With the recent security updates, but also in Debian Unstable I noticed
that some installations did no more report to the correct server or the
same list of servers anymore.

All those had one or more older server IPs in the debconf database and a
different set in /etc/default/xymon-client, either manually edited or
via config management like ansible.

xymon-client.postinst edits two variables in /etc/default/xymon-client
unconditionally and always sets the IP address(es) stored in the debconf
database.

It though only occurred to me often enough to see the pattern in the
past months — and it's unclear to me why not earlier. Because the
xymon-client.postinst script hasn't been touched since 2015. And the
last changes to the debconf part were in 2014 when the question about
automatic migration had been added. And the most recent bigger change
was in 2012.

There's a though chance that I ran into it more often, because I toyed
around with reporting to multiple Xymon servers as well as with Xymon
reporting over SSL and IPv6 via stunnel and probably edited
/etc/default/xymon-client manually rather often than using
"dpkg-reconfigure -plow xymon-client" for it (which is the way to
workaround this issue permanently — until the next manual edit of the
file ;-).

So it overwrites the configure file with local changes by the local
admin with a value set by the local admin (earlier). So both are local
configurations with two differents systems/styles/methods. They'rejust
not kept in sync and any diversion is not reported or cared about.

I just reread
https://www.debian.org/doc/debian-policy/ch-files.html#behavior
(§10.7.3) — but actually both, "must not overwrite or otherwise mangle
the user’s configuration without asking" and "must not ask unnecessary
questions (particularly during upgrades)" applies and seems to
contradict here (a bit at least).

I though tend to have the opinion that the current state is not good,
especially annoying and potentially a policy violation (§10.7.3) —
although it's mostly two local config sources not being in sync, but
both are local changes from the local admin. The admin is though likely
not aware of it.

Potential solutions:

* ucf — Potentially complex and error-prone. The function
  create_sshdconfig() from /var/lib/dpkg/info/openssh-server.postinst
  could be used as a pattern for a solution based on ucf.

* Adding a hint to the file that the values of two variables in the file
  are maintained via debconf and might be overwritten upon package
  (security) upgrades if their values are edited manually. (Probably
  doesn't help much if a configuration management ala Ansible is used.)

Suggestions, comments and opinions on this issue are welcome — and
actually wanted, hence the moreinfo tag. :-)

Hi Axel!

I also observed this on some servers.
Today I had a deep dive into all the debconf and postinst scripts of
xymon-client and found the root cause in xymon-client.config:

if [ -e $CONFIGFILE ]; then
   . $CONFIGFILE || true
fi

# if there is no value configured, look for debconf answers
if [ -z "$HOBBITSERVERS" ] ; then
        db_get hobbit-client/HOBBITSERVERS
        HOBBITSERVERS="$RET"
fi

This reads HOBBITSERVERS from /etc/default/xymon, but this isn't set
(since it was overwritten by XYMONSERVERS some time ago).
Since now the current setting XYMONSERVERS isn't found in
/etc/default/xymon (because it searches for HOBBITSERVERS, that isn't
set), it takes the (old) default from debconf database and breaks
/etc/default/xymon.

I'm working on a new Debian release of xymon, that removes all the pre
4.3.7 hobbit to xymon migration logic (available since Debian 8, so it
can not be removed) and also rename these hobbit-client and
HOBBITSERVERS debconf fields to xymon-client and XYMONSERVERS (with a
fallback to the old variables, if the new ones are not found).

