Extend your Checkmk monitoring with packages created by community members. Or create your own packages and share the here with the rest of the community.
Finds applications that are running on your hosts but not monitored yet, and suggests the agent plug-in or special agent that would cover them. The Monitoring Coverage Analyzer (MCA) looks at the agent data Checkmk already has and finds applications and subsystems that are running on agent-monitored hosts but not monitored yet (databases, web servers, Hyper-V, SAP, Veeam, Citrix, ...). For each finding it names the agent plug-in or special agent that would cover it, including checks from MKPs installed on your site. - GUI page "Setup > Maintenance > Analyze monitoring coverage" with the coverage of all hosts and open findings per host - One service "Checkmk Monitoring Coverage" per host - Nothing to deploy on your hosts: uses the agent data Checkmk has already cached - Works in distributed setups (analysis on the central site only) - Findings can be ignored with a Setup rule Detection is heuristic by design (curated rules plus a fuzzy search across all check plug-ins of the site), so false positives and false negatives cannot be ruled out completely. Please report them on GitHub. After installing, run once as the site user: mcactl setup Requires Checkmk 2.5.0p15 or later, also runs on 3.0. Developed with the help of AI coding assistants; designed, reviewed and tested on real Checkmk sites by the authors. Source, documentation and issues: [https://github.com/Gulaschcowboy/checkmk\_monitoring\_coverage\_analyzer](https://github.com/Gulaschcowboy/checkmk_monitoring_coverage_analyzer)
Checkmk MKP that monitors OPNsense firewalls through the OPNsense REST API. Not an replacement for the checkmk agent, but an addition.
by mape2k
This agent plugin checks Proxmox VE using the Checkmk-Agent. It produces the same output as the official Promox VE special agent including piggyback sections for Virtual Machines and Linux Containers (LXC). In most places, it (re)uses the source code of # the Proxmox VE special agent. This solution is intended for cases where the Proxmox VE node is not directly accessible from the Checkmk server.
APT/DNF/Zypper Advanced Linux Update Check - pending package updates for Debian/Ubuntu (apt, apt-get), RHEL/Rocky/Alma/Oracle Linux/Fedora (dnf, yum) and SLES/openSUSE (zypper), rated by threat. Every pending update is put into one tier: zero-day (fixes a CVE in the CISA KEV catalog, actively exploited), critical (severity critical/high or EPSS score above threshold), security, normal. Each tier has its own delay, counted from the moment the update was first seen on the host, plus state and escalation. Example: actively exploited fixes go CRIT immediately, ordinary security updates WARN only after 24 hours - no more daily alerts for hosts with unattended nightly patching. Zero-day and critical can be switched off. apt: simulates apt-get upgrade AND dist-upgrade (kept back, phased, new and removed packages), CVEs via OSV. dnf/yum: severity, advisory and CVEs from the distribution's updateinfo. zypper: security patches with severity and CVEs. snap/flatpak updates as info. Services: APT/DNF/YUM/Zypper Pending Updates, Reboot Required (reboot flag, needs-restarting, newer kernel, kernel livepatch, services to restart), Repository Health (metadata age, refresh errors, missing security repository, foreign suites, broken and orphaned packages, unattended-upgrades/dnf-automatic, OS end of life). HW/SW inventory with pending updates and CVE table - find all hosts affected by a CVE. Automatic host labels (package manager, automatic updates, security information, livepatch). Graphs and perfometers. Agent Bakery rule, always asynchronous, rate-limited metadata refresh. Nothing is ever installed. Threat data (CISA KEV, EPSS, OSV, endoflife.date) is refreshed automatically on every site, no cron or setup needed, proxy supported. Checkmk 2.5.0\+. Keywords: apt, apt-get, dnf, yum, zypper, debian, ubuntu, rhel, rocky, almalinux, oracle linux, fedora, sles, opensuse, security updates, patch management, cve, kev, epss, zero-day, reboot required, livepatch, unattended-upgrades, snap, flatpak, inventory --- APT/DNF/Zypper Advanced Linux Update Check - offene Paket-Updates für Debian/Ubuntu (apt, apt-get), RHEL/Rocky/Alma/Oracle Linux/Fedora (dnf, yum) und SLES/openSUSE (zypper), bewertet nach Bedrohungslage. Jedes offene Update kommt in eine Stufe: Zero-Day (schließt eine CVE aus dem CISA-KEV-Katalog, aktiv ausgenutzt), Critical (Schweregrad critical/high oder EPSS über Schwelle), Security, Normal. Jede Stufe hat eine eigene Verzögerung, gezählt ab der