[Pkg-nagios-devel] Bug#1136062: check_apt doesn't detect a pending (critical) update

[Uli Martens]

Hey Uwe,

disclaimer: I'm not involved in this package, just another user.

I think you should switch your monitoring to call check_apt with the -d 
flag for --dist-upgrade:

  -d, --dist-upgrade=OPTS
     Perform a dist-upgrade instead of normal upgrade. Like with -U OPTS
     can be provided to override the default options.

check_apt does not show you the linux-image-arm64 package as upgradable 
when called without that flag, because it's not actually upgradable. The 
lnux-image-arm64 package depends on the latest kernel image, which you 
will not yet have installed. You need to allow apt-get to (consider) 
install(ing) new packages to see the pending kernel update:

root at node01 ~ # /usr/lib/nagios/plugins/check_apt
APT OK: 0 packages available for upgrade (0 critical updates). 
|available_upgrades=0;;;0 critical_updates=0;;;0
root at node01 ~ # apt-get upgrade -s -qq
root at node01 ~ #

vs

root at node01 ~ # /usr/lib/nagios/plugins/check_apt -d
APT CRITICAL: 2 packages available for dist-upgrade (2 critical 
updates). |available_upgrades=2;;;0 critical_updates=2;;;0
root at node01 ~ # apt-get dist-upgrade -s -qq
Inst linux-image-6.12.86+deb13-amd64 (6.12.86-1 
Debian-Security:13/stable-security [amd64])
Inst linux-image-amd64 [6.12.85-1] (6.12.86-1 
Debian-Security:13/stable-security [amd64])
Conf linux-image-6.12.86+deb13-amd64 (6.12.86-1 
Debian-Security:13/stable-security [amd64])
Conf linux-image-amd64 (6.12.86-1 Debian-Security:13/stable-security 
[amd64])
root at node01 ~ #

yours,
    Uli



On 5/8/26 23:56, Uwe Kleine-König wrote:
> Package: monitoring-plugins-basic
> Version: 2.4.0-3+deb13u1
> Severity: normal
> File: /usr/lib/nagios/plugins/check_apt
> X-Debbugs-Cc: ukleinek at debian.org
> 
> Hello,
> 
> I currentently experience:
> 
> 	root at quarterberry:~# /usr/lib/nagios/plugins/check_apt
> 	APT OK: 0 packages available for upgrade (0 critical updates). |available_upgrades=0;;;0 critical_updates=0;;;0
> 	root at quarterberry:~# apt list --upgradable
> 	linux-image-arm64/stable-security 6.12.86-1 arm64 [upgradable from: 6.12.85-1]
> 	Notice: There are 2 additional versions. Please use the '-a' switch to see them.
> 
> and so icinga doesn't notify me about the pending upgrade.
> 
> I would expect that check_apt detects that as a critical update.
> 
> Best regards
> Uwe
> 
> -- System Information:
> Debian Release: 13.4
>    APT prefers stable-updates
>    APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
> Architecture: arm64 (aarch64)
> 
> Kernel: Linux 6.12.85+deb13-arm64 (SMP w/4 CPU threads)
> Kernel taint flags: TAINT_CRAP
> Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
> Shell: /bin/sh linked to /usr/bin/dash
> Init: systemd (via /run/systemd/system)
> LSM: AppArmor: enabled
> 
> Versions of packages monitoring-plugins-basic depends on:
> ii  iputils-ping               3:20240905-3
> ii  libc6                      2.41-12+deb13u2
> ii  libcurl4t64                8.14.1-2+deb13u2
> ii  libssl3t64                 3.5.5-1~deb13u2
> ii  libsystemd0                257.9-1~deb13u1
> ii  liburiparser1              0.9.8+dfsg-2
> ii  monitoring-plugins-common  2.4.0-3+deb13u1
> ii  procps                     2:4.0.4-9
> ii  ucf                        3.0052
> 
> Versions of packages monitoring-plugins-basic recommends:
> ii  libcap2-bin  1:2.75-10+b8
> 
> Versions of packages monitoring-plugins-basic suggests:
> ii  icinga2  2.14.6-1
> 
> -- no debconf information
> 
> _______________________________________________
> Pkg-nagios-devel mailing list
> Pkg-nagios-devel at alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-nagios-devel