Your message dated Fri, 09 Oct 2026 11:39:28 +0000
with message-id <[email protected]>
and subject line Bug#1123716: fixed in nagios4 4.5.14+ds-1
has caused the Debian Bug report #1123716,
regarding nagios4: last check time is always set to 1970; nagios constantly
rechecks all services and hosts
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1123716: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123716
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nagios4
Version: 4.4.6-4.1
Severity: important
Dear Maintainer,
The problem occurred on Armbian running on an ODROID-MC1 Solo.
I upgraded my system from bookworm to trixie, and noticed Nagios
consuming most or all available CPU resources.
I verified that the system has the correct time. Nagios itself also
shows the correct time in other contexts. Next scheduled check of each
service is near the present time.
I purged nagios4{,-cgi,-common,-conf} and my nagios configuration, then
installed nagios4 again, installed only my password database so I could
log in to the web interface, and observed the default localhost entry.
It had the same condition, with last check reported as 1970, and next
check scheduled in the present. So I don't think this is a problem with
my particular configuration.
I performed a clean install of trixie and ran my deployment scripts to
redeploy nagios with my old configuration. The issue persisted. So I
don't think this is a result of the OS upgrade.
I configured bookworm package sources and installed the version of
nagios4 from bookworm (which brought along nagios4-{cgi,common,core}
from bookworm) and adjusted apt pinning to keep it there for now. The
system is otherwise on trixie. nagios4 is at version 4.4.6-4, and the
problem is not happening. Last check times are shown in the present
year, and Nagios is not thrashing the CPUs. The problem seems specific
to nagios4 version 4.4.6-4.1.
While the newer package was installed and the problem was ongoing, I set
debug_level=16 ("Host/service checks") and debug_verbosity=2 ("Very
detailed") in nagios.cfg. /var/log/nagios4/nagios.debug received a
rapid stream of messages. I am pasting an excerpt below. I notice that
for each service check, there is a line saying, "Rescheduling next check
of service", which specifies a time in 1970, followed by a line saying,
"Scheduling a non-forced, active check of service", which specifies a
time near the present.
Other than that, I notice both the incorrect timestamps in the log and
the "last checked" entries in the web interface seem to be specifically
in late February and early March of 1970, not right on the epoch.
I will be happy to engage the broken version and gather more logs, if
that helps. Just let me know what you want to see.
[0.1766210301] [000.803042] [pid=0] Parsing check output...
Short Output: Debian update: Critical! Last update returned 1 at 13 hours, 17
minutes, and 38 seconds ago.
Long Output: NULL
Perf Data: NULL
[0.1766210301] [000.803067] [pid=0] Service is in a non-OK state!
[0.1766210301] [000.803087] [pid=0] Host is currently UP, so we'll recheck its
state to make sure...
[0.1766210301] [000.803106] [pid=0] Service not ok, host is up, using cached
host data
[0.1766210301] [000.803128] [pid=0] Service was NOT OK at last check (CRITICAL).
[0.1766210301] [000.803148] [pid=0] Service is still in a non-OK state
(CRITICAL)!
[0.1766210301] [000.803167] [pid=0] Service state type is hard, sending a
notification
[0.1766210301] [000.803187] [pid=0] Checking service 'Debian update' on host
'synapse' for flapping...
[0.1766210301] [000.803208] [pid=0] LFT=5.00, HFT=20.00, CPC=0.00, PSC=0.00%
[0.1766210301] [000.803244] [pid=0] Service is not flapping (0.00% state
change).
[0.1766210301] [000.803268] [pid=0] Checking host 'synapse' for flapping...
[0.1766210301] [000.803291] [pid=0] LFT=5.00, HFT=20.00, CPC=0.00, PSC=0.00%
[0.1766210301] [000.803321] [pid=0] Host is not flapping (0.00% state change).
