This release contains a fix for a security vulnerability regarding check_mailq.
Technically we do not introduce the security problem, but strongly lead people
to create one.

check_mailq could be used with the sudo option (-s/--sudo) and would execute
sudo then with mailq as an argument AND additional arbitrary arguments given by the user.
A simple sudo rule to allow the monitoring user to execute this, could lead to arbitrary
command execution with root privileges.

The patch with this release disables the whole sudo option of check_mailq.
Allowing the monitoring user to view the mail queue is now a problem of the MTA and
most (hopefully all) MTAs should support this in one way or another.

We thank @c-kr (again) for reporting the problem.

Other changes

• check_smtp:
  • Trying to use authentication resulted in an UNKNOWN state
    if the authentication succeeded. It returns OK again now.
  • The port logic in SMTP was a bit broken. When the order
    of cli parameters was wrong, the wrong port was used for
    either direct TLS or STARTTLS when using the certificate
    lifetime option (-D). The default port is now directly
    taken from --ssl/--starttls and one of these has to be
    selected explicitly.
• check_swap
  • On FreeBSD information about swap usage was not detected
    correctly (it was assumed that swap was disabled).
    It should work now as expected again.
• check_snmp:
  • On Gentoo builds would fail to due a certain net-snmp
    configuration. This should be fixed and check_snmp
    offers the options which net-snmp on that system has
  • SNMPv3 authentication and privacy was broken since 3.0.0
    This should be fixed now.
• check_ups
  • Since 3.0.0 there were some new bugs which reduced the utility
    significantly. Those were fixed.

The codename for this release is "Gabriele Tergit".

This is a security release. It fixes four potential vulnerabilites in the following plugins:

• check_snmp
• check_real
• check_dhcp
• check_curl

Since check_dhcp is installed as setuid sometimes, this might be especially problematic.

The codename for this release is "Sophie Germain".

This is a security release to fix a potential local privilege escalation problem in check_icmp which might
be possible if check_icmp runs with setuid (our default).
Additionally there are some other small changes.

What's Changed

• check_curl fix: populate the dns cache when hostname gets resolved locally by
• check_mysql_query: add option to hide query in output
• check_mysql: Fix MariaDB casing
• check for net-snmp-config when buildin check_snmp (fixes #2281)

New Contributors

• @C0rn3j made their first contribution in #2283

Full Changelog: v3.0.0...v3.0.1

The Monitoring Plugins Development Team finally announces version 3.0.0 of the Monitoring Plugins.

This is a rather big release as the C part of the project received a huge amount of changes, some of them only internally, but also to the user facing side of things. Most notably is the change in the output of many plugins, which is now mostly multi line by default and hopefully improves the readability. Altough we were careful to avoid breaking anything, it can not completely ruled out, that in some scenarios there are new bugs. Please report (and fix) them :-)

This is also the first release with a code name (because those are cool, right?), which is Johann Georg Elser for this release. You can find more on this Person on Wikipedia.

We have to thank a lot of people for reporting problems or contributing fixes and enhancements. Especially the OpenBSD crew was very helpful with testing the release candidates and reporting problems promptly (mostly with patches attached). It is a joy to have such wonderful people on the project.

Some special thanks go to NLnet and the french goverment for granting us the Blue Hat Prize which made a lot of the work possible.

Last, but not least, we, of course, thank everyone who reported a problem, posted a patch or tested the release candidates to find most of the new bugs. We do appreciate it.The Monitoring Plugins Development Team finally announces version 3.0.0 of the Monitoring Plugins.

