Check_apt on Ubuntu 16.04.6 LTS

Icinga 2
1

Hi,
I installed Icinga (version: r2.11.3-1)
on Ubuntu 16.04.6 LTS. Unfortunately I can’t use a newer version of Ubuntu.
I have a problem with the check check_apt.
The version of check_apt installed is this one:

check_apt v2.1.2 (monitoring-plugins 2.1.2)
Copyright (c) 2006-2008 Monitoring Plugins Development Team
        <devel@monitoring-plugins.org>

This plugin checks for software updates on systems that use
package management systems based on the apt-get(8) command
found in Debian GNU/Linux


Usage:
check_apt [[-d|-u|-U]opts] [-n] [-t timeout]

Options:
 -h, --help
    Print detailed help screen
 -V, --version
    Print version information
 --extra-opts=[section][@file]
    Read options from an ini file. See
    https://www.monitoring-plugins.org/doc/extra-opts.html
    for usage and examples.
 -t, --timeout=INTEGER
    Seconds before plugin times out (default: 10)
 -U, --upgrade=OPTS
    [Default] Perform an upgrade.  If an optional OPTS argument is provided,
    apt-get will be run with these command line options instead of the
    default (-o 'Debug::NoLocking=true' -s -qq).
    Note that you may be required to have root privileges if you do not use
    the default options.
 -d, --dist-upgrade=OPTS
    Perform a dist-upgrade instead of normal upgrade. Like with -U OPTS
    can be provided to override the default options.
  -n, --no-upgrade
    Do not run the upgrade.  Probably not useful (without -u at least).
 -i, --include=REGEXP
    Include only packages matching REGEXP.  Can be specified multiple times
    the values will be combined together.  Any packages matching this list
    cause the plugin to return WARNING status.  Others will be ignored.
    Default is to include all packages.
 -e, --exclude=REGEXP
    Exclude packages matching REGEXP from the list of packages that would
    otherwise be included.  Can be specified multiple times; the values
    will be combined together.  Default is to exclude no packages.
 -c, --critical=REGEXP
    If the full package information of any of the upgradable packages match
    this REGEXP, the plugin will return CRITICAL status.  Can be specified
    multiple times like above.  Default is a regexp matching security
    upgrades for Debian and Ubuntu:
        ^[^\(]*\(.* (Debian-Security:|Ubuntu:[^/]*/[^-]*-security)
    Note that the package must first match the include list before its
    information is compared against the critical list.

The following options require root privileges and should be used with care:

 -u, --update=OPTS
    First perform an 'apt-get update'.  An optional OPTS parameter overrides
    the default options.  Note: you may also need to adjust the global
    timeout (with -t) to prevent the plugin from timing out if apt-get
    upgrade is expected to take longer than the default timeout.

Send email to help@monitoring-plugins.org if you have questions regarding
use of this software. To submit patches or suggest improvements, send email
to devel@monitoring-plugins.org

Unfortunately, in this version (v2.1.2) the –only-critical option is not available.

 -o, --only-critical
    Only warn about upgrades matching the critical list.  The total number
    of upgrades will be printed, but any non-critical upgrades will not cause
    the plugin to return WARNING status.

I need the result of this missing option.
I mean, in case of non-critical updates, I’d like the status to be like this:

APT OK: 6 packages available for upgrade (0 critical updates).

Instead, when there are critical updates I would like a status like this:

APT CRITICAL: 6 packages available for upgrade (3 critical updates).

Can you please give me some advice?

Thanks!

2

Hi.

Some time ago, I had this problem, too.

You can add the following to the service:

  vars.apt_include = "[^/]*/[^-]*-critical_updates"
  vars.apt_critical = "[^/]*/[^-]*-nocritsplease"

Edit: I forgot to note, that these two lines only check for critical updates.
If you only use the second line

vars.apt_critical = "[^/]*/[^-]*-nocritsplease"

you will get a warning about any available update but only a crit-returncode for critical updates.
So that is not exactly what you asked for.

Hope this helps.

Greetings.

3

Hi, thank you for your answer.
I followed your suggestion and set the command like this:

zones.d/director-global/commands.conf

object CheckCommand "Check APT" {
    import "plugin-check-command"
    import "apt"

    arguments += {
        "--critical" = {
            description = "If the full package information of any of the upgradable packages match this REGEXP, the plugin will return CRITICAL status. Can be specified multiple times."
            value = "$apt_critical$"
        }
        "--include" = {
            description = "Include only packages matching REGEXP. Can be specified multiple times the values will be combined together."
            value = "$apt_include$"
        }
    }
    vars.apt_critical = "[^/]*/[^-]*-nocritsplease"
    vars.apt_include = "[^/]*/[^-]*-critical_updates"
}

Can you please tell me if I followed your suggestion correctly?
Because even if there are critical updates, I get this:

APT OK: 0 packages available for upgrade (0 critical updates).

thanks for your help

4

Hi. Sorry for the late answer.

You are right, this doesn’t work.

I will try to figure out why at next week.

Big sorry for the wrong answer!

Greetings.

5

Hi again.

I tested the following on an unpatched Ubuntu 16 machine and it worked.

You do not have to extend the existing apt-CheckCommand, --include is already part of it:
Here is a shortened version of the definition :

Part of the apt CheckCommand definition 
object CheckCommand "apt" {
		command = [ PluginDir + "/check_apt" ]
		...
                }
                "--include" = {
                        value = "$apt_include$"
                        description = "Include only ...."

		...
}

You can add the following to the corresponding service:

vars.apt_include = "^[^\\(]*\\(.* (Debian-Security:|Ubuntu:[^/]*/[^-]*-security)"

Effect: It only checks for critical updates and doesn’t check or report for other updates.

Sorry again for the previous answer.

Hope this helps.

1 Like
6

Hi, thanks for your help.
Your advice is working great :slight_smile: