Icinga 2 v2.12.10

This security release updates Boost and OpenSSL libraries bundled on Windows
and repairs broken SELinux policies.

Security

• Windows: update bundled OpenSSL to v1.1.1t. #9686

Bugfixes

• SELinux: fix user and domain creation by explicitly setting the role. #9689

Enhancements

• Windows: update bundled Boost to v1.81. #9686

Icinga 2 v2.13.6

The main focus of version 2.13.6 is improved performance of Icinga DB and apply rules.
Additionally, it includes bug fixes related to config loading and API permissions.

Bugfixes

• Improve the throughput of the Icinga DB feature. #9550
• Multiple changes to speed up evaluation of apply rules. #9559 #9565 #9558
• Fix a possible crash on config loading related to ignore_on_error. #9560
• Check API user permission on objects returned by joins. #9561
• Windows: update bundled Boost and OpenSSL versions. #9562 #9567

Icinga 2 v2.13.5

Version 2.13.5 is a maintenance release that fixes some bugs, improves logging and updates a bundled library.

Bugfixes

• Ensure not to write an incomplete (i.e. corrupt) state file. #9467
• ITL: Render vars.apt_upgrade=true as --upgrade, not --upgrade=true. #9458
• Icinga DB: Add missing Redis SELinux policy. #9473
• Windows: Don't spam the event log with non-error startup messages. #9457
• Windows: Update bundled version of OpenSSL. #9460
• Docs: Update RHEL 8 installation instructions. #9482
• Docs: Add RHEL 9 installation instructions. #9482

Icinga 2 v2.13.4

This release brings the final changes needed for the Icinga DB 1.0 release. Addtionally, it includes some fixes and a performance improvement resulting in faster config validation and reload times.

Bugfixes

• Fix a race-condition involving object attribute updates that could result in a crash. #9395
• After a host recovered, only send problem notifications for services after they have been rechecked afterwards to avoid false notifications. #9348
• Speed up config validation by avoiding redundant serialization of objects. #9400
• Add a separator attribute to allow using arguments like --key=value as required by some check plugins. This fixes the --upgrade and --dist-upgrade arguments of check_apt. #9397
• Windows: Update bundled versions of Boost and OpenSSL. #9360 #9415

Icinga DB

• Add an icingadb CheckCommand to allow checking if Icinga DB is healthy. #9417
• Update documentation related to Icinga DB. #9423
• Fix a bug where history events could miss the environment ID. #9396
• Properly serialize attributes of command arguments when explicitly set to null. #9398
• Rename some attributes to make the database schema more consistent. #9399 #9419 #9421
• Make the error message more helpful if the API isn't set up #9418

Icinga 2 v2.12.9

This release includes some fixes and a performance improvement
resulting in faster config validation and reload times.

Bugfixes

• Fix a race-condition involving object attribute updates that could result in a crash. #9394
• Speed up config validation by avoiding redundant serialization of objects. #9401
• Windows: Update bundled version OpenSSL. #9414

Icinga 2 v2.12.8

In the previous version 2.12.7, one bugfix was applied incorrectly. This is fixed by this release.

Downtimes

• Scheduling downtimes for all children and all services no longer fails due to an object name conflict. Only version 2.11.7 was affected by this issue. #9349

Windows

• Update the bundled version of Boost to 1.79.0. #9359

Icinga 2 v2.13.3

This version includes bugfixes for many features of Icinga 2, including fixes for multiple crashes. It also includes a number of fixes and improvements for Icinga DB.

API

• The /v1/config/stages endpoint now immediately rejects parallel config updates instead of accepting and then later failing to verify and activate them. #9328

Certificates

• The lifetime of newly issued node certificates is reduced from 15 years to 397 days. #9337
• Compare cluster certificate tickets in constant time. #9333

Notifications

• Fix a crash that could happen while sending notifications shortly after Icinga 2 started. #9124
• Fix missing or redundant notifications after certain combinations of state changes happened while notifications were suppressed, for example during a downtime. #9285

Checks and Commands

• Fix a deadlock when processing check results for checkables with dependencies. #9228
• Fix a message routing loop that can happen for event commands that are executed within a zone using command_endpoint that resulted in excessive execution of the command. #9260

Downtimes

• Fix scheduling of downtimes for all services on child hosts. #9159
• Creating fixed downtimes starting immediately now send a corresponding notification. #9158
• Fix some issues involving daylight saving time changes that could result in an hour missing from scheduled downtimes. This fix applies to time periods as well. #9238

Configuration

• Fix the evaluation order of default templates when used in combination with apply rules. Now default templates are imported first as stated in the documentation and as it already happens for objects defined without using apply. #9290

IDO

• Fix an issue where contacts were not written correctly to the notification history if multiple IDO instances are active on the same node. #9242
• Explicitly set the encoding for MySQL connections as a workaround for changed defaults in Debian bullseye. #9312
• Ship a MySQL schema upgrade that fixes inconsistent version information in the full schema file and upgrade files which could have resulted in inaccurate reports of an outdated schema version. #9139

Performance Data Writers

• Fix a race condition in the InfluxDB Writers that could result in a crash. #9237
• Fix a log message where Influxdb2Writer logged as InfluxdbWriter. #9315
• All writers no longer send metrics multiple times after HA failovers. #9322

Build

• Fix the order of linker flags to fix builds on some ARM platforms. #9164
• Fix a regression introduced in 2.13.2 preventing non-unity builds. #9094
• Fix an issue when building within an unrelated Git repository, version information from that repository could incorrectly be used for Icinga 2. #9155
• Windows: Update bundled Boost version to 1.78.0 and OpenSSL to 1.1.1n #9325

