How to disable https check?

Troubleshooting
,
1

**CMK version: 2.4.0p26 Enterprise Edition **

I’m a little desperate how to disable a https service check, that was enabled in the past.
I can still spot a connection to the target host, although I literally removed everything (host, checks) related to the target host.

root@lnzcheckmk01:~ # tcpdump -i any host 10.100.10.74 and port 443
..
11:24:32.186391 ens192 Out IP lnzcheckmk01.research.silicon-austria.com.40606 > VIHWEB01.siliconaustria.local.https: Flags [S] ..

The https check I had was time.silicon-austria.com , so VIHWEB01.siliconaustria.local seen is an alias. I still see these SYN packets every 5 minutes (and the webserver log also).

I also meanwhile removed the host time.silicon-austria.com in the setup, restarted checkmk, reloaded the core cmk -O .

And besides that, I see no http check anymore:

SAL@lnzcheckmk01:~/var/log $ cmk -N -v time.silicon-austria.com
#
# Created by Check_MK. Do not edit.
#


# ----------------------------------------------------
# time.silicon-austria.com
# ----------------------------------------------------
define host {
  _ADDRESSES_4
  _ADDRESSES_6
  _ADDRESS_4                    10.100.10.74
  _ADDRESS_6
  _ADDRESS_FAMILY               4
  _TAGS                         / auto-piggyback cmk-agent ip-v4-only lan no-snmp prod site:SAL
  __TAG_616464726573735F66616D696C79 69702D76342D6F6E6C79
  __TAG_6167656E74              636D6B2D6167656E74
  __TAG_637269746963616C697479  70726F64
  __TAG_6E6574776F726B696E67    6C616E
  __TAG_70696767796261636B      6175746F2D70696767796261636B
  __TAG_73697465                53414C
  __TAG_736E6D705F6473          6E6F2D736E6D70
  address                       10.100.10.74
  alias                         time.silicon-austria.com
  check_command                 check-mk-host-ping!-w 200.00,80.00% -c 500.00,100.00%
  host_name                     time.silicon-austria.com
  hostgroups                    check_mk
  use                           check_mk_host
}

define service {
  check_command                 check-mk-ping!-w 200.00,80.00% -c 500.00,100.00% 10.100.10.74
  check_interval                1.0
  contact_groups
  host_name                     time.silicon-austria.com
  service_description           PING
  use                           check_mk_pingonly
}

and

SAL@lnzcheckmk01:~ $ cmk -N -v VIHWEB01.siliconaustria.local
#
# Created by Check_MK. Do not edit.
#


# ----------------------------------------------------
# VIHWEB01.siliconaustria.local
# ----------------------------------------------------
Updating IPv4 DNS cache for VIHWEB01.siliconaustria.local: 10.100.10.74
define host {
  _ADDRESSES_4
  _ADDRESSES_6
  _ADDRESS_4                    10.100.10.74
  _ADDRESS_6
  _ADDRESS_FAMILY               4
  _TAGS                         / auto-piggyback cmk-agent ip-v4-only lan no-snmp prod site:SAL
  __TAG_616464726573735F66616D696C79 69702D76342D6F6E6C79
  __TAG_6167656E74              636D6B2D6167656E74
  __TAG_637269746963616C697479  70726F64
  __TAG_6E6574776F726B696E67    6C616E
  __TAG_70696767796261636B      6175746F2D70696767796261636B
  __TAG_73697465                53414C
  __TAG_736E6D705F6473          6E6F2D736E6D70
  address                       10.100.10.74
  alias                         VIHWEB01.siliconaustria.local
  check_command                 check-mk-host-ping!-w 200.00,80.00% -c 500.00,100.00%
  host_name                     VIHWEB01.siliconaustria.local
  hostgroups                    check_mk
  use                           check_mk_host
}

define service {
  check_command                 check-mk-ping!-w 200.00,80.00% -c 500.00,100.00% 10.100.10.74
  check_interval                1.0
  contact_groups
  host_name                     VIHWEB01.siliconaustria.local
  service_description           PING
  use                           check_mk_pingonly
}

How can I stop the https check completely? Thanks

2

You still observe this after a omd restart site - even once remove the hosts from your setup? Are you sure this comes from CheckMK? Not sure but mabe you can cross check by omd stop site and check if you still have https traffic to the host in question.

