Merge branch 'master' into feature-nvidia-smi-linux-plugin

.aspect/cli/config.yaml

@@ -0,0 +1,3 @@
+lint:
+  aspects:
+    - //packages/cmk-agent-based:linters.bzl%ruff

.bazeliskrc

@@ -0,0 +1,2 @@
+BAZELISK_BASE_URL=https://github.com/aspect-build/aspect-cli/releases/download
+USE_BAZEL_VERSION=aspect/5.10.15

.bazelrc

@@ -25,11 +25,6 @@ build --flag_alias=cmk_version=//:cmk_version
 # valgrind-clean again, which is a crucial feature for debugging the NEB & CMC!
 build --copt="-DRE2_ON_VALGRIND"
 
-# Don't require system python for bootstrapping
-# See: https://github.com/bazelbuild/rules_python/commit/f5b19dce7bc0837396ac03a425cdb9b64643cf61
-# TODO: should be dropped as soon as this becomes the default
-build --@rules_python//python/config_settings:bootstrap_impl=script
-
 clean --async
 # all bazel-created temporary and build output files
 # clean --expunge
@@ -53,6 +48,13 @@ common:ci --@//:filesystem_layout=FILESYSTEM_LAYOUT_INVALID
 
 ## For specific commands
 # build:ci ...
+# Don't require system python for bootstrapping
+# See: https://github.com/bazelbuild/rules_python/commit/f5b19dce7bc0837396ac03a425cdb9b64643cf61
+# TODO: should be dropped as soon as this becomes the default
+# TODO: this should be the overall default, see discussions in
+# https://tribe29.slack.com/archives/C03PW9280U9/p1728303949973099
+build:ci --@rules_python//python/config_settings:bootstrap_impl=script
+
 # clean:ci ...
 # run:ci ...
 # test:ci ...

.clangd

@@ -0,0 +1,3 @@
+Diagnostics:
+  UnusedIncludes: None
+  MissingIncludes: None

.gitignore

@@ -82,6 +82,7 @@ tests/.hypothesis/
 /buildscripts/docker_image_aliases/docker-image-alias-resolve-error.txt
 /bazel-*
 /bazel_log*
+bazel-memory.profile
 user.bazelrc
 
 # Created by https://www.toptal.com/developers/gitignore/api/visualstudiocode

.gitmodules

@@ -2,3 +2,4 @@
 	path = tests/qa-test-data
         url = ../qa-test-data
 	branch = master
+	ignore = all

.pre-commit-config.yaml

@@ -20,6 +20,7 @@ repos:
       rev: 'v0.4.4'
       hooks:
         - id: ruff
+        - id: ruff-format
     - repo: https://github.com/pre-commit/pre-commit-hooks
       rev: v4.6.0
       hooks:
@@ -58,16 +59,6 @@ repos:
             language: script
             entry: scripts/run-autoflake
             types: [file, python]
-          - id: format
-            name: Run format
-            entry: scripts/run-format
-            language: script
-            types: [file, python]
-          - id: sort
-            name: Run sort imports
-            entry: scripts/run-sort
-            language: script
-            types: [file, python]
           - id: bandit
             name: Run bandit
             # -l level low -ll = level medium -lll level high

.werks/10848

@@ -8,11 +8,12 @@ Knowledge: undoc
 Level: 1
 Version: 2.0.0i1
 
-An configuration directory for mk_oracle has been added.  mk_oracle
-usually reads mk_oracle.cfg. Now it also reads all files with *.cfg from
-$MK_CONFDIR/mk_oracle.d This feauture is needed for setups with bakery and
+A configuration directory for <code>mk_oracle</code> has been added. <code>mk_oracle</code>
+usually reads <code>mk_oracle.cfg</code>. Now, it also reads all files with <code>*.cfg</code> from
+<code>$MK_CONFDIR/mk_oracle.d</code>. This feauture is needed for setups with bakery and
 local changes on the database server. It is possible to configure through
-the bakery and add custom SQLs in configuration directory.
+the bakery and add custom SQLs in configuration directory <code>mk_oracle.d</code>.
 
-All variables in files from mk_oracle.d will oerwrite possible entries from
-mk_oracle.cfg.
+All variables defined in files from the <code>mk_oracle.d</code> directory will overwrite entries with the same name from
+<code>mk_oracle.cfg</code>. Further, all variables defined in <code>*.cfg</code> files within the <code>mk_oracle.d</code>, must be unique, otherwise the last
+read file wins.

