ID: 13623
Title: New default dashboards for linux and windows
Component: Multisite
Level: 2
Class: New feature
Version: 2.1.0i1
With this werk 4 new default dashboards are added to Checkmk. These are:
* <b>Linux hosts</b>: A default dashboard to be used for a (smaller) group of Linux hosts, e.g. a cluster. You will find this dashboard in the "Overview" topic of the Monitor menu.
* <b>Windows hosts</b>: A default dashboard like the above but for windows hosts.
* <b>Single Linux host</b>: A host specific dashboard for Linux hosts. This dashboard is available through the context of a Linux host or though the link of the particular host in the overview dashboard.
* <b>Single Windows host</b>: A host specific dashboard like the above but for windows hosts.
You will find the group dashboards on Monitor > Overview and below the entry
"All hosts". Both dashboards are prefilterted to hosts with the according
operating system. But the scope is a smaller group of related host, e.g. a
cluster of linux or windows server. Because of that it is recommended, to add
more filters to get an actual overview of a specifc group of linux/windows
hosts.
The single host dashboards linked in the host name column, reachable through
the "Host information" dashlet of the group dashboard. Alternatively you
can reach them through the host overview itself by the "Host" dropdown at
the topic "Overview".
ID: 13083
Title: cleanup only very old activations
Component: Core & setup
Level: 2
Class: Bug fix
Version: 2.1.0i1
During the process of "activating changes" it was possible
in certain situations that the activation-ID would disappear before
the activation could have a chance to complete.
Investigations showed that a cleanup job removed these activations
before they even started. This could then manifest itself as the error:
"Missing Activation ID" or a response with a 404 status in the REST API.
This werk fixes this problem by changing the cleanup job to only consider
activations which are at least an hour (3600 seconds) old.
There are no further changes needed for this to take effect.
ID: 13288
Title: Improve speed of activate changes by incremental activating changes
Component: Setup
Level: 2
Class: New feature
Version: 2.1.0i1
With this change the microcore and its helper processes are able to reuse parts of the previous configuration,
without compiling everything anew. Only actually changed hosts will be fully recompiled.
This can significantly reduce the waiting time for "Activate changes".
In addition, the workload during the compilation phase is also reduced, giving the monitoring core some room to breathe.
F+:
## Compilation time comparison using a demo config with 150k services ##
# Full compiliation of all hosts (default behaviour in all previous versions)
real 0m21.107s
user 2m10.626s
sys 0m2.581s
# Using new incremental activation
real 0m6.936s
user 0m24.366s
sys 0m1.492s
F-:
The incremental activation mechanism is used automatically when it is feasible.
Actions where hosts are changed (edit/add/remove/discovery) can make use of this new feature.
However, changes to rulesets require a complete recompilation of the entire configuration, just as in previous versions.
ID: 13574
Title: Update net-snmp lib to 5.9.1
Component: inline-snmp
Level: 2
Class: Bug fix
Version: 2.1.0i1
We now ship omd with the net-snmp lib in version 5.9.1.
This was motivated by several reasons:
* The previously used net-snmp lib had a bug in the python C binding which caused any higher auth protocol then SHA/MD5 not working. (e.g. SHA256, SHA512 etc.). This affected the inline SNMP mode in checkmk only.
* The net-snmp project had a long time no releases. So we now want to go for the latest release.
ID: 13574
Title: Update net-snmp lib to 5.9.1
Component: inline-snmp
Level: 2
Class: Bug fix
Version: 2.1.0i1
We now ship omd with the net-snmp lib in version 5.9.1.
This was motivated by several reasons:
* The previously used net-snmp lib had a bug in the python C binding which caused any higher auth protocol then SHA/MD5 not working. (e.g. SHA256, SHA512 etc.). This affected the inline SNMP mode in checkmk only.
* The net-snmp project had a long time no releases. So we now want to go for the latest release.
ID: 13600
Title: Custom Windows agent port was not respected during update
Component: Checks & agents
Level: 2
Class: Bug fix
Version: 2.1.0i1
Previously, during <tt>update</tt> Windows agent always opened
default port, 6556, in the firewall, even if the TCP port had been
changed by WATO
With this release the problem had been eliminated.
ID: 13633
Title: The password store is now storing passwords obfuscated
Component: Core & setup
Level: 2
Class: New feature
Version: 2.1.0i1
The password stores primary use is to centralize stored credentials. Instead of
spreading the credentials in the whole configuration, we have this as a central
place for sensitive information.
We are a monitoring system. We definitely need credentials in clear text to
contact remote some systems all the time. And we also need to be able do this
after restarting the whole system without user interaction (for providing some
kind of master key). This means the secrets need to be available to the site
user on disk in clear text.
To underline this fact, we kept the password store file in clear text on disk
for a long time. This approach made the situation clearly visible to everyone.
We are faced with the requirement that no credential shall be stored in clear
text on disk, they need to be encrypted. We'd love to have that too. But since
securing is not possible, we are now "obfuscating". In fact it's encryption,
but we are doing it with a secret that is stored in the same context as the
password store itself - this is why we call it obfuscation. The best we can do
in this case.
With the development of Checkmk 2.2 we will evaluate the usage of HSMs as well
as vault solutions in the future which may be helpful in some use cases.
The password store file <tt>var/check_mk/stored_passwords</tt> is now encrypted
using the new password store key (<tt>etc/password_store.secret</tt>). This key
is created during update to Checkmk 2.1 automatically. You are free to replace
the secret with what ever text you want. But please note that the password store
needs to be initialized again after changing the secret.
All existing passwords stores will be obfuscated automatically during update to
Checkmk 2.1.