/
Troubleshooting missing site sections in the Checkmk agent output caused by the sudo requiretty option

Troubleshooting missing site sections in the Checkmk agent output caused by the sudo requiretty option

This article explains how to resolve missing site-related agent sections caused by the sudo requiretty option.

LAST TESTED ON CHECKMK 2.4.0P33

Table of Contents

Overview

On systems hosting a Checkmk site, several site-related agent sections may be missing when the agent is executed by Checkmk, even though they are present when running the agent manually. This is typically caused by the requiretty option in the sudo configuration blocking non-interactive sudo calls.

 


Problem

The following agent sections are missing from the agent output:

  • cmk_site_statistics

  • livestatus_status

  • livestatus_ssl_certs

  • mkeventd_status

  • mkbackup

  • mknotifyd

  • omd_apache

  • omd_diskusage

 

This can lead to the following symptoms:

  • Services report Item not found in monitoring data

  • Existing services are marked as vanished after a service discovery

  • The OMD <mysite> status service remains OK, making the issue easy to overlook

 


Background

Beginning with Checkmk 2.4, these sections are collected by helper scripts that are executed as the site user using non-interactive sudo.

If the system enforces the requiretty option, these helper scripts cannot run because the agent is executed without an attached terminal. As a result, the corresponding agent sections are omitted from the output.

 

 

Solution

Step 1: Verify the issue

Compare the agent output collected by Checkmk with the output from a manual execution.

Query the agent through Checkmk:

OMD[mysite]:~$ cmk -d mylinuxhost | grep -c '^<<<livestatus_status' 0

 

Run the agent locally:

root@mylinuxhost$ /usr/bin/check_mk_agent | grep -c '^<<<livestatus_status' 1

If the section is only missing when queried by Checkmk, continue with the next step.

 

 

Step 2: Confirm that requiretty is the cause

Run one of the helper scripts without a controlling terminal.

Replace <mysite> and <version> with the appropriate values.

setsid --wait sh -c \ 'sudo --non-interactive --user=<mysite> \ /omd/versions/<version>/bin/cmk-monitor-core' \ </dev/null >/tmp/core.out 2>/tmp/core.err echo "rc=$?" cat /tmp/core.err

 

If the command returns:

sudo: sorry, you must have a tty to run sudo

The requiretty policy is preventing the helper scripts from running.

 

 

Step 3: Create a sudoers exception

Create a dedicated sudoers drop-in file:

visudo -f /etc/sudoers.d/99-checkmk-agent

 

Add the following entry:

# Required by the Checkmk agent Defaults:root !requiretty

Save the file.

 

 

Step 4: Validate the configuration

Set the correct permissions:

chmod 0440 /etc/sudoers.d/99-checkmk-agent

 

Validate:

visudo -c

 

 

Step 5: Verify the fix

Repeat the test from Step 2. The command should now complete successfully.

Then confirm that the missing section is present:

OMD[mysite]:~$ cmk -d mylinuxhost | grep -c '^<<<livestatus_status' 1

 

Finally:

  1. Reschedule the Check_MK service.

  2. Run a service discovery if services were previously marked as vanished.

A site restart or agent reinstallation is not required.

 

 

Alternative solution

If your security policy does not allow disabling requiretty for all root commands, you can limit the exception to the Checkmk helper scripts.

Create the following sudoers configuration:

Cmnd_Alias CMK_MONITOR = /omd/versions/*/bin/cmk-monitor-* Defaults!CMK_MONITOR !requiretty

This applies the exception only to the helper scripts used by the Checkmk agent.

 


Additional information

Warning

While these agent sections are missing, the Checkmk server monitors itself only partially. Notification spooler failures, Event Console problems, failed site backups, expiring Livestatus certificates, and site disk usage are no longer detected.

 

Note

The use_pty option does not cause this issue and can remain enabled. Other sudo options, such as targetpw, rootpw, or runaspw, can also prevent the helper scripts from running because non-interactive sudo cannot prompt for a password. These settings require similar exceptions.

 

 

Related articles