0.14.1

[mickem]

Host security posture, JSON-aware HTTP checks, and a clearer licence

This release adds a brand-new CheckSecurity module for monitoring a host's
security posture — certificates, firewall, antivirus, BitLocker, Secure Boot,
NLA and logged-on users — and teaches check_http to assert on values inside a
JSON response body. It also fixes boolean check arguments over REST, tidies up
process aggregation and module activation, relicenses the project under a clear
dual licence, and reworks the documentation to handle Windows and Linux side by
side.

Highlights

• New CheckSecurity module. Seven new checks for host security posture:
  check_certificate, check_firewall, check_antivirus, check_bitlocker,
  check_secureboot, check_nla and check_users. check_certificate and
  check_users run everywhere; the rest are Windows-only. (Added check security #1339)
• check_http can assert on JSON responses. New json-path=alias:path
  options extract values from a JSON body into filter keywords you can threshold
  on and emit as perfdata. (Feature/check net json support #1341)
• CheckNet queries now emit performance data by default, so check_http,
  check_tcp and friends graph out of the box without an explicit perf
  syntax. (Feature/check net json support #1341)
• Boolean check arguments accept values, not just flags.
  check_ping host=www.google.com total=true now works alongside the bare-flag
  form — the form REST already used. (Boolean arguments in check command now work with values as well as as… #1338)
• Activate several modules in one command:
  nscp settings --active-module CheckSystem CheckNet. (Fix installer deleting nsclient.ini on upgrade #1329-follow-up)
• Clear dual licence. NSClient++ is now Apache-2.0 OR GPL-2.0-only, with
  machine-readable REUSE metadata and third-party notices. (Feature/license change #1343)
• Reworked, multi-OS documentation that presents Windows and Linux options
  and features together instead of assuming one platform. (Feature/multi os docs #1342)

Detailed changes

CheckSecurity — new host security-posture module

A new module, CheckSecurity (alias security), checks whether a host is in
the security state you expect. Each check is a normal modern_filter check, so
you can override the default warn/crit expressions, filter, and
detail-syntax/top-syntax as usual.

Command	Platforms	What it checks
check_certificate	All	X.509 certificate expiry / validity / hygiene from files or the Windows store
check_users	Windows + Linux	Count and detail of logged-on / RDP sessions
check_firewall	Windows only	Firewall profile (Domain/Private/Public) enabled and active state
check_antivirus	Windows only	Registered antivirus products' enabled / up-to-date state (Security Center)
check_bitlocker	Windows only	BitLocker drive-encryption protection status per volume
check_secureboot	Windows only	Whether UEFI Secure Boot is enabled (distinguishes "disabled" from "legacy")
check_nla	Windows only	Network Location Awareness category (public/private/domain) per network

check_certificate defaults to warning when a certificate expires within 30
days and critical within 10 (matching common practice), emits expires_in (whole
days until expiry) as perfdata, and can scan a whole directory:

check_certificate file=/etc/ssl/certs/mysite.pem
check_certificate file=/etc/ssl/certs recursive=true "detail-syntax=${subject}: ${expires_in}d"
check_certificate file=/etc/pki/tls/certs critical=expired=1

The Windows checks expose the raw state fields so you can tighten or relax the
default posture. check_firewall adds an active flag (which profile is
currently in effect) alongside enabled, so you can warn when a machine silently
falls back to the Public profile after a network change:

check_firewall "warn=active = 1 and profile = 'Public'" "detail-syntax=${profile} profile is active"
check_secureboot "warn=supported = 0" "crit=supported = 1 and enabled = 0"
check_nla "crit=connected = 1 and category != 'domain'" "detail-syntax=${network}=${category}"

On a platform where a Windows-only check does not apply, the check returns
UNKNOWN with a clear message rather than failing.