General changes

In the C part of the project

• Heavy refactoring to simplify and unify the code base
  - Introduction of a generalized output mechanism for most plugins
  - Standardized code formatting via clang-format

Specific changes

• check_curl
  • check_curl received a lot of changes which improve the documentation and fix several bugs. It is also not considered experimental anymore.
  • Additionaly check_curl can now be configured to handle cookies internally without saving cookies to the filesystem.
  • The new --proxy flag allows setting the proxy similar to the curl tool itself.
• check_http
  check_http is now considered deprecated and will not receive attention any more. It is replaced by check_curl
• check_snmp
  check_snmp does not execute snmpget or snmpgetnext anymore but executes the net-snmp calls natively now.
• check_nwstat
  check_nwstat was removed, due to its perceived insignificance in the current IT world. This reduces the maintenance load and ressource consumption in general.
• check_ntp
  check_ntp was removed. It was faulty by design and marked as deprecated for a long time. The replacements are check_ntp_time and check_ntp_peer.
• check_nt
  check_nt was removed. It is no longer useful in current setups and hasn't been for some time.
• check_by_ssh
  check_by_ssh ignores output on stderr by default now. This should avoid false positives for warnings by the OpenSSH client (especially about the server missing Post-Quantum cryptography.
• check_dns
  check_dns now ignores CNAMES in reverse DNS mode.
• check_fping
  If during compilation fping 5.2, 5.3 or higher are present, check_fping will be able to use new options which were introduced with these versions. These options are (equivalent to the ones with the same name in fping) --fwmark, --icmp-timestamp and --check-source. The older flags --dontfrag and --random were also added.
  Also the -4 and -6 flags may not have worked as intented and should be fixed now.
• check_mysql
  check_mysql should now be able to correctly detect whether a replica is attached and working correctly. Changes were necessary here to adapt to changes in the naming convention in MySQL.

New Contributors

• @ymartin-ovh made their first contribution in #2011
• @aanriot made their first contribution in #1637
• @Firstyear made their first contribution in #2041
• @klaernie made their first contribution in #2053
• @orlitzky made their first contribution in #2062
• @rlaager made their first contribution in #2133
• @Decstasy made their first contribution in #2165
• @inqrphl made their first contribution in #2198
• @dirkmueller made their first contribution in #2231
• @mgagne made their first contribution in #2235

Full Changelog: v2.4.0...v3.0.0

This is the fourth release candidate for version 3.0.0.
The changes in here are again mostly fixes,
If there are no notable problems in this release here, 3.0.0 will be very similar to this state.

The most notable change to 3.0.0-rc3 is the change in the "summary" (the first line in the plugin output) of all
the plugins with the new output functionality.
It now contains either a topic specific OK message or (in the case of a non-OK state) the message from the worst-first failed subcheck.

Changes since 3.0.0-rc3

Changes/Features

• check_http and check_curl: custom timeout return state
• Error and OK summaries for the plugins with the new output functionality
• check_ups: implement modern output

Fixes

• check_snmp: Put all privproto/authproto options into help
• check load: fix some inconsistencies mostly regarding the output text (Typos and such stuff)

Full Changelog: v3.0.0-rc3...v3.0.0-rc4

This is the third release candidate for version 3.0.0.
The changes in here are again mostly fixes, with some exceptions.
If there are no notable problems in this release here, 3.0.0 will be very similar to this state.

Changes since 3.0.0-rc2

Changes/Features

• check_real: implement modern output
• check_radius: Implement modern output
• OpenBSD: pledge(2) some network-facing checks
• check_curl: add proxy argument and improve dns cache usage

Fixes

• Fix some minor compiler warnings
• Refactor check_ide_smart
• Compute numbers in output summary correctly
• check_icmp: prevent segfault on OpenBSD
• check_disk: compare inode thresholds against the correct value
• check_icmp: Populate progname before np_extra_opts call
• Make IPv6 unconditional
• Fix a few typos
• Make replacing of mismatching single quotes work
• Fix check_procs -T option
• check_curl: check certificates and exit before checking for curl_easy_perform result
• Remove troublesome symbols ("|") from output
• Update/gnulib 2026 03
• Handle rc_send_server in libfreeradius
• Revert check_disk performance data back to used space
• Add option to override output for check in lib for check_by_ssh
• common.h: added guard to avoid warning when ENABLE_NLS is not defined
• check_snmp: fixed falltrhough case in ASN_FLOAT/ASN_DOUBLE
• removed -Werror=declaration-after-statement from net-snmp-config --cf… by
• check_curl: Clean up
• added CHECK_EOF to work around warnings about EOF and -1 being the same

This is the second release candidate for version 3.0.0.