Check crontab / process list / apache config

3

according to tcpdump, yes the traffic is initiated from checkmk server.
Thanks for your tip, but there is no cronjob etc.
For testing purpose I stopped checkmk, and the traffic disappears

4

In that case you might have configured a http rule for another host to check the host in question ?

should print all configured http checks and this still did not show the host in question here ?
cmk -N | grep http

any local/custom checks which might initiate a http connection ?

5

$ cmk -N | grep http didn’t reveal any info about this http service check.

so I did -

SAL@lnzcheckmk01:~ $ grep -rn "http\|urlcheck" /omd/sites/SAL/etc/check_mk/conf.d/wato/ --include="*.mk" | grep -i "time\|vihweb\|10\.100\.10\.74"
...
/omd/sites/SAL/etc/check_mk/conf.d/wato/webserver/rules.mk:26:{'id': '9dabf352-8ada-4af7-9dcb-30be93e0b761', 'value': {'endpoints': [{'service_name': {'prefix': 'auto', 'name': 'https_check_time'}, 'url': 'https://time.silicon-austria.com'}], 'standard_settings': {'connection': {'method': ('get', None), 'redirects': 'ok'}, 'cert': ('validate', ('fixed', (3456000.0, 1728000.0)))}}, 'condition': {'host_name': ['time.silicon-austria.com'], 'host_folder': '/%s/' % FOLDER_PATH}, 'options': {'disabled': True, 'description': 'Website check', 'comment': '2025-08-27 krausf: \n'}},

Now I cleared and rebuild -

SAL@lnzcheckmk01:~ $ rm -f /omd/sites/SAL/etc/check_mk/conf.d/wato/*.mk
SAL@lnzcheckmk01:~ $ cmk -O
SAL@lnzcheckmk01:~ $ rm -f /omd/sites/SAL/var/nagios/retention.dat /omd/sites/SAL/var/nagios/status.dat
SAL@lnzcheckmk01:~ $ cmk -R

although I see disabled (?), it still checks. But a rule is found (which I can’t find in the UI in my service checks Setup > Services > HTTP, TCP, email, ... > Check HTTP web service 

SAL@lnzcheckmk01:~ $ grep -rn "http\|urlcheck" /omd/sites/SAL/etc/check_mk/conf.d/wato/ --include="*.mk" | grep -i "time\|vihweb\|10\.100\.10\.74"
/omd/sites/SAL/etc/check_mk/conf.d/wato/webserver/rules.mk:26:{'id': '9dabf352-8ada-4af7-9dcb-30be93e0b761', 'value': {'endpoints': [{'service_name': {'prefix': 'auto', 'name': 'https_check_time'}, 'url': 'https://time.silicon-austria.com'}], 'standard_settings': {'connection': {'method': ('get', None), 'redirects': 'ok'}, 'cert': ('validate', ('fixed', (3456000.0, 1728000.0)))}}, 'condition': {'host_name': ['time.silicon-austria.com'], 'host_folder': '/%s/' % FOLDER_PATH}, 'options': {'disabled': True, 'description': 'Website check', 'comment': '2025-08-27 krausf: \n'}},

last action would be to call for assistance from checkMK support ..

6

http-check02
http-check021683×112 7.83 KB

Those are all empty ?

7

I have http checks defined -

image

but here, in Check HTTP web service I had this check, but 1st I disabled the check, meanwhile I removed it already. But still, I see packets on the wire, strange

8

Does you get anything back from


grep -rli “10.100.10.74|vihweb” /omd/sites/SAL/etc/check_mk/
grep -rli “10.100.10.74|vihweb” /etc/check_mk

Please keep in mind to change /etc/check_mk to the config directory of the agent if it has been changed.

Also verify that you might not have (or have the correct entry) in /etc/hosts of the system in question.

9

thanks for the tipp, but also here, no clue

SAL@lnzcheckmk01:~ $ grep -rli '10.100.10.74|vihweb' /omd/sites/SAL/etc/check_mk/
SAL@lnzcheckmk01:~ $ grep -rli '10.100.10.74|vihweb' /etc/check_mk
SAL@lnzcheckmk01:~ $ sudo grep -rli '10.100.10.74|vihweb' /etc/check_mk
SAL@lnzcheckmk01:~ $

no /etc/hostsentry exists.

Meanwhile I’m also waiting for checkMK support to reply. I see in the contract Support: 8 Stunden x 5 Tage, and I need to figure out how to contact them. I filled out the form on checkmk.de to contact me last week. Still waiting ..

10

Usually you should be able to login at:

11

thanks I could meanwhile open a case ..

12

problem solved. I had accidentally a webservice check rule with the same IP address I was not aware of

1 Like