#1136062 check_apt doesn't detect a pending (critical) update

Package:
monitoring-plugins-basic
Source:
monitoring-plugins-basic
Description:
Plugins for nagios compatible monitoring systems (basic)
Submitter:
Uwe Kleine-König
Date:
2026-08-07 07:43:01 UTC
Severity:
normal
#1136062#5
Date:
2026-05-08 21:56:21 UTC
From:
To:
Hello,

I currentently experience:

	root@quarterberry:~# /usr/lib/nagios/plugins/check_apt
	APT OK: 0 packages available for upgrade (0 critical updates). |available_upgrades=0;;;0 critical_updates=0;;;0
	root@quarterberry:~# apt list --upgradable
	linux-image-arm64/stable-security 6.12.86-1 arm64 [upgradable from: 6.12.85-1]
	Notice: There are 2 additional versions. Please use the '-a' switch to see them.

and so icinga doesn't notify me about the pending upgrade.

I would expect that check_apt detects that as a critical update.

Best regards
Uwe
#1136062#10
Date:
2026-08-07 07:38:30 UTC
From:
To:
Hello,

As I hit this problem today again, I debugged a bit. The reason this
fails is that (by default) check_apt calls `/usr/bin/apt-get -o
Debug::NoLocking=true -s -qq upgrade`. When removing the -qq (to make
apt-get a bit more talkative) I get today:

	root@quarterberry:~# /usr/bin/apt-get -o Debug::NoLocking=true -s upgrade
	Reading package lists... Done
	Building dependency tree... Done
	Reading state information... Done
	Calculating upgrade... Done
	The following packages have been kept back:
	  linux-image-arm64
	0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

so linux-image-arm64 is kept back as it introduces new dependant
packages. With dist-upgrade the kernel isn't kept back.

check_apt can be made to use dist-upgrade instead of upgrade using `-d`.
I wonder if that would be the saner default.

Best regards
Uwe