It contains mostly fixes to the 3.0.0-rc1 version and is also not a full release, but serves as a basis for test until we are mostly sure not to break production setups.

Changes

• check_nt was removed
  check_nt is no long useful in current setups and hasn't been for some time. Therefore it was removed without a replacement.
• check_ntp was removed
  check_ntp was marked as deprecated for a long time due to systematic problems. It should not be in use anywhere and gets now removed to reduce code size and avoid misleading users. The replacements are check_ntp_time and check_ntp_peer
• Bugfix for check_ntp_time
  An errournous change in check_ntp_time made it fail in almost all use cases. This has been fixed
  Properly separate perfdata from different subchecks A missing separator caused errors in perfdata strings (from C plugins) where two different data points where not properly separated and showed up as a single invalid data point
• check_curl: append the query string from parsed uri
  When using the old style follow method (-f follow) with check_curl the query string was not appended to the new target after redirect. This was fixed. (Thanks @inqrphl )
• Fixing different problems on OpenBSD
  A few different things did prevent proper compilation and usage on OpenBSD, partly due to different naming conventions there. These are hopefully fixed now. Thanks to @oxzi and @sthen .
• Gnulib update to stable-202507

Almost time for a new Monitoring Plugins release

This is a pre release since there are a lot of changes and we would like to give peope some time for testing and to find the new bugs :-)

The core parts of this release are significant changes to the C part of this project, which should be mostly internal and
not change the results in a significant way (meaning the input parameters mostly stay as they are and the exit code should remain the
same if the parameters are the same in the old version and context did not change).
The reality is, that big changes have unintented consequences which are not covered in the test cases or some consequences were not in our scope at all.
Therefore the pre release.

What has changed?

The broad picture

The relevant changes were done in the C part mostly and were introduced to make working on the project easier.
The code is now uniformly formatted with clang-format (config file is in this repository) and a lot of refactoring went into getting more uniform and ideal "dumber" code (meaning easier to read and to think about).
Also some steps were taken to
get to a uniform code base regarding the output.

The idea here is, that each run of a Monitoring Plugin consists of one or more individual "tests" which are summed to present
the overall result state. These "tests" can either be dependent on each other (if one can not connect to a server via network, building a TLS connection and building a HTTP exchange after that is not possible) or independent of each other (check_disk tests different filesystems independently).
This idea was inspired by some other Monitoring Plugins and feel like a good abstraction for the use case.
The consequence is, that there are now data structures which contain individual tests (a test result like OK or CRITICAL , some output and the perfdata part) and they are put together when everything else is done.

Practically the output is not anymore generated by each plugin individually, but centrally by a library (at least for those plugins which were already migrated to that new structure).
This allows to format the ouptut on stdout centrally, currently there is only the default format and an experimental JSON ouptut format (for testing purposes! not stable!).

Plugins with the new output

These Plugins are already migrated:

• check_apt
• check_by_ssh
• check_cluster
• check_curl
• check_dbi
• check_disk
• check_ftp
• check_http
• check_imap
• check_jabber
• check_ldap
• check_mrtg
• check_mrtgtraf
• check_mysql
• check_mysql_query
• check_nntp
• check_nntps
• check_ntp
• check_ntp_peer
• check_ntp_time
• check_pgsql
• check_pop
• check_simap
• check_smtp
• check_snmp
• check_spop
• check_ssh
• check_ssmtp
• check_swap
• check_tcp
• check_udp
• check_users

What else changed?

