Replace freshness and kernel_version checks

Use an updated plugin from BLSE that uses needrestart instead of manual
parsing of these elements.

roles/base/files/usr/lib/check_mk_agent/plugins/freshness

@@ -1,52 +1,103 @@
-#!/bin/bash
+#!/usr/bin/env python
 
-# Open file handle freshness check for Check_MK
+# Check for freshness of various components using needrestart
-# Installed by PVC ansible
 
-OK=0
+import subprocess
-WARNING=1
+import re
+import json
 
-FRESHNESS="$( lsof -Fcftn / 2>/dev/null | grep -v '/tmp' | \
+try:
-awk '
+    nrout = subprocess.run(["/usr/sbin/needrestart", "-b"], timeout=5, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-{
+except subprocess.TimeoutExpired:
-    field=substr($0,1,1);
+    exit(2)
-    data=substr($0,2);
+except Exception:
-    if (field=="f") {
+    exit(1)
-        file_descriptor=data;
+
-    } else if (field=="t") {
+stdout = nrout.stdout.decode("ascii").split('\n')
-        file_type=data;
+stderr = nrout.stdout.decode("ascii").split('\n')
-    } else if (field=="c") {
+
-        command_name=data;
+# Output data structure after parsing needrestart output
-    } else if (field=="n" && file_descriptor=="DEL" && file_type=="REG") {
+data = {
-        name=data;
+    'kernel': {
-        file[command_name]++;
+        'current': None,
-    }
+        'pending': None,
+        'state': 0,
+    },
+    'microcode': {
+        'current': None,
+        'pending': None,
+        'state': 0,
+    },
+    'services': {
+        'count': 0,
+        'list': list(),
+    },
+    'containers': {
+        'count': 0,
+        'list': list(),
+    },
+    'sessions': {
+        'count': 0,
+        'list': list(),
+    },
 }
-END {
-    for (name in file) {
-        error++;
-    # Skip these problematic programs
-    if (name=="systemd-udevd") { continue; }
-    if (name=="pulseaudio") { continue; }
-    if (name=="light-locker") { continue; }
-    if (name=="at-spi-bus-laun") { continue; }
-    if (name=="node") { continue; }
-    if (error_name) { error_name=error_name " " };
-        error_name=error_name name;
-    }
-    if (error_name) {
-        print error_name;
-        exit error;
-    } else {
-        exit;
-    }
-}' )";
 
-echo "<<<freshness>>>"
+# NEEDRESTART-VER: 3.4
-if [ "$FRESHNESS" ]; then
+# NEEDRESTART-KCUR: 4.19.0-6-amd64
-    echo "Applications needing restart: $FRESHNESS"
+# NEEDRESTART-KEXP: 4.19.0-20-amd64
-    exit $WARNING
+# NEEDRESTART-KSTA: 3
-else
+# NEEDRESTART-UCSTA: 2
-    echo "No applications needing restart"
+# NEEDRESTART-UCCUR: 0xb000038
-    exit $OK
+# NEEDRESTART-UCEXP: 0xb000040
-fi
+# NEEDRESTART-SVC: acpid
+# NEEDRESTART-SVC: cron
+# NEEDRESTART-SVC: irqbalance
+# NEEDRESTART-SVC: mcelog
+# NEEDRESTART-SVC: munin-node
+# NEEDRESTART-SVC: ntp
+# NEEDRESTART-SVC: ssh
+# NEEDRESTART-SVC: syslog-ng
+# NEEDRESTART-SVC: trousers
+# NEEDRESTART-SVC: watchdog
+# NEEDRESTART-SVC: wd_keepalive
+# NEEDRESTART-CONT: LXC web1
+# NEEDRESTART-SESS: metabase @ user manager service
+# NEEDRESTART-SESS: root @ session #28017
+
+# STA:
+#  0: unknown or failed to detect
+#  1: no pending upgrade
+#  2: ABI compatible upgrade pending
+#  3: version upgrade pending
+
+for line in stdout:
+    # Kernel version
+    if re.match(r'^NEEDRESTART-KSTA', line):
+        data['kernel']['state'] = int(line.split(': ')[-1])
+    elif re.match(r'^NEEDRESTART-KCUR', line):
+        data['kernel']['current'] = line.split(': ')[-1]
+    elif re.match(r'^NEEDRESTART-KEXP', line):
+        data['kernel']['pending'] = line.split(': ')[-1]
+    # Microcode version
+    elif re.match(r'^NEEDRESTART-UCSTA', line):
+        data['microcode']['state'] = int(line.split(': ')[-1])
+    elif re.match(r'^NEEDRESTART-UCCUR', line):
+        data['microcode']['current'] = line.split(': ')[-1]
+    elif re.match(r'^NEEDRESTART-UCEXP', line):
+        data['microcode']['pending'] = line.split(': ')[-1]
+    # Services needing restart
+    elif re.match(r'^NEEDRESTART-SVC', line):
+        data['services']['count'] += 1
+        data['services']['list'].append(' '.join(line.split(': ')[1:]))
+	# Containers needing restart
+    elif re.match(f'^NEEDRESTART-CONT', line):
+        data['containers']['count'] += 1
+        data['containers']['list'].append(' '.join(line.split(': ')[1:]))
+    # Sessions needing restart
+    elif re.match(f'^NEEDRESTART-SESS', line):
+        data['sessions']['count'] += 1
+        data['sessions']['list'].append(' '.join(line.split(': ')[1:]))
+
+print("<<<freshness>>>")
+print(json.dumps(data))
+exit(0)

roles/base/files/usr/lib/check_mk_agent/plugins/kernelversion

@@ -1,14 +0,0 @@
-#!/bin/bash
-OK=0
-WARNING=1
-
-echo "<<<kernelversion>>>"
-ACTIVE="$( uname -v | awk '{ print $4" "$5 }' )"
-ONDISK="$( strings /vmlinuz | grep 'Debian' | head -1 | awk '{ print $6" "$7 }' )"
-echo ${ACTIVE}
-echo ${ONDISK}
-if [[ ${ACTIVE} != ${ONDISK} ]]; then
-    exit $WARNING
-else
-    exit $OK
-fi

roles/base/tasks/main.yml

@@ -619,7 +619,6 @@
     - entropy
     - freshness
     - ipmi
-    - kernelversion
     - ownership
   tags: base-cmkagent