Host is set to "Accepts Config: No" in Director, but i'm still able to add/change services and settings

Hi!
For one network in our environment we wish to have a read-only type of monitoring. To make this work we wanted to first configure the agent on a windows server through director (setting up services etc.) and then forbidding the agent from accepting any more changes to what is executed on the system.
I have found the “Accepts Config” option. When i set it through director i’m still able to change and add services as well as change that setting and others. Same applies when i set it to false in the api.conf on the actual server.

Am i misunderstanding this setting or is there something else i need to do first?

  • Version used: r2.14.0-1
  • Operating System and version: Debian 12
  • Enabled features: api checker icingadb mainlog notification
  • Icinga Web 2 version and modules 2.12.0

You need to configure accept_config = false at your agents in the api.conf file.

Under icinga2\etc\icinga2\features-available ?

This is my api.conf

object ApiListener “api” {
accept_commands = true
accept_config = false
bind_host = “::”;
bind_port = 5665;
}

I’ve restarted the icinga sevice and the machine, doesn’t change anything.

yes

Yes, the agent will no longer accept any changes he gets from its parent.

Do you see the changes only in the director or are they really transported to the agent in question?

I don’t think the director is clever enough to reflect, that the agent is now read only.

I’m not sure if i’m maybe misunderstanding what the flag does.
I’m still able to add check commands / Services to the host after i’ve chagned it. But maybe that’s not part of it?

these options are only written during rollout using icinga powershell framework.

but as @rsx said, if you change it on the AGENT and restart after, this should work.

of course your icinga master still things there are new services for the windows machine, they should not be executed.

does anything of this match your case?