Of course some bugfixes and even small features found their way into the code, too

check_curl

• check_curl: fix relative redirects on non-standard port by @sni in #2010
• check_curl: raise SSL issue when --continue-after-certificate is used by @ymartin-ovh in #2011
• check_curl: Documentation for --certificate, --cookie-jar by @oxzi in #2012
• Remove experimental state from check_curl by @RincewindsHat in #2017
• Check curl regex state by @RincewindsHat in #2014
• fix check_curl: OpenSSL SSL_read: error:0A000126:SSL routines::unexpe… by @sni in #2022
• check_curl: update TLS notification notes by @RincewindsHat in #2050
• check_curl: enable internal cookie handling by @klaernie in #2052
• Fix/check curl sticky redir by @RincewindsHat in #2188
• check_curl: try to be more helpful in check_curls help by @RincewindsHat in #2186
• check_curl: abort redir if location is not found by @RincewindsHat in #2185

check_snmp

check_snmp links directly agains net-snmp instead of executing snmpget and parsing the output.

• Add more documentation to the help page of check_snmp regarding authe… by @RincewindsHat in #2001
• Check snmp fixes by @RincewindsHat in #2020
• Require snmpgetnext to build check_snmp by @orlitzky in #2062
• check_snmp: fix offset computation for INT by @RincewindsHat in #2190

check_dig

• check_dig: add -E/--require-flags and -X/--forbid-flags by @Decstasy in #2165

general changes regarding the Plugins and the library

• Add clang-format config file by @RincewindsHat in #2026
• Docs update by @RincewindsHat in #2027
• check_ifstatus: Add -d switch by @aanriot in #1637
• Cleanup/check dhcp by @RincewindsHat in #2029
• Improve readability and reliability of test prepare scripts by @RincewindsHat in #2031
• Cleanup/check ups by @RincewindsHat in #2030
• Cleanup check icmp by @RincewindsHat in #2028
• Cleanup for some more plugins by @RincewindsHat in #2035
• Cleanup/lib by @RincewindsHat in #2034
• Fix/check ssh variable stuff by @RincewindsHat in #2016
• check_disk: Initialize most variables by @RincewindsHat in #2039
• Sync with the latest Gnulib code (d4ec02b3cc) (gnulib v1.0) by @RincewindsHat in #2037
• Add dontfrag / random to fping check by @Firstyear in #2041
• tap: clang-format by @RincewindsHat in #2036
• Add missed changes for dontfrag by @Firstyear in #2042
• Fix RPM build tests by @RincewindsHat in #2044
• Cleanup/check apt by @RincewindsHat in #2032
• Cleanup/leftovers by @RincewindsHat in #2043
• Fix argument order of calloc on several occasions by @RincewindsHat in #2045
• Fix false formatting directive in printf by @RincewindsHat in #2046
• Check disk static fixes by @RincewindsHat in #2021
• add new github test workflow for debian:testing and fedora:rawhide by @sni in #2023
• Fix/check icmp rta min by @RincewindsHat in #2051
• fix typo in SUPPORT by @klaernie in #2053
• Fix breakage in rpm build test due to changes in mock by @RincewindsHat in #2057
• Refactor check_swap by @RincewindsHat in #1976
• Update configure.ac to Autoconf 2.71 syntax by @weiss in #2058
• check_http: fix documentation for --state-regex by @andreasbaumann in #2056
• Opttest tool by @RincewindsHat in #2065
• Remove ROADMAP by @RincewindsHat in #2066
• Feature/new output infra by @RincewindsHat in #2064
• Check by ssh missing options by @RincewindsHat in #2069
• Remove tinderbox related stuff by @RincewindsHat in #2072
• Check mysql replica check by @RincewindsHat in #2068
• Implement JSON output parsing for tests by @RincewindsHat in #2076
• Just use eval instead of Try::Tiny in tests by @RincewindsHat in #2077
• Refactor/check dbi by @RincewindsHat in #2075
• Refactor/check ssh by @RincewindsHat in #2071
• Refactor check dns by @RincewindsHat in https://github...

