System Updates monitors pending system and package updates on Linux and Windows hosts. It sorts them into security and normal updates, reports required reboots and service restarts, and graphs the trend over time.

Services

• Pending Updates: pending updates sorted into security / normal / unknown. Updates ignored by regex, held/pinned updates and optional updates (Windows drivers) are counted separately. It also shows the age of the oldest pending security update.
• Update Cache Age (per backend): warns when the package metadata is stale, when no security advisory source exists, or when the automatic Windows Update scan is disabled.
• Reboot Required, with the reason: from distribution-specific signals (e.g. /var/run/reboot-required, needs-restarting, zypper needs-rebooting, Windows Update/CBS) and distribution-independent ones (running kernel no longer installed, PID 1 still using replaced libraries, …).
• Service Restart Needed (Linux): services still running code from shared libraries that an update replaced.

Backends: apt (Debian/Ubuntu), dnf/yum incl. dnf5 (RHEL family, Fedora, Amazon Linux), zypper (openSUSE/SLES), apk (Alpine), Windows Update (incl. WSUS) and winget.

No surprise network traffic: updates are checked only against the local package caches. Refreshing metadata is opt-in and limited to at most once per hour, so a host can't get rate-limited by a mirror or Windows Update.

Scheduling: an execution interval, plus an optional daily start time, e.g. right after the automatic update run.

Configuration: Agent Bakery rules "System Updates (Linux)" / "System Updates (Windows)" in the commercial editions (Checkmk 2.4 via a built-in Bakery API v1 bridge). Thresholds and ignore patterns are set in check-parameter rules. On Checkmk Community, install the agent plug-in by hand. Works independently of the system/display language.

Compatibility: Checkmk 2.4.0 or newer. Tested on 2.4.0p39 and 2.5.0p17; built and smoke-tested on the 3.0.0 daily. Linux was live-tested on 23 distribution versions, Windows on Windows 11 and Windows Server 2016/2022.

Documentation, test details and changelog: https://gitlab.thatsallmine.de/checkmk1/checkmk_system_updates

I did not develop this MKP officially as an employee of Checkmk GmbH, but rather as a private individual.