Nagios XI Changelog

2026R1.7 - August 4, 2026

The most potentially impactful thing is that we are now shipping check_ncpa written in C, versus the old way written in Python. check_ncpa checks execute up to 10x faster in our checking, the ultimate impact is that customers should be able to run more check_ncpa checks on the same hardware. Existing checks will not be affected. New monitoring configured via a check_ncpa-based wizards will use the new C-based plugin.

There is a migration script available from the support department if people want to migrate their checks to the faster plugin. We aren’t shipping that script with XI so that people don’t just run it without thinking through the consequences.

Other than that, SSO for XI mobile is the “Added” that makes it a feature release. Lots of fixes, Debian 11 support is removed, and people will see that continue with the other products. [Video Overview]

Added

Added SSO to mobile [GL:XI#2411] – BB

Fixed

Fixed an issue causing Capacity Planning dashlets to use autoscale erroneously on Smart Dashboards [GL:XI#2604] – ZR
Fixed an issue causing ranges to be ineffective when monitoring license activations in the Microsoft 365 Wizard [GL:XI#2612] – BS
Fixed an issue causing the Bar Chart dashlet for Smart Dashboards to fail to filter when Data Source Hostgroup is selected [GL:XI#2613] – ZR
Fixed an issue causing the Custom Login component to be incompatible with the Neptune theme login page [GL:XI!2624] – ZR
Fixed an issue on the Manage Deployed Agents page where you could edit an existing worker with no token value [GL:XI#2584] – BR
Fixed an issue that allows people to run upgrades with versions older than the installed version [GL:XI#2621] – BR
Fixed an issue where conflicting modsecurity rules would not allow apache to start [GL:XI#2114] – BR
Fixed an issue where custom time periods on the Graph Explorer would not give data with US or EURO time formats [GL:XI#2616] – BR
Fixed an issue where logrotate would fail due to duplicate log entries in xidebug.log [GL:XI#2596] – BR
Fixed an issue where missing nrds files would cause an offline upgrade to fail [GL:XI#2571] – BR
Fixed an issue where offline installs would check for updates by default [GL:XI#1798] – BR
Fixed an issue where the Send Test Notifications page would return a false positive email sent result [GL:XI#2593] – BR
Fixed an issue where the Reason column on the Notifications page would be blank when a host/service recovered or when using custom notifications [GL:XI#2617] – BR
Fixed an issue where the browser’s history API wasn’t being updated properly in the Neptune theme, preventing history navigation [GL:XI#2214] – BB
Fixed an issue where the connectivity probe could incorrectly report a disconnect, usually due to PHP locking on large requests [GL:XI!2617] – BB
Fixed an issue where the subcomponent install script could loop infinitely [GL:XI#2597] – KF
Fixed an issue where users with an identical alias would show as Unknown when configuring individual SSO users [GL:XI#2537] – BB
Fixed an issue where you could not save a service if using only template inheritance [GL:XI#2607] – BR
Fixed an issue where you could not see the full input on date and time input fields in Neptune theme [GL:XI#2601] – BR
Fixed an issue where you could still attempt to modify the Home page without the existence of the Home Page Modification component [GL:XI#2599] – BR
Fixed an issue with links on the rapid response page leading to a 404 error [GL:XI#2573] – BR
Fixed an issue with PHPMailer logging where no logs were being recorded [GL:XI#498] – BR
Fixed an issue with SSH backups failing to be sent and being stored locally – [GL:XI#2588] – BR
Fixed an issue with the Kubernetes Wizard where Step 2 was not displaying metrics [GL:XI#2631] – LG
Fixed an issue with the Kubernetes Wizard where the NCPA token was mangled, breaking checks [GL:XI#2640] – LG
Fixed an undefined variable warning when offloading a database [GL:XI#2559] – BR
Fixed Load Average being a VM metric when it should be a server metric in the Proxmox VE Wizard [GL:XI!2582] – BS
Improved visibility on the close button for some menus on the Manage Mibs page [GL:XI#2558] – BR

Removed

Removed Debian 11 support [GL:XI#2564] – BS
Removed debug information from the timeperiods V1 API endpoint [GL:XI#2626] – BR
Removed the prep-release file [GL:XI#2602] – BS