Greetings
Roland

We believe that the bug you reported is fixed in the latest version of
xymon, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 939859@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Roland Rosenfeld <roland@debian.org> (supplier of updated xymon package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 18 Aug 2026 20:59:22 +0200
Source: xymon
Architecture: source
Version: 4.3.30-6
Distribution: unstable
Urgency: medium
Maintainer: Axel Beckert <abe@debian.org>
Changed-By: Roland Rosenfeld <roland@debian.org>
Closes: 909316 939859 1139228
Changes:
 xymon (4.3.30-6) unstable; urgency=medium
 .
   [ Roland Rosenfeld ]
   * 102_ldap_url_parse: Fix build problems with ldap.
   * Update build-depends from libldap2-dev to libldap-dev.
   * Declare compliance with Debian Policy 4.7.4.
   * Use magick (from imagemagick 7) instead of convert.
   * Remove 69_disk-no-duplicate-root.patch, which was only needed with
     coreutils in wheezy.
   * Revert pre 4.3.7 hobbit-client migration logic.
   * Cleanup maintainer scripts.
   * Rename debconf variables from hobbit-client to xymon-client and fix
     inconsistency between debconf and /etc (Closes: #939859).
   * 103_openssl4: Fix build issues with OpenSSL 4 (Closes: #1139228).
   * Update debian/README.Debian.
   * Update lintian overrides.
 .
   [ Martin Zobel-Helas ]
   * Show ZFS mounts (Closes: #909316).
Checksums-Sha1:
 a5302cea770458abd74226976003fe76b0ee641c 2061 xymon_4.3.30-6.dsc
 80725eeeabdf46d987e760163bfb11ca67d61cc2 62996 xymon_4.3.30-6.debian.tar.xz
 0b501bbefde52b931ad53204ef36dcd4cfadf5c5 9744 xymon_4.3.30-6_source.buildinfo
Checksums-Sha256:
 4ecbddb9d841e83d420c2d09769835a02bfb443f3d4671cfc29d3e4aa64db5d2 2061 xymon_4.3.30-6.dsc
 e7c7bbe437752221109549b4f2aa37eac8d318c1a36e1eea35fd9873265e24aa 62996 xymon_4.3.30-6.debian.tar.xz
 92ac0497e371b29ee9031bc1a017f169ffa8e0d6a0603290e9f0e87a8b5ff263 9744 xymon_4.3.30-6_source.buildinfo
Files:
 fab2f433feff6200b99bb7f4d5339e08 2061 net optional xymon_4.3.30-6.dsc
 bc3009f59b05db9ea96fa7a0458b9be6 62996 net optional xymon_4.3.30-6.debian.tar.xz
 c361bf5b71e4ccfc3207a1c846542327 9744 net optional xymon_4.3.30-6_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErC+9sQSUPYpEoCEdAnE7z8pUELIFAmqEq6sACgkQAnE7z8pU
ELIP7g//S8pNo1cg/TJgH/ALkRjvZeWboPaQYdMwdoK0iClZVuFAjj41isG0vNNG
QvOZDm/KZH5iU9XYjSQ38DLkS6V9ZqeXTDaKHd4K1+gy5zZRJzP3TWMIgGpJkcEv
yXMIO6aJK3XRgC6mcdvmX4OdfNhBU7WpCA96iKBnywppODYYekbEh6BZz/AB+bFg
wRMPo+ez9xp4WQEpO9tUGj2gUjQ7vfB5YQHzEIoLn20WN32OZKVp6i92Cl6vP+K3
Fway09WVWzJ6It87zyh+algM/JeDjTMWkUwDTKrgv+t/VLiPc1mFwr8BDuZH3ZVL
Aflv6heX/8LSnEvQUq/wjKx6IO8uZQT1ilCd5XeYx98JiL3ptCvYRi/VyV/xb9Xt
jODq1wKwKid+y/bpH4sZMNkI8c+AtT7DbfWiH0SiDlTg49x5m0gE74LfWew7u+0s
ACXGpDay9Zj/bUyJVFFqZpOXUcya0gdpk10FdQyMj17Sjv9budI7ZIc97KtfSkBY
OmNbRVH6PeGahLYcevEUdqnwJnxxwiuZrMV/JQzdDNSZNDGlmOQRcdWn0liElrXM
cHMcaeC2+uvkwTlB6yrDl3LbyRBEcQakajNqJK5XaRY1FidlyuvDemqYYAL1WnKh
eNmC3uCQzga55WIvAwX+2TUnD5Ru7sLXXbS8MPnr2G+YFNsm340=
=ZVAu
-----END PGP SIGNATURE-----