; cycloon; legioner0; legna-namor; macdems; mathiasaerts; mcodato; n-rodriguez; netphantm; nicolasberens; oldelvet; peteeckel; tbauriedel; w1ll-i-code; ymartin-ovh$$$$$$Breaking Changes$$$API: Fix /v1/objects/* queries with attrs set to [] to return empty attributes instead of all of them. #8169$$$Drop the undocumented Checkable#process_check_result and broken System#track_parents DSL functions. #10457$$$Enhancements$$$Gracefully disconnect all clients on shutdown and prevent from accepting new connections. #10460$$$Icinga DB: Send data to Redis® exactly as theyre stored in the database to avoid extra value-mapping routines by the Go daemon. #10452$$$Add support for Icinga 2 dependencies in Icinga DB. #10290$$$Take host/service reachability into account when computing its severity. #10399$$$Rework the dependency cycle detection to efficiently handle large configs and provide better error messages. #10360$$$Dont log next check timestamp in scientific notation. #10352$$$Automatically remove child downtimes when removing parent downtime. #10345$$$Ensure compatibility with Boost version up to v1.88. #10278 #10419$$$Reject infinite performance data values. #10077$$$Support host_template and service_template tags in ElasticsearchWriter. #10074$$$Icinga DB: Support Redis® username authentication. #10102$$$Cluster: Distribute host child objects (e.g. services; notifications; etc.) based on the hosts name. #10161$$$Icinga DB Check: Report an error if both Icinga DB instances are responsible in a HA setup. #10188$$$Windows: upgrade build toolchain to Visual Studio 2022. #9747$$$Bugfixes$$$Core$$$Use Checkable#check_timeout also for rescheduling remote checks. #10443$$$Log: Dont unnecessarily buffer log messages that are going to be dropped anyway. #10177$$$Dont loose perfdata counter (c) unit when normalizing performance data for Icinga DB. #10432$$$Fix broken SELinux policy on Fedora = 41 due to the new /usr/sbin to /usr/bin equivalence. #10429$$$Dont load Notification objects before User and UserGroup objects to allow them to be referenced in notifications. #10427$$$Ensure consistent DST handling across different platforms. #10422$$$Fix Icinga 2 doesnt generate a core dump when it crashes with SIGABRT. #10416$$$Dont process concurrent checks for the same checkable. #10372$$$Dont process check results after the checker and API listener have been stopped. #10397$$$Avoid zombie processes on plugin execution timeout on busy systems. #10375$$$Properly restore the notification object state on Recovery notification. #10361$$$Fix incorrectly dropped acknowledgement and recovery notifications. #10211$$$Prevent checks from always being rescheduled outside the configured check_period. #10070$$$Dont send reminder notifications after a Custom notification while interval is set to 0. #7818$$$Reset all signal handlers of child processes to their defaults before starting a plugin. #8011$$$tests: Fix FormatDateTime test cases with invalid formats on macOS and all BSD-based systems. #10149$$$Mark move constructor and assignment operator in String as noexcept to allow optimizations. #10353 #10365$$$Cluster and API$$$Fix an inverted condition in ApiListener#IsHACluster() that caused to always return true in a non-HA setup. #10417$$$Dont silently accept authenticated JSON-RPC connections with no valid endpoint. #10415$$$Sync Notification#notified_problem_users across the cluster to prevent lost recovery notifications. #10380$$$Remove superfluous ) from a HTTP request log message. #9966$$$Disable TLS renegotiation (handshake on existing conne

This release fixes a regression introduced in 2.14.4 that caused the icinga2 node setup; icinga2 node wizard; and icinga2 pki request commands to fail if a certificate was requested from a node that has to forward the request to another node for signing. Additionally; it fixes a small bug in the performance data normalization and includes various documentation improvements.$$$$$$Bug Fixes$$$Dont close anonymous connections before sending the response for a certificate request #10337$$$Performance data: Dont discard min/max values even if crit/warn thresholds aren’t given #10339$$$Fix a failing test case on systems time_t is only 32 bits #10343$$$Documentation$$$Document the -X option for the mail-host-notification and mail-service-notification commands #10335$$$Include Nagios in the migration docs #10324$$$Remove RHEL 7 from installation instructions #10334$$$Add instructions for installing build dependencies on Windows Server #10336

Icinga 2 v2.14.4$$$This bugfix release is focused on improving HA cluster stability and easing$$$troubleshooting of issues in this area. It also addresses several crashes;$$$in the core itself and both in Icinga DB and IDO (numbers out of range).$$$In addition; it fixes several other issues such as lost notifications$$$or TimePeriod/ScheduledDowntime exceeding specified date ranges.$$$$$$Crash Fixes$$$Invalid DateTime#format() arguments in config and console on Windows Server 2016 and older. #10112$$$Downtime scheduling at runtime with non-existent trigger. #10049$$$Object creation at runtime during Icinga DB initialization. #10151$$$Comment on a service of a non-existent host. #9861$$$Miscellaneous Bugfixes$$$Lost notifications after recovery outside the notification time period. #10187$$$TimePeriod/ScheduledDowntime exceeding specified date range. #9983 #10107$$$Clean up failure for obsolete Downtimes. #10062$$$ifw-api check command: use correct process-finished handler. #10140$$$Email notification scripts: strip 0x0D (CR) for a proper Content-Type. #10061$$$Several fixes and improvements of the code quality. #10066 #10214 #10254 #10263 #10264$$$Cluster and API$$$Sync runtime objects in topological order to honor their dependencies. #10000$$$Make parallel config syncs more robust. #10013$$$After object creation via API fails; clean up properly for the next try. #10111$$$Close HTTPS connections properly to prevent leaks. #10005 #10006$$$Reduce the number of cluster messages in memory at the same time. #9991 #9999 #10210$$$Once a cluster connection shall be closed; stop communicating. #10213 #10221$$$Remove unnecessary blocking of semaphores. #9992 #9994$$$Reduce unnecessary cluster messages setting the next check time. #10011$$$Icinga DB and IDO$$$IDO: fix object relations after aborted synchronization. #10065$$$Icinga DB; IDO: limit all timestamps to four year digits. #10058 #10059$$$Icinga DB: limit execution_time and latency (milliseconds) to database schema. #10060$$$Troubleshooting$$$Add /v1/debug/malloc_info which calls malloc_info(3) if available. #10015$$$Add log messages about own network I/O. #9993 #10141 #10207$$$Several fixes and improvements of log messages. #9997 #10021 #10209$$$Windows$$$Update OpenSSL shipped on Windows to v3.0.15. #10170$$$Update Boost shipped on Windows to v1.86. #10114$$$Support CMake v3.29. #10037$$$Dont require to build .msi as admin. #10137$$$Build configuration scripts: allow custom $CMAKE_ARGS. #10312$$$Documentation$$$Distributed Monitoring: add section External CA/PKI. #9825$$$Explain how to enable/disable debug logging on the fly. #9981$$$Update supported OS versions and repository configuration. #10064 #10090 #10120 #10135 #10136 #10205$$$Several fixes and improvements. #9960 #10050 #10071 #10156 #10194$$$Replace broken links. #10115 #10118 #10282$$$Fix typographical and similarly trivial errors. #9953 #9967 #10056 #10116 #10152 #10153 #10204

2.14.3 (2024-11-12)¶$$$This security release fixes a TLS certificate validation bypass. Given the severity of that issue; users are advised to upgrade all nodes immediately.$$$$$$Security: fix TLS certificate validation bypass. CVE-2024-49369$$$Security: update OpenSSL shipped on Windows to v3.0.15.$$$Windows: sign MSI packages with a certificate the OS trusts by default.

Version 2.14.2 is a hotfix release for master nodes that mainly fixes excessive disk usage caused by the InfluxDB writers.$$$$$$InfluxDB: truncate timestamps to whole seconds to save disk space. #9969$$$HttpServerConnection: log request processing time as well. #9970$$$Update Boost shipped on Windows to v1.84. #9970

