NAME
Monitoring::Sneck::Checks::debsecan - checks for Debian security fixes through debsecan
VERSION
Version 0.0.1
SYNOPSIS
!debsecan|interval=3600 timeout=300|perl:debsecan
!debsecan_urgent|interval=3600 timeout=300|perl:debsecan -u 1 -U 1 -f 100 -F 200DESCRIPTION
Runs debsecan and counts what it reports, the same as check_debsecan. It is WARNING or CRITICAL once a count is at or over its limit.
- fixed :: Vulnerabilities with a fix ready to install.
- obsolete :: Installed packages Debian no longer has.
- high, medium, low :: Vulnerabilities by urgency.
By default only those with a fix are counted, as only those can be acted on.
debsecan downloads the security tracker's data each time it runs, which takes a while and should not be done every few minutes. Run it as a compliance check with a interval of a hour or more and a longer timeout, as in the synopsis. Set http_proxy through a env line if it needs a proxy.
debsecan failing, such as not being able to reach the tracker, is UNKNOWN. So is it not being there.
OPTIONS
- -s, --suite :: The Debian suite, such as trixie. Default :: VERSION_CODENAME from /etc/os-release, else what debsecan picks
- -a, --all :: Count vulnerabilities with no fix yet too.
- -f, --fixed-warning and -F, --fixed-critical :: The WARNING and CRITICAL limits for fixed. Default :: 20, 30
- -o, --obsolete-warning and -O, --obsolete-critical :: The same for obsolete. Default :: 1, 1
- -u, --high-warning and -U, --high-critical :: The same for high urgency. Default :: 1, 1
- -m, --medium-warning and -M, --medium-critical :: The same for medium urgency. Default :: 5, 10
- -l, --low-warning and -L, --low-critical :: The same for low urgency. Default :: 10, 20
- -n, --lines :: How many of what it found to list after the status line, once it is not OK. Default :: 20
METHODS
check
Does the check.
suite
Returns VERSION_CODENAME from /etc/os-release, or undef if it has none.