Failed to start icingadb-redis.service after update

Icinga 2 Icinga DB
1

Hello everyone!

Icinga2 deployed in the LXC-container, based on Debian Bookworm.

After a full upgrade system and all packages (apt update && apt upgrade -y && apt-autoremove -y), I encountered a problem starting the service:

× icingadb-redis.service - Redis database for Icinga DB
     Loaded: loaded (/etc/systemd/system/icingadb-redis.service; enabled; preset: enabled)
    Drop-In: /run/systemd/system/service.d
             └─zzz-lxc-service.conf
     Active: failed (Result: exit-code) since Thu 2024-07-11 15:39:14 +03; 8min ago
   Main PID: 20832 (code=exited, status=217/USER)
        CPU: 12ms

Jul 11 15:39:14 icinga-master-01 systemd[1]: Starting icingadb-redis.service - Redis database for Icinga DB...
Jul 11 15:39:14 icinga-master-01 (s-server)[20832]: icingadb-redis.service: Failed to set up user namespacing: Read-only file system
Jul 11 15:39:14 icinga-master-01 (s-server)[20832]: icingadb-redis.service: Failed at step USER spawning /usr/bin/icingadb-redis-server: Read-only file system
Jul 11 15:39:14 icinga-master-01 systemd[1]: icingadb-redis.service: Main process exited, code=exited, status=217/USER
Jul 11 15:39:14 icinga-master-01 systemd[1]: icingadb-redis.service: Failed with result 'exit-code'.
Jul 11 15:39:14 icinga-master-01 systemd[1]: Failed to start icingadb-redis.service - Redis database for Icinga DB.

I tried to forcefully remove the packages mentioned in the blog, but that didn’t solve the problem.

If run ExecStart from service manually:

/usr/bin/icingadb-redis-server /usr/share/icingadb-redis/icingadb-redis-systemd.conf

then Redis accepts connections and the notification disappears in IcingaWeb2.

IcingaDB packages versions:

icingadb-redis/icinga-bookworm,now 7.0.15-1+debian12 amd64 [installed]
icingadb-web/icinga-bookworm,now 1.1.2-1+debian12 all [installed]
icingadb/icinga-bookworm,now 1.2.0-1+debian12 amd64 [installed]

I tried:

  • systemctl daemon-reload
  • reinstall all icingadb* packages
  • check permissions for /etc/icingadb*
  • compared systemd configs with fresh installed container

Never found any problems…

2

Hi, we have hardened the Icinga DB Redis systemd unit file, such as enabling the PrivateTmp option and much more, which forces systemd to set up a new filesystem for that service and mount the required directories from your host system. However, having never used an lxc container, I can’t tell you what option you need to set to make it work.

Nevertheless, if I understood you correctly, Icinga DB Redis was working before the upgrade? In that case, you can comment out the ReadOnlyPaths=/ option in the service file and see if it works, because that’s the only new option added in the new version.