Icinga 2 v2.14.0 Latest$$$Issues and PRs$$$$$$Notes$$$Upgrading docs: https://icinga.com/docs/icinga2/snapshot/doc/16-upgrading-icinga-2/#upgrading-to-2-14$$$$$$Thanks to all contributors: atj; atwebm; cspeterson; cycloon; DamianoChini; efuss; fabieins; haxtibal; jaapmarcus; log1-c; lrupp; maggu; mcodato; Napsty; orbison; peteeckel; slalomsk8er; stevie-sy; Tqnsls$$$$$$Breaking Changes$$$Remove CheckResultReader (which has been deprecated since v2.9). #9714$$$Remove StatusDataWriter (which has been deprecated since v2.9). #9715$$$ElasticsearchWriter: drop support for Elasticsearch < v7. #9812$$$Consider a checkable unreachable once one Dependency fails.$$$Previously all of them had to fail. (Consult the upgrading docs.) #8218$$$API: reject config modifications during reload with HTTP status 503. #9445$$$icinga2 daemon: to reduce config load time; write file needed by$$$icinga2 object list only if --dump-objects is given. #9586 #9591$$$Default email notification scripts: link to Icinga DB Web;$$$not the monitoring module. (Consult the upgrading docs.) #9742 #9757$$$API: for security reasons hide TicketSalt in /v1/variables. #7863$$$Icinga 2 Config DSL$$$Disallow global variable modification after config commit start (i.e.$$$inside object/apply T x { ... }) to reduce config load time. #9740$$$Forbid Dependency cycles at config load time. #8389$$$Allow only strings in the arrays Host#groups; Service#groups and$$$User#groups. Needed for consistency; especially by the IDO. #9057$$$Disallow empty object names. (They worked only partially anyway.) #9409$$$Windows Agent only$$$The official MSIs dont include the following features anymore.$$$They werent intended; tested or needed on Windows and only waste build time;$$$bandwidth and disk space. Both new installations and upgrades are affected.$$$$$$ElasticsearchWriter #9704$$$GelfWriter #9704$$$GraphiteWriter #9704$$$InfluxdbWriter and Influxdb2Writer #9704$$$OpenTsdbWriter #9704$$$PerfdataWriter #9704$$$We also dont ship the following files anymore.$$$(You can still obtain them manually.)$$$$$$NSCP.msi (NSClient++ installer) #9703$$$doc/ (Icinga 2 markdown documentation) #9705$$$On the other hand MSIs are now 75% smaller than before.$$$$$$Enhancements$$$Significantly reduce config load time of large setups.$$$#8118 #9555 #9557 #9572 #9577 #9603 #9608 #9627 #9648 #9657 #9662$$$Allow to connect dependencies via redundancy groups. Only parents within$$$one group are assumed to provide redundancy for each other. #8218$$$Built-in check command ifw-api; communicates directly with the Icinga for$$$Windows REST API. (Doesnt spawn a PowerShell process for that.) #9062$$$JournaldLogger which logs to systemd journal. #9000$$$API: POST /v1/objects: allow to discard some previously modified attributes;$$$i.e. to restore the config files values. #9783$$$ElasticsearchWriter: support Elasticsearch v8. #9812$$$Support $env.ENV_VAR_NAME$ macros. #8302$$$Speed up Icinga DB config dump. #9524$$$Default mail notification scripts: also print $host.notes$ and $service.notes$. #9713$$$Enable built-in OpenSSL DH parameters to allow DHE TLS ciphers. #9811$$$Clean up global default TLS cipher list to improve security. #9809$$$Influxdb(2)Writer: write more precise timestamps (nanoseconds). #9599$$$Bugfixes$$$Icinga DB feature: normalize several Redis data not to crash the Go daemon.$$$#9772 #9775 #9792 #9793 #9794 #9805$$$Fix parsing of perfdata across multiple lines in plugin output. #8969$$$icinga check: fix last reload failure time. #8429 #9827$$$Resolve macros inside custom vars of IcingaApplication. #9779$$$SELinux: allow Icinga and its plugins to write to syslog. #9688$$$ElasticsearchWriter: fix data buffer flush race condition during stop. #9810$$$Trigger flexible downtimes not in the past if checkable is already down. #9726$$$Send downtime expiration notifications immediately; not after up to a minute. #9726$$$Cluster$$$Dont hang in timed out connection attempt. #9711 #9725$$$Fix lost acknowledgements after re-connect. #9718$$$cluster-zone check: dont complain about

Icinga 2 v2.13.7 Latest$$$This security release updates Boost and OpenSSL libraries bundled on Windows$$$and repairs broken SELinux policies. By the way it fixes several other bugs.$$$$$$Security$$$Windows: update bundled OpenSSL to v1.1.1t. #9672$$$Bugfixes$$$SELinux: fix user and domain creation by explicitly setting the role. #9690$$$Signal handlers: dont interrupt and break plugins spawning. #9682$$$Icinga DB: take check_period into account during overdue calculation. #9679$$$Avoid corrupted files: use fsync(2)/FlushFileBuffers() everywhere. #9681$$$Solaris: fix compile error. #9680$$$Enhancements$$$Windows: update bundled Boost to v1.81. #9678$$$Documentation: several fixes and improvements. #9671

The main focus of version 2.13.6 is improved performance of Icinga DB and apply rules.$$$Additionally; it includes bug fixes related to config loading and API permissions.$$$$$$Bugfixes$$$Improve the throughput of the Icinga DB feature. #9550$$$Multiple changes to speed up evaluation of apply rules. #9559 #9565 #9558$$$Fix a possible crash on config loading related to ignore_on_error. #9560$$$Check API user permission on objects returned by joins. #9561$$$Windows: update bundled Boost and OpenSSL versions. #9562 #9567

Version 2.13.5 is a maintenance release that fixes some bugs; improves logging and updates the documentation as well as a bundled library.$$$$$$Bugfixes$$$Ensure not to write an incomplete (i.e. corrupt) state file. #9467$$$ITL: Render vars.apt_upgrade=true as –upgrade; not –upgrade=true. #9458$$$Icinga DB: Don’t surprise (and crash) the Go daemon with config types it doesn’t know. #9480$$$Icinga DB: Add missing Redis SELinux policy. #9473$$$Windows: Don’t spam the event log with non-error startup messages. #9457$$$Windows: Update bundled version of OpenSSL. #9460$$$Docs: Update RHEL 8 installation instructions. #9482$$$Docs: Add RHEL 9 installation instructions. #9482