.werks/14237.md

@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# Fixed performance problems for various command line operations
+
+key        | value
+---------- | ---
+date       | 2024-09-27T10:40:03+00:00
+version    | 2.4.0b1
+class      | fix
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+With larger setups (>10000 hosts), loading the host configuration took considerably longer ( **O(n^2)** ) than normal.
+The ‘Parameters for this service’ page, for example, requires the complete host configuration.

.werks/16251.md

@@ -0,0 +1,14 @@
+[//]: # (werk v2)
+# Update monitoring-plugins to 2.4.0
+
+key        | value
+---------- | ---
+date       | 2024-09-04T14:11:06+00:00
+version    | 2.4.0b1
+class      | feature
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+

.werks/16254.md

@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# Add metric translations mrpe based windows checks
+
+key        | value
+---------- | ---
+date       | 2024-10-07T08:14:51+00:00
+version    | 2.4.0b1
+class      | feature
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+Metrics provided by `check_ping.exe` or `check_tcp.exe` have now a metric translation and are
+displayed in a correct manner.

.werks/16255.md

@@ -0,0 +1,17 @@
+[//]: # (werk v2)
+# Stop shipping check_ircd from monitoring-plugins
+
+key        | value
+---------- | ---
+date       | 2024-10-10T11:13:32+00:00
+version    | 2.4.0b1
+class      | fix
+edition    | cre
+component  | checks
+level      | 1
+compatible | no
+
+Since the update of monitoring-plugins to 2.4.0, `check_ircd` requires the perl module `IO::Socket::IP`.
+As we cannot guarantee that the required perl version is available under all distros supported by Checkmk, we decided to stop shipping the plugin.
+
+In case you need this plugin, you can install it manually to the local hierarchy of your site.

.werks/16557.md

@@ -0,0 +1,19 @@
+[//]: # (werk v2)
+# Distributed agent bakery: cached packages remain on remote site
+
+key        | value
+---------- | ---
+date       | 2024-10-02T11:56:57+00:00
+version    | 2.4.0b1
+class      | fix
+edition    | cee
+component  | agents
+level      | 1
+compatible | yes
+
+When using the agent bakery and (automatically) downloading agent packages from a remote site,
+the remote site caches the provided packages until they are invalidated by the central site.
+This happens automatically on every call from the agent updater.
+
+This mechanism recently failed to delete unneeded cached packages from the remote site, leading
+to an increased disk usage.

.werks/16567.md

@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# Re-add missing "History action type" filter
+
+key        | value
+---------- | ---
+date       | 2024-10-02T08:34:26+00:00
+version    | 2.4.0b1
+class      | fix
+edition    | cre
+component  | ec
+level      | 1
+compatible | yes
+
+The "History action type" filter has been added back to the "Recent event
+history" view. It was accidentally removed during the development of 2.3.

.werks/16778.md

@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# fortisandbox plugin: expand monitored models
+
+key        | value
+---------- | ---
+date       | 2024-09-26T11:57:53+00:00
+version    | 2.4.0b1
+class      | feature
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+Previously, the fortisandbox plugins discovered and monitored only the Fortinet _fsa3000E_ devices.
+With this change, the plugin monitors all available models discoverable under the oid _1.3.6.1.4.1.12356.118.1._.

.werks/16895.md

@@ -0,0 +1,20 @@
+[//]: # (werk v2)
+# omd: curl wrapper not used for all supported versions of SLES and EL
+
+key        | value
+---------- | ---
+compatible | yes
+version    | 2.4.0b1
+date       | 2024-09-17T15:13:20+00:00
+level      | 1
+class      | fix
+component  | omd
+edition    | cre
+
+Some OMD makefile rules have to be (de-)activated for certain versions of SLES or EL
+(Enterprise Linux), but would not respect all affected versions due to the redundant
+implementation of the check. This led to {{curl}} not being wrapped as needed for SLES15-SP3.
+
+This change makes use of string prefixes rather than explicit listing of all supported
+versions of e.g. SLES15[-sp*], which fixes the mentioned issue and also takes care of
+future releases of SLES15 or EL based distros.

.werks/16897.md

@@ -0,0 +1,19 @@
+[//]: # (werk v2)
+# chrony: wrong handling of 'n/a' values for 'Ref time (UTC)' and 'Stratum'
+
+key        | value
+---------- | ---
+date       | 2024-09-25T11:16:41+00:00
+version    | 2.4.0b1
+class      | fix
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+A chrony status without a valid server also contains invalid values for 'Stratum' and 'Ref time',
+resulting in a 'Time since last sync' of 54 years 256 days being reported (which is the difference
+to epoc := 1.1.1970).
+
+This change just skips reporting 'Stratum' and 'Time since last sync' if we don't have a valid
+server (address).