[0.1766210301] [000.803412] [pid=0] Rescheduling next check of service at Sun
Mar 8 05:54:12 1970
[0.1766210301] [000.803522] [pid=0] Scheduling a non-forced, active check of
service 'Debian update' on host 'synapse' @ Sat Dec 20 00:58:21 2025
[0.1766210301] [000.803554] [pid=0] Scheduling new service check event.
[0.1766210301] [000.803662] [pid=0] STATE: 2, TYPE: HARD, CUR: 5, MAX: 5,
LAST_STATE: 2, LAST_HARD: 2, NOTIFY: 1, LOGGED: 0, HANDLED: 0
[0.1766210301] [000.803770] [pid=0] Attempting to run scheduled check of
service 'Debian update' on host 'synapse': check options=0, latency=0.000192
[0.1766210301] [000.803859] [pid=0] Checking service 'Debian update' on host
'synapse'...
[0.1766210301] [000.803903] [pid=0] Raw Command Input:
/usr/local/bin/check_debian_update $HOSTADDRESS$
[0.1766210301] [000.803926] [pid=0] Expanded Command Output:
/usr/local/bin/check_debian_update $HOSTADDRESS$
[0.1766210301] [000.860666] [pid=0] Processing check result for service
'HTTP+SSL' on host 'gateway'
[0.1766210301] [000.860732] [pid=0] ** Handling ACTIVE async check result for service 'HTTP+SSL' on host 'gateway' from 'Core Worker 17150'... current state 0 last_hard_state 0
[0.1766210301] [000.860751] [pid=0] * OPTIONS: 0, SCHEDULED: 1, RESCHEDULE: 1, EXITED OK: 1, RETURN CODE: 0, OUTPUT:
HTTP OK: HTTP/1.1 200 OK - 715 bytes in 0.106 second response time
|time=0.106101s;;;0.000000;10.000000 size=715B;;;0;
[0.1766210301] [000.860777] [pid=0] Parsing check output...
Short Output: HTTP OK: HTTP/1.1 200 OK - 715 bytes in 0.106 second response time
Long Output: NULL
Perf Data: time=0.106101s;;;0.000000;10.000000 size=715B;;;0;
[0.1766210301] [000.860794] [pid=0] Service is OK
[0.1766210301] [000.860810] [pid=0] Service was OK at last check.
[0.1766210301] [000.860825] [pid=0] Service is still OK.
[0.1766210301] [000.860842] [pid=0] Checking service 'HTTP+SSL' on host
'gateway' for flapping...
[0.1766210301] [000.860860] [pid=0] LFT=5.00, HFT=20.00, CPC=0.00, PSC=0.00%
[0.1766210301] [000.860946] [pid=0] Service is not flapping (0.00% state
change).
[0.1766210301] [000.860967] [pid=0] Checking host 'gateway' for flapping...
[0.1766210301] [000.860989] [pid=0] LFT=5.00, HFT=20.00, CPC=0.00, PSC=0.00%
[0.1766210301] [000.861011] [pid=0] Host is not flapping (0.00% state change).
[0.1766210301] [000.861077] [pid=0] Rescheduling next check of service at Mon
Mar 9 01:51:00 1970
[0.1766210301] [000.861170] [pid=0] Scheduling a non-forced, active check of
service 'HTTP+SSL' on host 'gateway' @ Sat Dec 20 00:58:21 2025
[0.1766210301] [000.861196] [pid=0] Scheduling new service check event.
[0.1766210301] [000.861221] [pid=0] STATE: 0, TYPE: HARD, CUR: 1, MAX: 5,
LAST_STATE: 0, LAST_HARD: 0, NOTIFY: 0, LOGGED: 0, HANDLED: 0
[0.1766210301] [000.861298] [pid=0] Attempting to run scheduled check of
service 'HTTP+SSL' on host 'gateway': check options=0, latency=0.000083
[0.1766210301] [000.861359] [pid=0] Checking service 'HTTP+SSL' on host
'gateway'...
