[Release] Checkmk stable release 2.4.0p18

Announcements
, , , ,
1

Dear friends of Checkmk,

the new stable release 2.4.0p18 of Checkmk is ready for download.

This stable release ships with 21 changes affecting all editions of Checkmk,
4 changes for the Enterprise editions, 1 Cloud Edition specific and
0 Managed Services Edition specific changes.

Changes in all Checkmk Editions:

Checks & agents

  • 19060 Optimized details for clustered services…
  • 18552 check_httpv2: Add TLS compatibility mode option…
  • 18921 FIX: Check HTTP web service: Fix and improve text searches…
    NOTE: Please refer to the migration notes!
  • 18969 FIX: Cleanup discovered host label files of abandoned hosts…
  • 18347 FIX: Clustered services: Fix for disabling services…
  • 18700 FIX: Ensure new lines before and after sql based sections in mk_oracle…
  • 18597 FIX: Fix various certificate verification errors for special agents…
  • 18947 FIX: Graylog agent configuration: Re-enable macro support for instance field…
  • 18732 FIX: Improve service summary for failover aggregated clustered services…
  • 18348 FIX: Removed services during bulk discovery…
  • 18318 FIX: Solaris agent issue when encryption enabled…
  • 18479 FIX: Use fractions of seconds for VSphere System Time Offset…
  • 18884 FIX: agent_kube: Abort querying OpenShift endpoint…
  • 18596 FIX: kernel_performance: Don’t record negative number of context switches on reboot…
  • 18885 FIX: kube: KeyError: ‘user’…

Linux distributions

  • 18937 FIX: Expanded System Command Wrappers for OpenSSL Compatibility…
    NOTE: Please refer to the migration notes!

Other components

  • 19035 SEC: NagVis: Updated to 1.9.48…

Setup

  • 19030 SEC: Remote alert handlers (Linux) exposes SSH keys in rule page…
  • 18542 FIX: Improve password store management…
  • 18910 FIX: Update action: Notification parameters with custom values can now be hashable…

User interface

  • 18325 FIX: Graphs: Fix position of indicator line

Changes in the Checkmk Enterprise Edition:

Checks & agents

  • 18544 FIX: TCP Fetcher returns error if the host IP can’t be resolved…
  • 18886 FIX: mk_oracle: Fix ‘chgrp: cannot access /etc/check_mk/sqlnet.ora: No such file’…

The Checkmk Micro Core

  • 19045 FIX: Do not send notifications for soft states…
  • 17759 FIX: Fixed removal of non-sticky acknowledgements…

Changes in the Checkmk Cloud Edition:

Checks & agents

  • 18703 FIX: Prevent aws_lambda_performance crash on missing metrics…

Changes in the Checkmk Cloud (SaaS):

NO CHANGES

Changes in the Checkmk Managed Services Edition:

NO CHANGES

You can download Checkmk from our download page: Download Checkmk for free | Checkmk

List of all changes: Werks

We greatly thank you for using Checkmk and wish you a successful monitoring,

Your Checkmk Team

2025-2026 December - January Community Bulletin
2

TLS trust issues after installation on RHEL 10

We have installed a new test system on RHEL 10.
The setup works as expected on RHEL 9, but we are seeing issues on RHEL 10.

Our goal is to encrypt communication from the “Central” site to remote sites using TLS, with the option:

Encrypt data using TLS - Verify the Livestatus server certificate using the local site CA

Et bilde som inneholder tekst, programvare, Multimedieprogramvare, Grafikkprogramvare KI-generert innhold kan være feil.
Et bilde som inneholder tekst, programvare, Multimedieprogramvare, Grafikkprogramvare KI-generert innhold kan være feil.605×257 56 KB

image
image604×259 13.3 KB

Et bilde som inneholder tekst, skjermbilde, programvare, Multimedieprogramvare KI-generert innhold kan være feil.
Et bilde som inneholder tekst, skjermbilde, programvare, Multimedieprogramvare KI-generert innhold kan være feil.605×202 48.7 KB

image
image479×201 11.5 KB

Behavior on RHEL 10:

· When we initially accept the remote site certificate, the certificate becomes Trusted.

· However, as soon as we run Activate changes in Checkmk, the certificate immediately changes back to Not trusted.

It appears that Checkmk is ignoring the trusted Certificate Authorities configured under Global settings.

The only way we have been able to make this work is with the following workaround:

Copy the remote site CA manually:
from: /opt/omd/sites/test1/var/ssl/remote_sites_cas/test2.pem

to: /etc/pki/ca-trust/source/anchors/

Run command : sudo update-ca-trust extract
Then activate changes in Checkmk.

After doing this, the remote site certificate is accepted correctly.

This behavior differs from RHEL 9

3

@ladden are you using Checkmk MSP? In that case you need to keep an eye on the site specific global settings. They override the global settings for trusted certificate authorities.

Your “solution” should not be implemented, as it will probably create issues down the road.

If the issue is still present in the latest 2.4.0 release, please open a dedicated thread or ticket, if you can.