syscheck 3.0

Key Highlights & Architectural Changes

##. New Container-Based Python Test Suite

• Full Coverage Suite: Added end-to-end containerized pytest test suites for 40+ scripts (covering both scripts-available/ and related-available/).
• Ansible Role Validation: Implemented an automated rendering compiler test (test_ansible_templates.py) to validate all Jinja2 configuration templates, ensuring zero UndefinedError or syntax bugs exist under the henrikandreasson namespace.
• Automated Playbook Execution Tests: Integrated a live, automated syntax check and localized playbook execution test (test_ansible_playbook_run.py) to verify role installation steps against mock targets inside Docker.

Transition to Ansible Collections Layout

• Collection Packaging: Restructured the repository's Ansible assets to comply with the modern Ansible Collections structure. Added galaxy.yml to define the henrikandreasson.syscheck namespace and metadata.
• Modernized Playbook Structure: Relocated the default deployment playbook and shared variables into a cleaner layout at misc/ansible/playbooks/playbook-syscheck.yml and misc/ansible/playbooks/common_vars.yml.
• FQCN Integration: Migrated playbook role executions to use Fully Qualified Collection Names (FQCN) as henrikandreasson.syscheck.syscheck.
• Playbook Portability: Improved role deployment tasks to skip RPM-specific (yum) operations and cron configurations gracefully when deploying on non-RedHat or minimalist environments.

---

🌟 Special Thanks to linusm-boom

A major portion of this release's structural and stability improvements was driven by the excellent work of linusm-boom.

Summary of linusm-boom's Contributions:

• sc_39 SafeNet HSM Overhaul: Rewrote the SafeNet Luna HSM integration from scratch, adding native support for Luna7, Crypto Officer activation tracking, battery level margin testing, and temperature warnings.
• sc_17 Time Sync Rework: Re-engineered the NTP offsets verification check to migrate away from obsolete ntpd daemons, replacing it with support for modern chrony and timesyncd engines.
• Database Backup and Dumps (904): Fixed duplicate execution bugs inside database backup hooks and significantly refactored SQL dump commands to be robust and fail-safe.
• Hardware RAID validation (sc_35): Fixed a critical logical drive assessment bug where any disk status would be evaluated as healthy.
• Plumbing and Scripting Fixes:
  • Standardized warn/error log thresholds and messaging structures for HP server health checks (sc_31), receipts checks (sc_42), and JNLP monitoring (sc_33).
  • Added robust validation to gracefully handle command line crashes and piped output failures during runtime database connection sessions.
  • Rectified system python shebangs across files to ensure cross-platform compatibility.

---

🔧 Core and Related Script Improvements

sc_03 Memory Usage Check

• Added robust fallback parsing and defaults for MEM_PERCENT and SWAP_PERCENT configurations (falling back to 80 and 50 respectively) if values are empty or non-numeric.
• Implemented dynamic platform portability detection to gracefully downgrade to standard raw KB formatting and re-evaluate translations if the GNU numfmt utility is missing on minimal hosts (e.g. Alpine/BusyBox).

sc_02 & sc_37 Health Check and JNLP Monitoring

• Integrated safe tool verification checks to force immediate exit (exit 1) if an invalid checking tool is configured, preventing cascading false-positive exceptions.
• Fixed argument alignment and SCRIPTINDEX increment order.

sc_12, sc_39 & sc_40 Process and Hardware Checks

• HSM Health check (sc_39): Overhauled sc_39 to correctly parse parentheticals out of standard slot set output strings. Removed redundant slot list workarounds.
• DB Process checks (sc_12/sc_40): Standardized MySQL and MariaDB process monitoring patterns. Changed default process search arguments to 'mysqld|mariadbd' using standard egrep filters to dynamically support both original MySQL and modern MariaDB installations out of the box.

sc_38 MySQL Connections Check

• Swapped mismatched error numbers to align with standard alert models, ensuring connections failures report ERRNO[3] and max connections variable failures report ERRNO[2].
• Mapped WARN_PERCENT warnings to $WARN status to prevent false alarm logging under $ERROR.