[0.1766210301] [000.861385] [pid=0] Raw Command Input:
/usr/lib/nagios/plugins/check_http --ssl -H '$HOSTADDRESS$' -I '$HOSTADDRESS$'
'$ARG1$'
[0.1766210301] [000.861403] [pid=0] Expanded Command Output:
/usr/lib/nagios/plugins/check_http --ssl -H '$HOSTADDRESS$' -I '$HOSTADDRESS$'
'$ARG1$'
[0.1766210301] [000.876401] [pid=0] Processing check result for service 'Tor
system service' on host 'neuron-mail'
[0.1766210301] [000.876533] [pid=0] ** Handling ACTIVE async check result for service 'Tor system service' on host 'neuron-mail' from 'Core Worker 17147'... current state 0 last_hard_state 0
[0.1766210301] [000.876566] [pid=0] * OPTIONS: 0, SCHEDULED: 1, RESCHEDULE: 1, EXITED OK: 1, RETURN CODE: 0, OUTPUT:
"service 'tor' status" returned 0.
-- System Information:
Debian Release: 13.2
APT prefers stable
APT policy: (990, 'stable'), (500, 'stable-updates'), (500,
'oldstable-updates'), (500, 'oldstable')
Architecture: armhf (armv7l)
Kernel: Linux 6.6.113-current-odroidxu4 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
set to en_US.UTF-8), LANGUAGE=en_US.UTF-8
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages nagios4 depends on:
ii nagios4-cgi 4.4.6-4.1
ii nagios4-common 4.4.6-4.1
ii nagios4-core 4.4.6-4.1
nagios4 recommends no packages.
Versions of packages nagios4 suggests:
pn nagios-nrpe-plugin <none>
-- no debconf information
--
Aaron Bugher
--- End Message ---
--- Begin Message ---
Source: nagios4
Source-Version: 4.5.14+ds-1
Done: Russell Stuart <[email protected]>
We believe that the bug you reported is fixed in the latest version of
nagios4, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Russell Stuart <[email protected]> (supplier of updated nagios4
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 19:35:18 +1000
Source: nagios4
Architecture: source
Version: 4.5.14+ds-1
Distribution: unstable
Urgency: high
Maintainer: Russell Stuart <[email protected]>
Changed-By: Russell Stuart <[email protected]>
Closes: 1063514 1119147 1121618 1123716 1144495 1145888
Changes:
nagios4 (4.5.14+ds-1) unstable; urgency=high
.
* New upstream release (4.5.14).
* Fixes reflected XSS in cmd.cgi via NagFormId (CVE-2026-48550),
CSRF protection bypass via a self-supplied double-submit cookie
(CVE-2026-48551), DOM XSS in jsonquery.js (CVE-2026-48552),
authenticated RCE via custom-variable macro injection
(CVE-2026-48553) and authenticated RCE via NOTIFICATION-family
macro substitution (CVE-2026-48554). Closes: #1144495.
* Fixes the CSRF cookie bypass when no Cookie header is sent
(CVE-2026-48549). Closes: #1145888.
* The daemon no longer contacts api.nagios.org by default, so it no
longer segfaults parsing the reply. Closes: #1119147.
* Upstream 4.5.10 fixed the 64-bit time_t printf in lib/worker.c that
made every check time land in 1970 on armhf. Closes: #1123716.
* Upstream 4.5.4 fixed the View Trends and View Alert Histogram links.
Closes: #1063514.
* Ship config.inc.php as a conffile in /etc/nagios4, symlinked into the
htdocs directory, so paths can be overridden locally. Closes: #1121618.
* Make apache2 read /etc/nagios4/apache2.conf.
* debian/watch: track upstream's GitHub tags, since SourceForge has
carried no release since 4.5.9.
* Rename 90_turn-off-use-authentication.path to .patch.