.werks/16898.md

@@ -0,0 +1,16 @@
+[//]: # (werk v2)
+# active_checks:httpv2: support macros in 'user_agent' field
+
+key        | value
+---------- | ---
+date       | 2024-10-08T11:32:55+00:00
+version    | 2.4.0b1
+class      | feature
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+While the `endpoint.url` element in httpv2 active check configuration support macro replacement,
+`user_agent` doesn't.
+This change adds support for macro replacement also for the `user_agent` field.

.werks/17038.md

@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# emka_modules: Fix parsing error
+
+key        | value
+---------- | ---
+date       | 2024-09-29T23:11:58+00:00
+version    | 2.4.0b1
+class      | fix
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+When upgrading from 2.2 to 2.3, a parsing error caused services related to the 'emka_modules' check plugin to receive no data and go to 'UNKN'.
+This has now been fixed and the check plugin will behave as it did in 2.2.

.werks/17039.md

@@ -0,0 +1,15 @@
+[//]: # (werk v2)
+# db2_sort_overflow: Fix typo in service summary
+
+key        | value
+---------- | ---
+date       | 2024-10-06T17:19:11+00:00
+version    | 2.4.0b1
+class      | fix
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+There was a typo in the summary. When the state was WARN or CRIT, the summary said "leves at" instead of "levels at".
+This is now fixed.

.werks/17088.md

@@ -0,0 +1,18 @@
+[//]: # (werk v2)
+# mk_logwatch: Remove colored output support in debug mode
+
+key        | value
+---------- | ---
+date       | 2024-09-23T08:58:40+00:00
+version    | 2.4.0b1
+class      | fix
+edition    | cre
+component  | checks
+level      | 1
+compatible | no
+
+Until now the debug mode ("-d" flag) would color the lines of the mk_logwatch output depending on their log level. This causes problems when processing the output, leading to the e.g. `maxcontextlines` setting no longer being effective.
+To improve the stability of the agent plugin, its output will no longer be colored.
+If you need the output to be colored, you can do so via e.g.
+
+    mk_logwatch.py -d  | sed  -e 's/^C .*/\x1b[1;31m&\x1b[0m/' -e 's/^W .*/\x1b[1;33m&\x1b[0m/' -e 's/^O .*/\x1b[1;32m&\x1b[0m/' -e 's/^I .*/\x1b[1;34m&\x1b[0m/'

.werks/17095.md

@@ -0,0 +1,50 @@
+[//]: # (werk v2)
+# Sanitize Host and Folder Credentials in Audit Log
+
+key        | value
+---------- | ---
+date       | 2024-10-07T05:57:04+00:00
+version    | 2.4.0b1
+class      | security
+edition    | cre
+component  | wato
+level      | 1
+compatible | no
+
+Before this Werk, adding, changing, or removing SNMP and IMPI credentials in a host or folder's properties would log those credentials in the WATO audit log. Now, credentials are masked before being written to the log.
+
+The affected logs, both via the rendering functionality in WATO as well as the files on the file system, are only accessible to authenticated users.
+
+This issue was found during internal review.
+
+*Affected Versions*:
+
+* 2.3.0
+* 2.2.0
+* 2.1.0
+* 2.0.0 (EOL)
+
+*Recommendations*:
+
+We have marked this Werk incompatible because we recommend taking manual action:
+
+Consider rotating affected credentials.
+If that is not feasible, consider sanitizing the log files.
+Also take into account that log files containing credentials might have been written to backups.
+
+The affected log files can be found in `~/var/check_mk/wato/log`.
+
+Note that, before Checkmk 2.3.0p18, entries in the files were not separated by newlines but by null bytes.
+So they would appear as one long line.
+Entries that might contain credentials are all entries where the `'action'` is `'edit-folder'` or `'edit-host'`, and the `'diff_text'` contains any of the following strings:
+
+ * `Attribute "snmp_community"`
+ * `Value of "snmp_community"`
+ * `Attribute "management_snmp_community"`
+ * `Value of "management_snmp_community"`
+ * `Attribute "management_ipmi_credentials"`
+ * `Value of "management_ipmi_credentials"`
+
+*Vulnerability Management*:
+
+We have rated the issue with a CVSS Score of 5.1 Medium (`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N`) and assigned `CVE-2024-38862`.