Icinga2 Master Shows Server as Not Connected After yum update

Icinga 2
,
1

As the title says, we monitor several Oracle Linux 7 servers with Icinga2, but after running yum update on them, the Icinga2 master now shows that the instance is not connected.

This issue only started happening after the update. The Icinga2 service is running on the server, and ping between the master and the server is working, so there is no network issue. However, the master still shows the server as disconnected.

i checked the logs using:

journalctl -u icinga2 --no-pager | tail -n 50

i noticed some warnings related to ApiListener, mentioning that cert_path, key_path, and ca_path are deprecated.

Has anyone faced this issue before? How can i fix it and restore the connection?

Any help is appreciated!

2

Welcome to the Icinga Community and thanks for posting.

First, could you please supply the versions of Icinga 2 being used?

Then, please verify on your Icinga 2 master that the clients are actually not connected. You can query this information via the Icinga 2 API like the following. Adjust the login credentials accordingly. Feel free to share the (redacted) output.

curl -k -s -S -u root:icinga -H 'Accept: application/json' -H 'X-HTTP-Method-Override: GET' -X POST -d '{ "attrs": [ "connected" ] }' 'https://localhost:5665/v1/objects/Endpoints?pretty=1'

Afterwards, consult the Icinga 2 log file /var/log/icinga2/icinga2.log on the server for connections from the faulty endpoints. The logs should start with something like:

information/ApiListener: New client connection for identity 'endpoint-name' from [::ffff:10.23.42.23]:37706

Please share this entries including the following lines, hopefully containing more information. Redact as you think it is necessary.

On the faulty endpoints, also check the icinga2.log for connection-related errors.

You have already mentioned deprecation warnings in your journal. Could you share these with us?

1 Like
3

We found the problem: the updated server is now using TLS 1.3 for handshake authentication, while the master only accepts the TLS 1.2 protocol

1 Like
4

So your agent was running a newer icinga2 version than your master?

5

yes, also openssl package is updated which force the server to use newer TLS version.

6

I am glad you were able to resolve the issue on your own.

Just for the record, please ensure that the version of the master must be greater/equal to those of the satellite, which must also be greater/equal to those of the agent. This is documented in more detail.

However, unless you have reconfigured the ApiListener, TLS 1.2 should work fine, as this is the minimum TLS version by default.

1 Like