Hello, On Fri, May 08, 2026 at 11:56:21PM +0200, Uwe Kleine-König wrote: > Package: monitoring-plugins-basic > Version: 2.4.0-3+deb13u1 > Severity: normal > File: /usr/lib/nagios/plugins/check_apt > X-Debbugs-Cc: [email protected] > > Hello, > > I currentently experience: > > root@quarterberry:~# /usr/lib/nagios/plugins/check_apt > APT OK: 0 packages available for upgrade (0 critical updates). > |available_upgrades=0;;;0 critical_updates=0;;;0 > root@quarterberry:~# apt list --upgradable > linux-image-arm64/stable-security 6.12.86-1 arm64 [upgradable from: > 6.12.85-1] > Notice: There are 2 additional versions. Please use the '-a' switch to > see them. > > and so icinga doesn't notify me about the pending upgrade. > > I would expect that check_apt detects that as a critical update.
As I hit this problem today again, I debugged a bit. The reason this
fails is that (by default) check_apt calls `/usr/bin/apt-get -o
Debug::NoLocking=true -s -qq upgrade`. When removing the -qq (to make
apt-get a bit more talkative) I get today:
root@quarterberry:~# /usr/bin/apt-get -o Debug::NoLocking=true -s
upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
linux-image-arm64
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.
so linux-image-arm64 is kept back as it introduces new dependant
packages. With dist-upgrade the kernel isn't kept back.
check_apt can be made to use dist-upgrade instead of upgrade using `-d`.
I wonder if that would be the saner default.
Best regards
Uwe
signature.asc
Description: PGP signature
