API query on the config master

Icinga 2
1

Hello,

I see this query in the icinga2.log every minute. Does anyone know why it is being run?

This is on Icinga2 master running v2.15.1-1

Thanks

[2025-10-21 13:51:00 -0700] information/HttpServerConnection: Request GET /v1/objects/services?attrs=name&attrs=display_name&attrs=state&attrs=check_command&attrs=host_name (from [::ffff:127.0.0.1]:50796, user: <unauthenticated>, agent: Go-http-client/1.1, status: Unauthorized) took total 0ms.
[2025-10-21 13:52:00 -0700] information/HttpServerConnection: Request GET /v1/objects/services?attrs=name&attrs=display_name&attrs=state&attrs=check_command&attrs=host_name (from [::ffff:127.0.0.1]:55310, user: <unauthenticated>, agent: Go-http-client/1.1, status: Unauthorized) took total 0ms.
[2025-10-21 13:53:00 -0700] information/HttpServerConnection: Request GET /v1/objects/services?attrs=name&attrs=display_name&attrs=state&attrs=check_command&attrs=host_name (from [::ffff:127.0.0.1]:35812, user: <unauthenticated>, agent: Go-http-client/1.1, status: Unauthorized) took total 0ms.
2

Thanks for posting, I would break down the lines as follows.

  • Each timestamp starts exactly at the beginning of a minute. Combined with the fact that the logged IP address is the localhost, please check your cron jobs and systemd timers.

  • from [::ffff:127.0.0.1]:35812 means, repeating myself, that the requests are sent from the localhost. Unless you tunnel traffic to this machine, e.g., via SSH, this indicates that the software runs on the same machine as Icinga 2.

  • user: <unauthenticated>, […] status: Unauthorized says that the authentication to the Icinga 2 API failed. The request received a HTTP 401.

  • agent: Go-http-client/1.1 is the generic Go HTTP user agent unless it is overwritten.
    There are a few Icinga components written in Go I could think of:

    • Icinga DB, but it does not query the Icinga 2 API. So no.
    • Icinga Notifications queries the API, but with its own user agent. Also no.
    • Icinga Kubernetes, but afaik it does not care about Icinga 2 objects. Not sure, but I would guess no.

    As none of these matches, I would guess that this might be some own development of yours?

Please check what your system executes every minute.

3

Thanks for your reply.

This is a new installation. I couldn’t find anything on the host which execute that query. Icingaweb2 runs on the host as well.