handle version locked packages (#112)

* handle version locked packages in agent

* show info for version locked packages

Author: leozachl

mkp/local/lib/python3/cmk_addons/plugins/yum/agent_based/yum.py

@@ -57,6 +57,7 @@
 class Section(NamedTuple):
     reboot_required: Optional[bool]
     packages: int = -1
+    locked_packages_list: Optional[str] = None
     security_packages: int = -1
     security_packages_list: Optional[str] = None
     last_update_timestamp: int = -1
@@ -75,11 +76,14 @@ def yum_parse(string_table: List[List[str]]) -> Section:
         pass
 
     packages = None
+    locked_packages_list = None
     security_packages = None
     security_packages_list = None
     last_update_timestamp = None
     try:
         packages = int(string_table[1][0])
+        if len(string_table[1]) > 1:
+            locked_packages_list = " ".join(string_table[1][1:])
         security_packages = int(string_table[2][0])
         if len(string_table[2]) > 1:
             security_packages_list = string_table[2][1]
@@ -90,6 +94,7 @@ def yum_parse(string_table: List[List[str]]) -> Section:
     return Section(
         reboot_required,
         packages,
+        locked_packages_list,
         security_packages,
         security_packages_list,
         last_update_timestamp)
@@ -118,9 +123,17 @@ def check_yum(params: Dict[str, object], section: Section):
 
     # === Normal Updates ===
     if section.packages < 0:
-        yield Result(state=State.UNKNOWN, summary="No package information available")
+        state = State.UNKNOWN
+        if section.locked_packages_list:
+            summary=f"No package information available ({section.locked_packages_list})"
+        else:
+            summary="No package information available"
     elif section.packages == 0 and section.security_packages == 0:
-        yield Result(state=State.OK, summary="All packages are up to date")
+        state = State.OK
+        if section.locked_packages_list:
+            summary=f"All packages are up to date ({section.locked_packages_list})"
+        else:
+            summary="All packages are up to date"
         yield Metric(name="normal_updates", value=0)
     else:
         mode, levels = params.get("normal")
@@ -134,8 +147,12 @@ def check_yum(params: Dict[str, object], section: Section):
                 state = State.OK
         else:
             state = State.OK
-        yield Result(state=state, summary=f"{section.packages} normal updates available")
+        if section.locked_packages_list:
+            summary=f"{section.packages} normal updates available ({section.locked_packages_list})"
+        else:
+            summary=f"{section.packages} normal updates available"
         yield Metric(name="normal_updates", value=section.packages)
+    yield Result(state=state, summary=summary)
 
     # === Security Updates ===
     if section.security_packages >= 0:

mkp/local/share/check_mk/agents/plugins/yum

@@ -169,17 +169,25 @@ then
 
     # Count available updates - different commands for different package managers
     if [ "$PKG_MGR" = "dnf5" ]; then
-        LOCKEDRE=$(dnf5 versionlock list | grep -o -P '(?<=^Package name: ).+' | tr '\n' '|' | sed 's/|/\\.|/g; s/|$//')
-        UPDATES=$(timeout 25s dnf5 list --upgrades 2>/dev/null | grep -E "^[a-zA-Z]" | tail -n +2 | grep -v -P "$LOCKEDRE" | wc -l || echo "-1")
+        LOCKED=$(dnf5 versionlock list | grep -o -P '(?<=^Package name: ).+' | tr '\n' ' ')
+        if [[ -n "$LOCKED" ]]; then
+            LOCKED="version locked: $LOCKED"
+            LOCKEDNR=$(dnf5 versionlock list | grep -c -o -P '(?<=^Package name: ).+')
+        else
+            let LOCKEDNR=0
+        fi
+        UPDATES=$(timeout 25s dnf5 list --upgrades 2>/dev/null | grep -E "^[a-zA-Z]" | tail -n +2 | wc -l || echo "-1")
+        let UPDATES=UPDATES-LOCKEDNR
     else
+        LOCKED=""
         UPDATES=$(timeout 25s $PKG_MGR -C --noplugins --quiet list updates 2>/dev/null | grep "\." | cut -d' ' -f1 | wc -l || echo "-1")
     fi
 
     # Check for security updates if supported
     if [ $SECURITY_SUPPORTED -eq 1 ]; then
         if [ "$PKG_MGR" = "dnf5" ]; then
             # dnf5 uses different command for security updates
-            SECURITY_OUTPUT=$(timeout 25s dnf5 -C --quiet check-upgrade --security 2>/dev/null)
+            SECURITY_OUTPUT=$(timeout 25s dnf5 -C --quiet check-upgrade --security 2>/dev/null | grep -v 'No security updates needed, but')
             SECURITY_UPDATES=$(echo "$SECURITY_OUTPUT" | grep -E "^[a-zA-Z0-9]" | wc -l || echo "-1")
             SECURITY_UPDATES_LIST=$(echo "$SECURITY_OUTPUT" | grep -E "^[a-zA-Z0-9]" | awk '{print $1}' | sed 's/\.[^.]*$//' | paste -sd, -)
         else
@@ -227,7 +235,7 @@ then
     fi
 
     echo "$BOOT_REQUIRED"
-    echo "$UPDATES"
+    echo "$UPDATES $LOCKED"
     echo "$SECURITY_UPDATES $SECURITY_UPDATES_LIST"
     echo "$LAST_UPDATE_TIMESTAMP"
 
@@ -245,7 +253,7 @@ then
     if [ -f "$CACHE_RESULT_CHECK" ] || [ ! -L "$CACHE_RESULT_CHECK" ]
     then
         echo "$BOOT_REQUIRED" > "$CACHE_RESULT_CHECK"
-        echo "$UPDATES" >> "$CACHE_RESULT_CHECK"
+        echo "$UPDATES $LOCKED" >> "$CACHE_RESULT_CHECK"
         echo "$SECURITY_UPDATES $SECURITY_UPDATES_LIST" >> "$CACHE_RESULT_CHECK"
         echo "$LAST_UPDATE_TIMESTAMP" >> "$CACHE_RESULT_CHECK"
     else