* debian/rules: remove base/wpres-phash.h, include/Makefile and
include/ignored_config.h in clean, so a second build in the same
tree does not abort on unexpected upstream changes.
Checksums-Sha1:
5ce88dfad6b8cff59c47b36fff45143c83094b95 2023 nagios4_4.5.14+ds-1.dsc
62b1ccea513d50cdd4b2f71216226d17da80ba6c 1802612 nagios4_4.5.14+ds.orig.tar.xz
c47ee33c2b95e6c519e72ed7cca16da88688dc94 23860
nagios4_4.5.14+ds-1.debian.tar.xz
51abf1ad6bc6abce51ac88b05853b80c144756ed 10470
nagios4_4.5.14+ds-1_amd64.buildinfo
Checksums-Sha256:
d1a6916b89267b1f13b9b25e224323d8dd6651bcb615f39f9b55b89ddad736bb 2023
nagios4_4.5.14+ds-1.dsc
de0633bfe18ff66cf34d00a1534a832620140b2b23802feeefab16014d55544d 1802612
nagios4_4.5.14+ds.orig.tar.xz
4f8a19055a2b4071e9e7cc8fd6fbe5c21072a10774905bd9a0b5a1eab9b693a5 23860
nagios4_4.5.14+ds-1.debian.tar.xz
95b21b380107b1eaf6752af6f83f139b5a6067377ba83b75ab70c7b5e3eb80b5 10470
nagios4_4.5.14+ds-1_amd64.buildinfo
Files:
d97f4df47921da61f67d659fd82d5955 2023 net optional nagios4_4.5.14+ds-1.dsc
de659d5488dfb0084e0bbd21be4d1a94 1802612 net optional
nagios4_4.5.14+ds.orig.tar.xz
35d4f60e430d52a29e24e2250c1874a0 23860 net optional
nagios4_4.5.14+ds-1.debian.tar.xz
4e36dc84b5e8467ddc32f777a7c8e88b 10470 net optional
nagios4_4.5.14+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZqiOeH6lCkTWvjmorNSfiF5UUm4FAmrIy1sACgkQrNSfiF5U
Um5k8A//eYOSHCaksdSnnslTzdOKnaYFmEkxVt13Nq6TJuUu0o9rnJSajcPS/ykh
rrZsTNEmxMujsOqpaq/uZSpD7HAftqHVzrmHkeFc+MDSjedgoSi1FawuokisWtmb
brZAj6CCVRpSbt1ShCiqvBLHpEUiachSDukFrb8satUs4aOfRmDQTVZUyDWU9q4u
VIg8BkQgHBpIVfYRms9ncrOBr4IP7yScN4+7quJXexVVqdzk4U6ClW5bpi7rTcFn
F/DPQnTiTPRwSO8CDUApExZFrhp56wfKTwJnVN95iqcVcMtq5GERiTFS3xy/uTwR
5kh9adgAeoUuWjByJrVNq41vpr7KE5hQniUhOLvK8yyl56E8apP68VUVDZklOlIr
WvwQCm+ZcTtHxpLr6wj0JelOwTnGKi7e6R7JlYI5aA1RleIrZiQ2Av4cBcBpv5lZ
8mD2VOuVglS+2Q/SxDw5dHZGaVSeM5yUPkxgu3tSGOjiwmmaNci5slvaWL9Nglb5
qdtAy6+yZ6Uf15aZ19wR3yX/66BJndIH1mDkKScMRg2iUYmYKvoh6+bd8R/rQe2N
Zxwe7ypgQwKkkSMQsU/jJOBDBHmR+Jd88ytxjmiqE0LidM1eVqMVW87+wbt2EoTU
ewK0lJM2Gv/Mdo1DyflcI8h8vb3uG9hzH8Ddalt8ck2HTq52+QU=
=0RPa
-----END PGP SIGNATURE-----
pgpbTcDKxGMry.pgp
Description: PGP signature
--- End Message ---