Updated

Updated “Azure AD” to “Entra ID” per Microsoft’s naming update [GL:XI#2590] – BR, BB
Updated check_ncpa to install the check_ncpa binary on fresh installs [NOISSUE] – KF
Updated Nagios Core to 4.5.14 [GL:XI!2638] – EK
Updated our method of installation for the php-pecl-ssh2 package for a more consistent installation/upgrade experience [GL:XI!2600] – BR
Updated the Linode Wizard language to reflect its new name, Akamai Cloud [GL:XI#2327] – BR
Updated the Network Switch Router Wizard documentation [GL:XI#2534] – BR
Updated the Proxmox VE, Nutanix CE, and XCP-ng Wizards to include tutorial documentation links [GL:XI#2591] – BR
Updated the upgrade script to display the version being upgraded to in the terminal [GL:XI#2620] – CD

2026R1.6.1 - July 8, 2026

Browser and offline compatibility fixes.

Fixed

Fixed an issue causing users running old browsers to encounter installation errors – CN
Fixed an issue blocking users from selecting “Home Lab” during an offline install – CN

2026R1.6 - June 23, 2026

Improved NNA integration, improved SharePoint monitoring, plus select updates and fixes. [Video Overview]

Added

Added support for monitoring license activations and SharePoint to the Microsoft 365 Wizard [GL:XI#1971,516] – BS
Added the option “All Hostgroups” to the Bar Chart dashlet for Smart Dashboards [GL:XI#2540] – ZR
Added the option to update NagVis config files from the Bulk Renaming Tool [GL:XI#2354] – EK
For NNA 2026 integrations, added support for Network Reports and Network Queries, as well as the Network Traffic Analysis tab under hosts/services [GL:XI#2335] – SG

Fixed

Fixed an issue causing some dashlets on Smart Dashboards to display error info while initially fetching data [GL:XI#2149] – ZR
Fixed an issue causing the Graph dashlet on Smart Dashboards to render incorrectly on Scheduled Reports [GL:XI#2476] – ZR
Fixed an issue in SSO where the “client secret expired or invalid” button was not displayed when the client secret was deleted [GL:XI#2569] – BB
Fixed an issue where an SVG on the Rapid Response page would be missing [GL:XI!2533] – EK
Fixed an issue where Network Analyzer reports and queries displayed a blank page when excluding table columns on PHP 8+ systems [GL:XI!2573] – SG
Fixed an issue where the Microsoft 365 Wizard would not include thresholds and filters in service creation [GL:XI!2531] – BS
Fixed an issue where the Microsoft 365 Wizard would time out if there were too many users and groups [GL:XI!2521] – BS
Fixed an issue with notification emails having the wrong event time [GL:XI#2549] – CD
Fixed an issue with upgrades having a chance to fail on RHEL 9 installs – BR

Removed

Removed password fields from Step 2 of wizards where it comes from Step 1 [GL:XI#2536] – JS

Updated

Enhanced the SSO interface to simplify editing and updating the client secret [GL:XI#2569] – BB
Updated the Data Table component used by Smart Dashboards to allow persistence of selected column visibility [GL:XI#2532] – ZR
Updated the wording in the Microsoft 365 Wizard to better reflect Microsoft’s verbiage [GL:XI#2568] – BS

2026R1.5 - May 27, 2026

New XCP-ng hypervisor plugin and Wizard, added Proxy support to the Twilio Component, so many fixes and updates, including a new NDO3 and new Nagios Core. It’s a chock-full changelog! [Video Overview]

Added

Added a documentation link to the Meraki Switch Configuration Wizard [GL:XI#2512] – ZR
Added a status indicator to the Undo Trap Processing button on the Manage MIBs page [GL:XI#17] – JS
Added Proxy support to the Twilio Component [GL:XI#2183] – BR
Added support for round robin DNS for the DNS Query Wizard [GL:XI#1942] – BR
Added the XCP-ng wizard [GL:XI#2485] – BS
Added tooltips to host and service form fields in the CCM for clarity regarding display names [GL:XI#2527] – BR
Added units for each metric on Graph dashlets for Smart Dashboards [GL:XI!2412] – ZR

