Werk #22491: Crash reports contain the data the plug-in actually processed
| Component | Core & setup | ||
| Title | Crash reports contain the data the plug-in actually processed | ||
| Date | Oct 7, 2026 | ||
| Level | Trivial Change | ||
| Class | Bug Fix | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
Previously, when a check or parse function crashed, the crash report
contained the agent cache file of the host (tmp/check_mk/cache/<host>)
plus all piggyback data stored for it at that moment. That was often not
the data the plug-in had actually processed:
- For hosts monitored via SNMP or special agents, the data the plug-in processed was missing, because they don't use that cache file.
- Clusters got no data, because they have no cache file of their own.
- The cache file may already have been overwritten by a later fetch.
This made many crash reports impossible to reproduce.
Crash reports now contain the raw data that was fetched for the crashing check or parse function. This applies to checks in the monitoring core, to service discovery and to the HW/SW inventory. If the data comes from several sources, for example the agent and piggyback data, or the nodes of a cluster, each source is preceded by a separator line naming the host, the source and the fetcher type. SNMP data is included in the format of the SNMP cache files. Piggyback data is included as it is stored on the site when the crash report is written, one block per source host with the time of its last update. It can therefore also contain data that was already too old to be processed.
The same goes for crashes outside of the plug-ins, for example in the Check_MK service itself: their crash reports contain the data fetched up to the crash.