[Pkg-nagios-devel] Bug#1136062: check_apt doesn't detect a pending (critical) update

[Uwe Kleine-König]

Hello,

On Fri, May 08, 2026 at 11:56:21PM +0200, Uwe Kleine-König wrote:
> Package: monitoring-plugins-basic
> Version: 2.4.0-3+deb13u1
> Severity: normal
> File: /usr/lib/nagios/plugins/check_apt
> X-Debbugs-Cc: ukleinek at debian.org
> 
> Hello,
> 
> I currentently experience:
> 
> 	root at quarterberry:~# /usr/lib/nagios/plugins/check_apt
> 	APT OK: 0 packages available for upgrade (0 critical updates). |available_upgrades=0;;;0 critical_updates=0;;;0
> 	root at quarterberry:~# apt list --upgradable
> 	linux-image-arm64/stable-security 6.12.86-1 arm64 [upgradable from: 6.12.85-1]
> 	Notice: There are 2 additional versions. Please use the '-a' switch to see them.
> 
> and so icinga doesn't notify me about the pending upgrade.
> 
> I would expect that check_apt detects that as a critical update.

As I hit this problem today again, I debugged a bit. The reason this
fails is that (by default) check_apt calls `/usr/bin/apt-get -o
Debug::NoLocking=true -s -qq upgrade`. When removing the -qq (to make
apt-get a bit more talkative) I get today:

	root at quarterberry:~# /usr/bin/apt-get -o Debug::NoLocking=true -s upgrade
	Reading package lists... Done
	Building dependency tree... Done
	Reading state information... Done
	Calculating upgrade... Done
	The following packages have been kept back:
	  linux-image-arm64
	0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

so linux-image-arm64 is kept back as it introduces new dependant
packages. With dist-upgrade the kernel isn't kept back.

check_apt can be made to use dist-upgrade instead of upgrade using `-d`.
I wonder if that would be the saner default.

Best regards
Uwe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-nagios-devel/attachments/20260807/de2e1f27/attachment.sig>