Internals

• Fix some race conditions due to missing synchronization. These race conditions should not have caused any practical problems besides incorrect numbers in debug log message. #9306
• Move the startup.log and status files created when validating incoming cluster config updates to /var/lib/icinga2/api and always keep the last failed startup.log to ease debugging. #9335

Icinga DB

• The severity attribute was updated to match the sort order Icinga Web 2 uses for the IDO. The documentation for this attribute was already incorrect before and was updated to reflect the current functionality. #9239 #9240
• Fix the is_sticky attribute for comments. #9303
• Fix missing updates of is_reachable and severity in the state tables. #9241
• Removing an acknowledgement no longer incorrectly writes comment history. #9302
• Fix multiple issues so that in an HA zone, both nodes now write consistent history. #9157 #9182 #9190
• Fix that history events are no longer written when state information should be updated. #9252
• Fix an issue where incomplete comment history events were generated. #9301
  Note: when removing comments using the API, the dedicated remove-comment action should be used instead of the objects API, otherwise no history event will be generated.
• Fix handling of non-integer values for the order attribute of command arguments. #9181
  Note: You should only specify integer values for order, other values are converted to integer before use so using fractional numbers there has no effect.
• Add a dependency on icingadb-redis.service to the systemd service file so that Redis is stopped after Icinga 2. #9304
• Buffer history events in memory when the Redis connection is lost. #9271
• Add the previous soft state to the state tables. #9214
• Add missing locking on object runtime updates. #9300

Icinga 2 v2.12.7

This version includes bugfixes for many features of Icinga 2, including fixes for multiple crashes.

API

• The /v1/config/stages endpoint now immediately rejects parallel config updates instead of accepting and then later failing to verify and activate them. #9326

Certificates

• The lifetime of newly issued node certificates is reduced from 15 years to 397 days. #9338
• Compare cluster certificate tickets in constant time. #9334

Notifications

• Fix a crash that could happen while sending notifications shortly after Icinga 2 started. #9125

Checks and Commands

• Fix a deadlock when processing check results for checkables with dependencies. #9229
• Fix a message routing loop that can happen for event commands that are executed within a zone using command_endpoint that resulted in excessive execution of the command. #9261

Downtimes

• Fix scheduling of downtimes for all services on child hosts. #9184
• Creating fixed downtimes starting immediately now send a corresponding notification. #9185
• Fix some issues involving daylight saving time changes that could result in an hour missing from scheduled downtimes. This fix applies to time periods as well. #9246
• Fix a bug where downtimes on the day after a daylight saving time change could be off by an hour. #9253

Configuration

• Fix the evaluation order of default templates when used in combination with apply rules. Now default templates are imported first as stated in the documentation and as it already happens for objects defined without using apply. #9294

IDO

• Fix an issue where contacts were not written correctly to the notification history if multiple IDO instances are active on the same node. #9243
• Explicitly set the encoding for MySQL connections as a workaround for changed defaults in Debian bullseye. #9313
• Ship a MySQL schema upgrade that fixes inconsistent version information in the full schema file and upgrade files which could have resulted in inaccurate reports of an outdated schema version. #9140

Performance Data Writers

• Fix a race condition in the InfluxDB Writers that could result in a crash. #9247
• All writers no longer send metrics multiple times after HA failovers. #9329

Build

• Fix the order of linker flags to fix builds on some ARM platforms. #9167
• Fix an issue when building within an unrelated Git repository, version information from that repository could incorrectly be used for Icinga 2. #9156
• Windows: Update bundled Boost version to 1.78.0 and OpenSSL to 1.1.1n #9320 #9327

Internals

• Fix some race conditions due to missing synchronization. These race conditions should not have caused any practical problems besides incorrect numbers in debug log message. #9305
• Move the startup.log and status files created when validating incoming cluster config updates to /var/lib/icinga2/api and always keep the last failed startup.log to ease debugging. #9336
• Remove outdated and incorrect of the severity attributes #9244

Icinga 2 v2.13.2

This version only includes changes needed for the release of Icinga DB 1.0.0 RC2 and doesn't include any other bugfixes or features.

Icinga DB

• Prefix command_id with command type #9085
• Decouple environment from Icinga 2 Environment constant #9082
• Make icinga:history:stream:*#event_id deterministic #9076
• Add downtime.duration & service_state.host_id to Redis #9084
• Sync checkables along with their states first #9081
• Flush both buffered states and state checksums on initial dump #9079
• Introduce icinga:history:stream:downtime#scheduled_by #9080
• Actually write parent to parent_id of zones #9078
• Set value in milliseconds for program_start in stats/heartbeat #9077
• Clean up vanished objects from icinga:checksum:*:state #9074
• Remove usernotification history stream #9073
• Write IDs of notified users into notification history stream #9071
• Make CheckResult#scheduling_source available to Icinga DB #9072
• Stream runtime state updates only to icinga:runtime:state #9068
• Publish Redis schema version via XADD icinga:schema #9069
• Don't include checkable types in history IDs #9070
• Remove unused Redis key 'icinga:zone:parent' #9075

Icinga 2 v2.13.1

Issues and PRs
Blogpost

The main focus of this version is a security vulnerability in the TLS certificate verification of our metrics writers ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer.

Version 2.13.1 also fixes two issues introduced with the 2.13.0 release.

Security

• Add TLS server certificate validation to ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer (GHSA-cxfm-8j5v-5qr2)

Depending on your setup, manual intervention beyond installing the new versions may be required, so please read the more detailed information in the release blog post carefully.

Bugfixes

• IDO PgSQL: Fix a string quoting regression introduced in 2.13.0 #8958
• ApiListener: Automatically fall back to IPv4 in default configuration on systems without IPv6 support #8961