Icinga director deployment fails

Version of Icinga and modules:


AlmaLinux release 8.10 (Cerulean Leopard)

Icinga2 director fails to deploy, after upgrade:

Packages Altered:
Upgrade icinga-l10n-1.2.0-1.icinga.noarch @free-icinga-stable-release
Upgraded icinga-l10n-1.1.0-1.el8.icinga.noarch @@System
Upgrade icinga-php-library-0.12.0-1.el8.noarch @free-icinga-stable-release
Upgraded icinga-php-library-0.7.0-1.el8.icinga.noarch @@System
Upgrade icinga-php-thirdparty-0.11.0-1.el8.noarch @free-icinga-stable-release
Upgraded icinga-php-thirdparty-0.10.0-2.el8.icinga.noarch @@System
Upgrade icingacli-2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded icingacli-2.9.5-1.el8.icinga.noarch @@System
Upgrade icingaweb2-2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded icingaweb2-2.9.5-1.el8.icinga.noarch @@System
Upgrade icingaweb2-common-2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded icingaweb2-common-2.9.5-1.el8.icinga.noarch @@System
Upgrade icingaweb2-vendor-HTMLPurifier-1:2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded icingaweb2-vendor-HTMLPurifier-1:2.9.5-1.el8.icinga.noarch @@System
Upgrade icingaweb2-vendor-JShrink-2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded icingaweb2-vendor-JShrink-2.9.5-1.el8.icinga.noarch @@System
Upgrade icingaweb2-vendor-Parsedown-2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded icingaweb2-vendor-Parsedown-2.9.5-1.el8.icinga.noarch @@System
Upgrade icingaweb2-vendor-dompdf-2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded icingaweb2-vendor-dompdf-2.9.5-1.el8.icinga.noarch @@System
Upgrade icingaweb2-vendor-lessphp-2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded icingaweb2-vendor-lessphp-2.9.5-1.el8.icinga.noarch @@System
Upgrade icingaweb2-vendor-zf1-2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded icingaweb2-vendor-zf1-2.9.5-1.el8.icinga.noarch @@System
Upgrade php-Icinga-2.11.3-2.el8.noarch @free-icinga-stable-release
Upgraded php-Icinga-2.9.5-1.el8.icinga.noarch @@System

From upgrade on most of time it deployed succesfully, but today on it fails to deploy on every attempt. There was no change in configuration that could impact the deployment.

Here we can see that there was only change in variable value, that shouldn’t affect deployment. The issue must be somewhere else:

Application log only say this:

Result of failed deployment:

Interesting, on todays date 13.1.2025 I rebooted Icinga VM and deployment started to work again. Although on previous dates I tried reboot and didn’t solve the problem. So anomaly has to be somewhere else:

Last time I had such a problem, the director systemd service wasn’t running.
But I din’t get a timeout, it was just spinning for ever.

I checked and icinga-director service seems to be running. Issue must probably be somewhere else. Today again we are noticing strange behaviour, most of the time deployment work, but sometimes it seems to fail. We also noticed high CPU usage from services sssd, redis-server and icinga2.

The ones with the same checksums, like dfcd1f2, are significant as the others could have had other problems.

I used Render config and compared, I only changed on variable parameter, which is not problematic:

Reboot of virtual machine seemed to help, so i was able to deploy now. But still am worried, because it’s running on production, I can’t pinpoint exact source of the problem.

1 Like

Any timeouts in journalctl?
OOM in dmesg?

what are the entries in the activitylog between the timespan of the failed and the successful deployment?

In icinga2 log it seems okay:

Also can’t find anything relatable inside journalctl.

Although i have my doubts regarding memory, since the update which was done with these repositories:
https://freedom-for-icinga.com/

Since original updates were discontinued (no support for Almalinux 8 / Centos 8), the memory has been behaving strange. Also don’t know exactly how it works with cache and release, but it is not stable as it was before the update. Worst case scenary I think i could try, reverting snapshot and importing current databases.

We also dedicated already more RAM, which was 32 gb and working stable before update and now 48 and it just seems to use more.

Please note that this projects seems to be dead. The latest version of Icinga 2 they are shipping seems to be 2.13.7, according to the directory listing. This version is vulnerable for the latest critical security vulnerability and also misses multiple bug fixes drafted in the meantime.

I would advise you to either build yourself an up-to-date version of Icinga 2 or take a look at the official repositories, requiring a repo subscription for your target distribution.

Regarding version, FREEDOM-FOR-Icinga repository seems, it was my mistake, after checking we are using packets from original Icinga repositories:
[root@icinga yum.repos.d]# yum info icinga2
Last metadata expiration check: 2:29:11 ago on Fri 17 Jan 2025 08:30:36 AM CET.
Installed Packages
Name : icinga2
Version : 2.14.3
Release : 1.el8
Architecture : x86_64
Size : 55 k
Source : icinga2-2.14.3-1.el8.src.rpm
Repository : @System
From repo : icinga-stable-release
Summary : Network monitoring application
URL : https://www.icinga.com/
License : GPLv2+
Description : Meta package for Icinga 2 Core, DB IDO and Web.

version installed and used is 2.14.3. I am informed that it might pose security risk, although currently migrating to newer version of Icinga (new backend) would propose problems regarding visualisation, since we use nagvis which is not compatible with new Icinga and it stopped releasing in 2017.

I did try also reset of icinga-director service, which seemed to help. But it seems to be bugged. Hopefully they would patch Icinga also for Centos8/Almalinux8/9.

This is the fixed version without known security issue. The backend refers to IDO vs. IcingaDB and is independent from the Icinga version.