How to remove custom changes to files in the appliance

Owned by Matthew Hierholzer
Last updated: Aug 26, 2024
2 min read

Over time, you might accumulate custom files in your Checkmk Appliance, which can put your support status in jeopardy. This article outlines how to restore the files to factory defaults.

This article is targeted at advanced users! If you are not entirely sure, what you are doing, you should not follow these instructions!

APPLICABLE FROM 1.7.0 UPWARDS


Table of Contents


Background

The Checkmk Appliance uses something called an overlay file system. This enables a read-only firmware, which cannot be tampered with, while still allowing configuration to be changed (through the web configuration).
As the name suggests, these file system has layers, where the lower layer is read-only, and the upper layer can be written to. This results in a "merged" file system, mounted at the root (/) of the directory tree.
So you will find three main directories: /ro/, which is the read-only file system, /rw/overlay-rw/,  which contains the modifications and /  which is the actual root of the running operating system.


Step-by-step guide

First, identify the files, which were changed. The resulting listing should mostly contain files, which are expected to have been changed, so this article will focus on the /etc/  directory.

  1. Log in as root.
  2. You can inspect the file system structure in /, but the actual changes reside in /rw/overlay-rw/
  3. Run the following command to find all changed files (you can pipe it to a file as well for easier inspection): find /rw/ 
  4. Now let's run a more narrow search to only find the changed files in /etc/ : find /rw/ | grep "/rw/overlay-rw/etc/" 
  5. Let's say, you found this file, and you know you modified it: /rw/overlay-rw/etc/check_mk/logwatch.cfg
    1. You can remove the changes by running rm /rw/overlay-rw/etc/check_mk/logwatch.cfg
    2. Do NOT remove the file at /etc/check_mk/logwatch.cfg! This would remove the whole file and not only custom changes!
  6. Congratulations, you have reverted the file to its factory default.