ersten Sichtung des Updates auf dem Host, sowie Status und Eskalation. Beispiel: aktiv ausgenutzte Lücken sofort CRIT, normale Security-Updates erst nach 24 Stunden WARN - keine täglichen Alarme mehr bei Hosts mit nächtlichem automatischem Patchen. Zero-Day und Critical lassen sich abschalten. apt: simuliert apt-get upgrade UND dist-upgrade (kept back, phased, neue und entfernte Pakete), CVEs über OSV. dnf/yum: Schweregrad, Advisory und CVEs aus updateinfo der Distribution. zypper: Security-Patches mit Schweregrad und CVEs. Snap-/Flatpak-Updates als Info. Services: APT/DNF/YUM/Zypper Pending Updates, Reboot Required (Reboot-Flag, needs-restarting, neuerer Kernel, Kernel-Livepatch, Dienste mit Neustart-Bedarf), Repository Health (Alter der Metadaten, Refresh-Fehler, fehlendes Security-Repository, fremde Releases, defekte und verwaiste Pakete, unattended-upgrades/dnf-automatic, OS End of Life). HW/SW-Inventur mit offenen Updates und CVE-Tabelle - alle von einer CVE betroffenen Hosts finden. Automatische Host-Labels (Paketmanager, automatische Updates, Security-Informationen, Livepatch). Graphen und Perfometer. Agent-Bakery-Regel, immer asynchron, gedrosselter Metadaten-Refresh. Es wird nie etwas installiert. Threat-Daten (CISA KEV, EPSS, OSV, endoflife.date) aktualisieren sich auf jeder Site automatisch, ohne Cron oder Einrichtung, Proxy wird unterstützt. Ab Checkmk 2.5.0. Stichworte: apt, apt-get, dnf, yum, zypper, debian, ubuntu, rhel, rocky, almalinux, oracle linux, fedora, sles, opensuse, security updates, patch management, cve, kev, epss, zero-day, reboot required, livepatch, unattended-upgrades, snap, flatpak, inventory
by TonyBostonTB
MikroTik RouterOS monitoring for CheckMK Monitors MikroTik RouterOS devices via the RouterOS API (v2, port 8729/SSL or 8728) or the RESTful API. Provides checks for: - System health, fans, and temperature sensors - Power supply units (per-PSU voltage, current, and wattage), PoE consumption - BGP and OSPF neighbors - not tested - VRRP status - not tested - IPsec tunnels - not tested - Firewall rules (with optional disabled-rule visibility) - not tested - File age monitoring - RouterOS Info: model, serial number, RouterOS version (with minimum version enforcement) and RouterBOOT firmware (state if an upgrade is pending) - HW/SW inventory: model, serial number, RouterOS version, RouterBOOT firmware - License expiration (CHR) - WiFi per SSID: connected clients, signal strength and radio state, for the new wifi driver, the legacy wireless driver (not tested) and CAPsMAN, new and legacy (one controller covers all its access points) - HW/SW inventory of the access points managed by a CAPsMAN controller: identity, model, serial number, RouterOS version, base MAC Requirements: CheckMK 2.4 or later, RouterOS 7.x. Upgrading from 3.x: stored rules are migrated automatically on install. See "Migration from v3.x" in the README for the power service change. Changes per release are shown in the version description below. Full changelog: [https://github.com/TonyBostonTB/CMK\_Mikrotik/blob/main/CHANGELOG.MD](https://github.com/TonyBostonTB/CMK_Mikrotik/blob/main/CHANGELOG.MD) Issues and source: [https://github.com/TonyBostonTB/CMK\_Mikrotik](https://github.com/TonyBostonTB/CMK_Mikrotik) Based on the original plugin by Andrea Fadda (devilofhell87).
by rsander
Agent Plugin to check SSL certificates in specified directories Now with support to check signature algorithm Windows Plugin added JSON data in agent data section Is now able to ignore certificates with a short lifetime
by simonmeggle
Robotmk integrates Robot Framework results into Checkmk.
by lgbff
This check monitors the status of ssl cert checks on ssllab.com. Changelog: - 3\.2.0 no systemtime in agent output - 3\.x version for cmk 2.2 - 2\.1.0 change to python3 - 2\.0.1 fix datasource\_programm group definition - 2\.0.0 insert cache for api response - 1\.6.0 insert Agent status (line\[3\]) - 1\.5.3 change default status - 1\.5.2 Insert Agent Header infos - 1\.5.1 cache default settings - 1\.5.0 new data seperator (59) - 1\.4.9 fix display JSON Error on check result. - 1\.4.8 fix connect exeption - 1\.4.7 add default value for timeout - 1\.4.6 change timeout handling - 1\.4.5 fix inventory issue while JSON issues - 1\.4.4 change urlopen error handling - 1\.4.3 Rename check file - 1\.4.2 Fix check manpage - 1\.4.1 delete modul calls from check - 1\.4.0 changes for cmk version 1.4 - 1\.3.1 improve error handling.
by rsander
Plugin to gather Ceph statistics. ### Starting with Checkmk 2.4, this plug-in is distributed with Checkmk. No need to download this MKP. Use this MKP only if you want to monitor Ceph with Checkmk 2.2 or 2.3.