ID: 6410
Title: Determine the parent process more reliably
Component: Site Management
Level: 1
Class: Bug fix
Version: 1.6.0i1
Previously, the parent process was determined by parsing
/proc/{PID}/stat and columns where assumed to be separated by space.
This was unreliable because the filename in the second
column may contain a space as well. If omd was issued e.g. from tmux
the process name "tmux: server" was used. This resulted in a traceback
during e.g. omd …
[View More]rm. Now the psutil module is used to determine the
parent process.
[View Less]
ID: 6733
Title: veeam_backup_status: Plugin is bakeable
Component: agents
Level: 1
Class: Bug fix
Version: 1.6.0i1
If no 64-bit Windows agent is used you have to create a wrapper batch script,
eg. {{veeam_backup_status.bat}} which calls the {{veeam_backup_status.ps1}}.
In this case the powershell script needs to be put somewhere else (see example
here) and is called from this .bat script with the 64 bit powershell:
<code>
@ECHO OFF
%systemroot%\sysnative\…
[View More]WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted " & ""C:\scripts\veeam_backup_status.ps1"""
</code>
[View Less]
ID: 6770
Title: Showing graph metric values at mouse position now
Component: metrics
Level: 2
Class: New feature
Version: 1.6.0i1
When moving the mouse pointer on Check_MK graphs a hover popup will be shown at
the mous position that contains the date and time of the current mouse
position together with the values of the single metrics.
ID: 6774
Title: Add Content-Security-Policy header to prevent some cross site scripting and injection attacks
Component: Multisite
Level: 1
Class: Security fix
Version: 1.6.0i1
When requesting pages from the GUI a <tt>Content-Security-Policy</tt> is now been set in the HTTP
response. Using this mechanism the application can tell the browser which things are allowed to
be done by the web page in the context of the browser.
We are now, for example …
[View More]limiting the URLs where AJAX calls can be made to or the URLs which can
be used as form targets. This helps to prevent some XSS and other injection attacks.
The configuration of this policy is made in the apache configuration file
<tt>etc/apache/conf.d/security.conf</tt>. In case you want to have a look at the details or
want to extend the policy somehow you may edit the file in the context of your site configuration.
To apply the changes you need to restart your site apache using <tt>omd restart apache</tt>.
In case of trouble please let us know. We can probably adapt the default configuration to solve
common issues with this policy for all users.
One thing that may affect users that include Check_MK pages on other web pages using frames or
iframes: We set the <tt>frame-ancestors</tt> option to <tt>'self'</tt> which means that only pages
with the same protocol, url and port as the Check_MK page may refer to Check_MK pages. You can
extend this statement with the URLs you want to allow.
[View Less]
ID: 6772
Title: LDAP: Only save users on changed configuration
Component: Multisite
Level: 1
Class: Bug fix
Version: 1.6.0i1
The LDAP synchronization was rewriting the user configuration during
every synchronization, even when no change has been made to the user
configuration.
This needless operation resulted in subsequent load because some
processes, like the Check_MK alert and notify helper were reloading
their configuration in case of a changed Check_MK config file.
ID: 6773
Title: Fixed URL redirect from /[site]/ when using custom ports
Component: Multisite
Level: 1
Class: Bug fix
Version: 1.6.0i1
Requests to the GUI were not done correctly when a non standard port is used
for accessing the GUI. The redirect from <tt>/[site]/</tt> or <tt>/[site]</tt>
to <tt>/[site]/check_mk/</tt> was setting the URL back to standard ports.
ID: 6771
Title: Fixed minor graph rendering issues when using the modern theme
Component: metrics
Level: 1
Class: Bug fix
Version: 1.6.0i1
The graph time axis labels had a slightly wrong background color. And
the graph hover indicator line had a wrong position in relation to the
mouse pointer.
ID: 6735
Title: cpu_util_unix: Fixed calculation of CPU usage on UNIX
Component: Checks & agents
Level: 1
Class: Bug fix
Version: 1.6.0i1
The result of the cpu_usage is wrong. The cpu_time_guest is included in
cpu_time_user: See
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/kerne…
for more information:
<code>
/*
* Account guest CPU time to a process.
* @p: the process that the CPU time gets accounted to
* @cputime: the CPU …
[View More]time spent in virtual machine since the last update
*/
void account_guest_time(struct task_struct *p, u64 cputime)
{
u64 *cpustat = kcpustat_this_cpu->cpustat;
/* Add guest time to process. */
p->utime += cputime;
account_group_user_time(p, cputime);
p->gtime += cputime;
/* Add guest time to cpustat. */
if (task_nice(p) > 0) {
cpustat[CPUTIME_NICE] += cputime;
cpustat[CPUTIME_GUEST_NICE] += cputime;
} else {
cpustat[CPUTIME_USER] += cputime;
cpustat[CPUTIME_GUEST] += cputime;
}
}
</code>
[View Less]
ID: 5511
Title: cmk-update-agent: Improve prelink handling
Component: agents
Level: 1
Class: Bug fix
Version: 1.6.0i1
With werk #5507, we tried to mitigate the impact of prelink on the agent updater binary.
However, it turned out that the corresponding files did not survive every Check_MK Agent
update scenarios.
First of all, please note that we do not recommend the usage of prelink at all,
as its benefit is questionable and there are some issues
(not limited …
[View More]the the cmk-update-agent binary) that may occur by applying it to a system.
Now, with this werk, the prelink exception for the cmk-update-agent is placed on the target
system in a more robust way.
A blacklist-file at <tt>/etc/prelink.conf.d/cmk-update-agent.conf</tt> is
now placed on the target system regardless of an existing prelink-installation.
If prelink is installed on the target system (i.e. the file <tt>/etc/prelink.conf</tt> exists),
our blacklist-file will be referenced as an additional prelink configuration file.
If prelink gets installed on the system after the Check_MK Agent, you have to reference
the blacklist-file by yourself. You can do this by adding a line
<pre>-c /etc/prelink.conf.d/cmk-update-agent.conf</pre>
to <tt>/etc/prelink.conf</tt>.
However, this mechanism is only available for .rpm and .deb Check_MK Agent pakages.
[View Less]