--- check_mk_agent.orig	2025-05-05 10:56:09.000000000 +0200
+++ check_mk_agent	2025-05-12 09:45:44.974700612 +0200
@@ -1217,17 +1217,56 @@
 section_omd() {
     if inpath omd; then
         # 60 is _probably_ the agents polling interval. Why would you use that??
-        _run_cached_internal "omd_status" 60 60 180 120 "echo '<<<omd_status>>>'; ${ROOT_OR_SUDO} omd status --bare || true"
+        _run_cached_internal "omd_status" 60 60 180 120 "echo '<<<omd_status>>>'; omd status --bare || true"
 
         ${MK_RUN_SYNC_PARTS} || return
 
+        echo '<<<mknotifyd:sep(0)>>>'
+        get_epoch
+        for statefile in /omd/sites/*/var/log/mknotifyd.state; do
+            if [ -e "${statefile}" ]; then
+                site=${statefile%/var/log*}
+                site=${site#/omd/sites/}
+                echo "[${site}]"
+                grep -v '^#' <"${statefile}"
+            fi
+        done
+
+        echo '<<<omd_apache:sep(124)>>>'
+        for statsfile in /omd/sites/*/var/log/apache/stats; do
+            if [ -e "${statsfile}" ]; then
+                site=${statsfile%/var/log*}
+                site=${site#/omd/sites/}
+                echo "[${site}]"
+                cat "${statsfile}"
+                : >"${statsfile}"
+                # prevent next section to fail caused by a missing newline at the end of the statsfile
+                echo
+            fi
+        done
+
+        _du_no_errors() {
+            if [ -e "${1}" ]; then
+                output=$(du -bs "$1") && printf "%s\n" "${output}"
+            else
+                printf "0 %s\n" "${1}"
+            fi
+        }
+
+        echo '<<<omd_diskusage:sep(0)>>>'
         for sitedir in /omd/sites/*; do
-            site_version="$(basename "$(realpath "${sitedir}/version")")"
             site=${sitedir#/omd/sites/}
-            for topic in "broker" "mknotifyd" "apache" "diskusage"; do
-                script="/omd/versions/${site_version}/bin/cmk-monitor-${topic}"
-                [ -x "${script}" ] && sudo --non-interactive --user="${site}" "${script}"
-            done
+            echo "[site ${site}]"
+            _du_no_errors "$sitedir"
+            _du_no_errors "$sitedir/var/log"
+            _du_no_errors "$sitedir/var/check_mk/rrd"
+            _du_no_errors "$sitedir/var/pnp4nagios/"
+            _du_no_errors "$sitedir/tmp/"
+            _du_no_errors "$sitedir/local/"
+            _du_no_errors "$sitedir/var/check_mk/agents/"
+            _du_no_errors "$sitedir/var/mkeventd/history/"
+            _du_no_errors "$sitedir/var/check_mk/core/"
+            _du_no_errors "$sitedir/var/check_mk/inventory_archive/"
         done
 