CheckNet — check_http JSON path extraction

check_http can now pull values out of a JSON response body and treat them as
filter keywords. Each json-path=alias:path option extracts the value at a
dotted path (numeric segments index into arrays; single-quote a segment that
itself contains a dot) and makes it available for warning=/critical=
expressions and perfdata:

check_http url=https://api.example.com/health "json-path=qlen:data.queue.length" "crit=qlen > 100"
check_http url=https://api.example.com/health "json-path=st:status" "crit=st != 'ok'"
check_http url=https://api.example.com/health "json-path=err:metrics.error_rate" "warn=err > 0.01" "crit=err > 0.05"
check_http url=https://api.example.com/health "json-path=first:items.0.name" "json-path=cfg:'a.b'.c"

Numeric values keep full precision, strings compare and render as strings, and
booleans read as 1/0. A missing path — or a body that is not valid JSON —
leaves the alias empty rather than failing the check, and multiple json-path
options can be combined freely.

CheckNet — default performance data

CheckNet queries now attach sensible performance data by default, so
check_http, check_tcp and the other network checks produce graphable
perfdata without a hand-written perf syntax. check_ntp_offset threshold
handling was also tidied up in the same change.

Check arguments — boolean options accept values

Boolean check options now accept an explicit value in addition to the bare-flag
form:

check_ping host=www.google.com total=true

Previously the value form was rejected from the CLI even though REST always
passes flags as key=true tokens, so a boolean option that worked over REST
could look broken from the command line. Both forms now behave identically.

CheckSystem — process total aggregation

check_process process-total aggregation now correctly reports the started
and hung states (on both Windows and Linux), so totals of these statuses
match what the per-process detail shows.

Settings — activate multiple modules at once

nscp settings --active-module now accepts several module names in one
invocation:

nscp settings --active-module CheckSystem CheckNet

Licensing — dual-licensed Apache-2.0 OR GPL-2.0-only

NSClient++ is now explicitly dual-licensed under Apache-2.0 OR
GPL-2.0-only. Source headers were updated to SPDX identifiers, the project
carries machine-readable REUSE metadata
(REUSE.toml, LICENSES/), and a THIRD-PARTY-NOTICES.md / NOTICE collect
the third-party licences. The installer, packaging and docs licence text were
updated to match.

Build — Python library discovery

CMake now derives the default Python library name instead of hardcoding a
version, and defaults it to the soname so the module loads without the Python
development packages installed. This makes Linux builds far less sensitive to
the exact Python version on the build and target hosts. (#1334)

Documentation

• Multi-OS reference docs. The reference documentation was reworked to
  present Windows and Linux options and features together, handling checks whose
  options diverge by platform instead of documenting a single OS. Windows docs
  were regenerated. (Feature/multi os docs #1342)
• New docs/samples/ usage examples and descriptions for every new
  CheckSecurity command and the check_http JSON feature.
• check_process docs cross-reference filter_perf for top-N processes. (docs: cross-reference filter_perf from check_process for top-N processes #1330)
• README restructured and dead files removed. (Readme and cleanup #1340)

Quality and CI

• Spelling. A codespell GitHub workflow was added and spelling errors in
  log messages and settings descriptions were fixed. (add codespell github workflow #1314, Fix some spelling errors in log messages and settings descriptions #1344)
• Live integration tests. A new opt-in test suite runs checks against a real
  VM in Azure, alongside the existing REST-driven integration tests. New
  integration tests cover CheckSecurity, the check_http JSON feature, and
  --active-module. (Added live test in azure #1335)
• Assorted build fixes for older Windows toolchains, Linux, and sanitizer runs.

Upgrade notes

• Licence change: NSClient++ is now distributed as Apache-2.0 OR
  GPL-2.0-only. This is a clarification/relicensing — review it if your
  organisation tracks the exact licence of bundled software. No code or runtime
  behaviour changes as a result.
• CheckNet perfdata is now on by default. Network checks emit performance
  data without an explicit perf syntax. If you were adding perfdata manually,
  double-check you are not now emitting it twice; graphs that previously showed
  nothing will start populating.
• Boolean check arguments: option=true / option=false now work from the
  CLI as well as over REST. Existing bare-flag usage is unchanged.
• CheckSecurity is not loaded by default. Enable it before using the new
  checks, e.g. nscp settings --active-module CheckSecurity. Windows-only
  checks return UNKNOWN on other platforms rather than erroring.

Full Changelog: 0.14.0...0.14.1

---

This discussion was created from the release 0.14.1.