Werk #22256: Linux agent: Fix encrypted agent output and real-time checks on bash 4.2

Component

Checks & agents

Title

Linux agent: Fix encrypted agent output and real-time checks on bash 4.2

Date

Oct 13, 2026

Level

Trivial Change

Class

Bug Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

3.0.0b1 Not yet released	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p16 Not yet released	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

This werk affects you if you monitor Linux hosts with bash 4.2, for example RHEL/CentOS 7.

Since Checkmk 2.5.0, the Linux agent failed to encrypt its output on such hosts if you use symmetric agent encryption (ruleset Encryption (Linux, Windows) or encryption.cfg) with the legacy pull mode. When running check_mk_agent -d, you saw errors like syntax error: operand expected, and Checkmk failed to decrypt the output with Decryption failed: MAC mismatch. Hosts registered for TLS via cmk-agent-ctl are not affected.

Since Checkmk 2.1.0, real-time checks did not send any data from such hosts, whether encrypted or not.

To fix this, update the agent on the affected hosts. On hosts that also have an OpenSSL version older than 1.1.1, such as RHEL/CentOS 7, you also need Werk #22255.

To the list of all Werks