The Monitoring Plugins Development Team is proud to announce version 2.4.0 of
the Monitoring Plugins! This release comes with various fixes provided by more
than 12 contributors. Many thanks to all of you!

For the list of notable changes in this release, see below.

Enhancements

General

• Use C99 booleans @RincewindsHat
• Improve negate plugin helptext @euniceremoquillo
• Add new test function for percentage expressions @RincewindsHat

Single Plugins

• check_mailq: remove trailing whitespaces @sni
• check_mailq: unify tabs/spaces @sni
• check_oracle: Shellcheck fixes @RincewindsHat
• check_ups: output ups.realpower if supported @sbraz
• check_disk: add -n short option for --ignore-missing @sni
• check_procs: Improve help text, mentioning excluded processes @shartge
• check_procs: Generalise wording, remove mentioning of nrpe @shartge
• check_curl: add haproxy protocol option @emriver
• check_disk: increase alert precision @sni
• check_ircd: IPv6 support @oxzi
• check_nwstat: adds percentage used space
• check_swap: Possibility to run check_swap without thresholds @Napsty
• check_ups: additional alarm conditions @RincewindsHat
• check_http/check_curl: added a --regex-state option to change the state of a regex check @andreasbaumann

Fixes

General

• Fixes for -Wsign-compare @RincewindsHat
• Fix logic in is_uint64_t to fix type-limit warning @RincewindsHat
• Prevent -lcrypto from showing up in Makefile dependencies @EricFromCanada
• Change irritating NULL assignment @RincewindsHat

Single Plugins

• check_dbi: Compiler warning for uninitialized variable @RincewindsHat
• check_curl: Initialize pointer before usage @RincewindsHat
• check_ntp: Initialize intermediate results in any case @RincewindsHat
• check_tcp: Fixes an error with using the wrong type for a variable @RincewindsHat
• check_mailq: exit on empty strings and exit early @sni
• check_users: Change option for sanity checking arguments to avoid segfault @RincewindsHat
• check_users: Update help to properly show that thresholds are ranges @RincewindsHat
• check_users: fix segfault @RincewindsHat
• check_dbi: Fix compiler warning for uninitialized variable @RincewindsHat
• check_curl: Initialize pointer before usage @RincewindsHat
• check_ntp: Initialize intermediate results in any case @RincewindsHat
• check_ntp_peer: Fixes for Wmaybe-unitialized and some restructuring @RincewindsHat
• check_dns: Remove unused variable @RincewindsHat
• check_disk: fix ignore-missing in combination with includes @sni
• check_procs: ignore our own children @shartge
• check_http: Remove self assignment of a variable and add some comments @RincewindsHat
• check_snmp: Remove unused variable @RincewindsHat
• check_dhcp: Make implicit conversion explicit to dismiss warning @RincewindsHat
• Ini Parser: Avoid freeing symbols from text section @RincewindsHat
• check_icmp: keep performance data order in case of none-reachable hosts @sni
• check_swap: Change another fake boolean to a real one @RincewindsHat
• check_swap: Rename type since *_t is reserved for C standard types @RincewindsHat
• check_ssh: Fix a typo in "remote-protocol parameter
• check_ssh: Handle non-alpha software versions
• check_ssh: properly parse a delayed version control string
• check_disk: Fail on missing arguments for --warning and --critical and fix a test case @RincewindsHat
• check_disk: Use new test function for percentage expressions @RincewindsHat
• check_load: remove unused code @RincewindsHat
• check_curl/check_http: clarified format of POST data @andreasbaumann

Full Changelog: v2.3.5...v2.4.0

The Monitoring Plugins Development Team is proud to announce version 2.3.5 of
the Monitoring Plugins! This release comes just with a small fix preventing
the tarball from being built. Sorry for this.

For the list of notable changes in this release, see below.

Fixes

General

• Include maxfd.h in lib Makefile

Please also have a look into the changes from the 2.3.4 release,
you might have missed.