         echo '<<<omd_info:sep(59)>>>'
@@ -1293,12 +1332,114 @@
 }
 
 section_omd_core() {
-    for sitedir in /omd/sites/*; do
-        site_version="$(basename "$(realpath "${sitedir}/version")")"
-        site=${sitedir#/omd/sites/}
-        script="/omd/versions/${site_version}/bin/cmk-monitor-core"
-        [ -x "${script}" ] && sudo --non-interactive --user="${site}" "${script}"
-    done
+    (
+        cd /omd/sites || return
+
+        # The files within a site are site-user writable! Therefore we must not use them!
+        # The version files are only root writable so we can use them instead.
+        site_version() {
+            printf "%s" "$(realpath "${1}/version" | sed 's|.*/||')"
+        }
+
+        site_cmd() {
+            # DO NOT ACCESS /omd/sites/${site}/bin/cmd directly.
+            # bin might point anywhere -> priv escalation.
+            printf "/omd/versions/%s/bin/%s" "$(site_version "${1}")" "${2}"
+        }
+
+        site_lib() {
+            printf "/omd/versions/%s/lib" "$(site_version "${1}")"
+        }
+
+        waitmax_for_unixcat_with_site_ld_library_path() {
+            LD_LIBRARY_PATH="$(site_lib "${2}"):${LD_LIBRARY_PATH}" waitmax "${1}" "$(site_cmd "${2}" unixcat)" "/omd/sites/${2}/tmp/run/${3}"
+        }
+
+        echo '<<<livestatus_status:sep(59)>>>'
+        for site in *; do
+            if [ -S "/omd/sites/${site}/tmp/run/live" ]; then
+                echo "[${site}]"
+                echo "GET status" |
+                    waitmax_for_unixcat_with_site_ld_library_path 3 "${site}" "live"
+            fi
+        done
+
+        echo '<<<livestatus_ssl_certs:sep(124)>>>'
+        for site in *; do
+            echo "[${site}]"
+            for PEM_PATH in "/omd/sites/${site}/etc/ssl/ca.pem" "/omd/sites/${site}/etc/ssl/sites/${site}.pem"; do
+                if [ -f "${PEM_PATH}" ]; then
+                    CERT_DATE=$(openssl x509 -enddate -noout -in "${PEM_PATH}" | sed 's/notAfter=//')
+                    echo "${PEM_PATH}|$(date --date="${CERT_DATE}" --utc +%s)"
+                fi
+            done
+        done
+
+        echo '<<<mkeventd_status:sep(0)>>>'
+        for site in *; do
+            if [ -S "/omd/sites/${site}/tmp/run/mkeventd/status" ]; then
+                echo "[\"${site}\"]"
+                (echo "GET status" && echo "OutputFormat: json") |
+                    waitmax_for_unixcat_with_site_ld_library_path 3 "${site}" "mkeventd/status"
+            fi
+        done
+
+        echo '<<<cmk_site_statistics:sep(59)>>>'
+        for site in *; do
+            if [ -S "/omd/sites/${site}/tmp/run/live" ]; then
+                echo "[${site}]"
+                waitmax_for_unixcat_with_site_ld_library_path 5 "${site}" "live" <<LimitString
+GET hosts
+Stats: state = 0
+Stats: scheduled_downtime_depth = 0
+StatsAnd: 2
+Stats: state = 1
+Stats: scheduled_downtime_depth = 0
+StatsAnd: 2
+Stats: state = 2
+Stats: scheduled_downtime_depth = 0
+StatsAnd: 2
+Stats: scheduled_downtime_depth > 0
+Filter: custom_variable_names < _REALNAME
+LimitString
+                waitmax_for_unixcat_with_site_ld_library_path 5 "${site}" "live" <<LimitString
+GET services
+Stats: state = 0
+Stats: scheduled_downtime_depth = 0
+Stats: host_scheduled_downtime_depth = 0
+Stats: host_state = 0
+Stats: host_has_been_checked = 1
+StatsAnd: 5
+Stats: scheduled_downtime_depth > 0
+Stats: host_scheduled_downtime_depth > 0
+StatsOr: 2
+Stats: scheduled_downtime_depth = 0
+Stats: host_scheduled_downtime_depth = 0
+Stats: host_state != 0
+StatsAnd: 3
+Stats: state = 1
+Stats: scheduled_downtime_depth = 0
+Stats: host_scheduled_downtime_depth = 0
+Stats: host_state = 0
+Stats: host_has_been_checked = 1
+StatsAnd: 5
+Stats: state = 3
+Stats: scheduled_downtime_depth = 0
+Stats: host_scheduled_downtime_depth = 0
+Stats: host_state = 0
+Stats: host_has_been_checked = 1
+StatsAnd: 5
+Stats: state = 2
+Stats: scheduled_downtime_depth = 0
+Stats: host_scheduled_downtime_depth = 0
+Stats: host_state = 0
+Stats: host_has_been_checked = 1
+StatsAnd: 5
+Filter: host_custom_variable_names < _REALNAME
+LimitString
+            fi
+        done
+    )
 }
 
 section_mkbackup() {