Related Scripts (900 - 941 backup & transfer utilities)

• 905 / 925 publication checks: Migrated legacy positional argument parsing to structured named options on 905 and 925 to prevent syntax crashes.
• 907 Backup & Transfer: Fixed outcome logging arguments to capture file paths and host destinations in messages to avoid ambiguity on multi-host transfers.
• 931 / 933 / 938 / 940 MariaDB/S3 Utilities: Standardized syntax checks, parameterized variables, and validated execution paths to guarantee robust, error-free database queries, physical mariabackups, and S3-compatible cloud transfers.

---

🗑️ Summary of Removed Assets

To focus on core functionality and ensure high maintainability, the following obsolete, legacy, or unmaintained assets were removed from the codebase:

• Legacy Test Frameworks: Completely deleted the unmaintained bash test framework test/bats-core/..., obsolete BATS runner scripts (test/run-test.sh), and dynamic test-generators (test/gen_test_bats.sh, test/gen_help_bats.sh).
• Obsolete sc_ checks (and associated configs/locales):
  • sc_22_boks_replica.sh (obsolete replication check)
  • sc_23_rsa_axm.sh (obsolete authentication manager check)
  • sc_27_dss.sh (obsolete document signing check)
  • sc_29_signserver.sh (obsolete signing server check)
  • sc_41_ra_verifier.sh (obsolete registration authority check)
  • sc_43_rittal_rack_sensors.sh (obsolete environmental sensors check)
• Obsolete Related scripts:
  • 903_make_hsm_backup.sh (obsolete HSM backup script)
  • 913_copy_ejbca_conf.sh & 921_copy_htmf_conf.sh (obsolete file-copy sync checks)
  • 914_compare_master_slave_db.sh (obsolete replication consistency checker)
  • 918_server_alive.sh (obsolete heartbeat check)
  • 923_rsync-to-remote-machine.sh & 924_backup-this-machine-to-remote-machine.sh (unneeded replication scripts)
  • 926_local_htmf_copy_conf.sh (obsolete backup script)
  • 928_check_dsm_backup.sh (obsolete Tivoli storage manager check)
  • 935_mysql_console_as_root.sh & 936_mysql_console_as_db_user.sh (unused interactive console wrappers)
  • 937_delete_old_CRLData.sh & 939_delete_old_elastic_index.sh (obsolete maintenance scripts)

syscheck-2.10 - maint rel 2026

What's Changed

• Fix sc 03 by @Skygfisk in #117
• Updated 934 so warning threshold works correctly by @Skygfisk in #119
• small updates for bugs by @abero-henrik in #120

New Contributors

• @Skygfisk made their first contribution in #117
• @abero-henrik made their first contribution in #120

Full Changelog: v2.9...syscheck-2.10

Release v2.9

Release Notes for v2.9

This release includes the latest deb package.

syscheck-2.8

What's Changed

• updates for HP-healthcheck by @linusm-boom in #106
• update 931 with support for multiple target nodes with same storage by @linusm-boom in #108
• add summary for Icinga to 06 raidcheck by @linusm-boom in #109

New Contributors

• @linusm-boom made their first contribution in #106

Full Changelog: syscheck-2.7...syscheck-2.8

switch 906 to hash instead of df

to make sure file is transferred ok.

credits linus m, da man

Fix for 906

syscheck-2.6

fix by da linus

Syscheck with two small fixes discusage and the new https cert checker

syscheck-2.5

add verbose print of cert info and fox connect string

Maint release syscheck

Lots of smaller fixes

• fix warn limit in 01 diskusage
• replace tempfile with mktemp in 934
• loop through files after backups in 907 and 931
• new script to check https server certificates - closes #102

Updated mariabackup

Merge pull request #101 from falleri/master

938

rittal sensors, elastich seach index delete and mariadb jobs

• new script to probe rittal sensors closes #95 - contrib by mats b.
• new script to delete old index (data) in elasticsearch - closes #92 - contrib by mats b.
• updates of 938_mariabackup - contrib by mats b.
• Script to run jobs (eg. stored procedures) in mariadb - Closes #91