Fixed

Fixed an issue causing Hostgroup member status counts for all status types to report as zero in certain dashlets for Smart Dashboards [GL:XI!2515] – ZR
Fixed an issue causing several dashlets for Smart Dashboards to run unnecessary queries [GL:XI#2531] – ZR
Fixed an issue causing some styling to load incorrectly on certain pages for the Neptune themes [GL:XI#2510] – ZR
Fixed an issue causing tooltips for dashlets on Smart Dashboards to display outside the boundaries of the window [GL:XI#2496] – ZR
Fixed an issue in the (Legacy) Switch and Router wizard where spaces would be replaced by hyphens causing service checks to error [GL:XI#1304] – BR
Fixed an issue in the Bulk Renaming Tool where it would give a sql and php error occasionally when changing names [GL:XI#1422] – BR
Fixed an issue in the SNMP Walk Wizard where changing Match Type did not change the threshold input to match [GL:XI#2495] – JS
Fixed an issue in the SNMP Walk Wizard where custom host names would not work [GL:XI#2488] – BR
Fixed an issue on some installs where the default timecode was invalid [GL:XI#2481] – BR
Fixed an issue regarding certain license types in XI [GL:XI#2529] – BR
Fixed an issue where Active Directory “person” entities would sometimes not be viewable in the UI [GL:XI#2475] – JS
Fixed an issue where Neptune theme’s routing could lose parameters [GL:XI#2504] – BB
Fixed an issue where NRPE configs would be incomplete on install [GL:XI#364] – BR
Fixed an issue where SSO users individually assigned to existing XI accounts would not work properly [GL:XI#2511] – BB
Fixed an issue where the (Legacy) Switch and Router Wizard was not handling (‘) properly in interface descriptions [GL:XI#1397] – BR
Fixed an issue where the CCM’s Run Check Command did not use custom variables [GL:XI#2516] – BR
Fixed an issue where the Microsoft 365 wizard would return an ‘Insifficient privileges’ error [GL:XI#1211] – BS
Fixed an issue where the SNMP Walk wizard did not correctly parse multi-index MIBs [GL:XI#2491] – JS
Fixed an issue where the UTC offset would be incorrectly displayed for some timezones [GL:XI#2543] – CN
Fixed an issue where upgrades would fail due to pip not being installed [GL:XI#2470] – BS
Fixed an issue where upgrading PHP version to PHP 8.1 would break the scheduled backups page [GL:XI#1776] – BR
Fixed an issue where users acknowledging issues via rapid response links from notifications would be unable to login afterwards [GL:XI#2509] – BB
Fixed an issue where users associated with a service group would not see any services in the CCM [GL:XI#19] – BR
Fixed an issue where users imported through AD/LDAP could not have an email as a username [GL:XI#2530] – BR
Fixed an issue where XI upgrades/installs would fail on EL systems if you have dpkg installed [GL:XI#2520] – BR
Fixed an issue where you could get locked out of XI for the duration of the session due to token mismatch [GL:XI#2032] – BB
Fixed an issue with several Configuration Wizards where form fields did not maintain input when going back from step 4 [GL:XI#525] – BR
Fixed an issue with the “Manage MIBs” interface on Ubuntu where some MIBs were not appearing [GL:XI#17] – JS
Fixed an issue with the Availability Report where selecting “Display Service Performance Graphs” would result in some unreadable metrics [GL:XI#2492] – BR
Fixed an issue with the MSSQL Database Wizard having a broken step 2 page depending on the MSSQL version selected [GL:XI!2444] – BR
Fixed an issue with the Network Status Map where you could not change the root node more than one [GL:XI#2493] – BR
Fixed default wizard host names colliding for same-named sources on different NNA servers [GL:XI#2514] – SG
Fixed several PHP warnings on the “Manage MIBs” interface [GL:XI#17] – JS

Updated

Updated check_postgres.pl to version 2.26.0 [GL:XI#2089] – JS
Updated httpd configuration files to have up to date access control directives [GL:XI#1480] – BR
Updated instructions for enabling NSCA for Inbound Check Tranfers [GL:XI#2479] – BR
Updated Nagios Core to 4.5.13 [GL:XI!2491] – EK
Updated NDO to version 3.1.2 to improve thread and database management [GL:XI#30] – KF
Updated queries, reports, and NNA wizard step 1 with links to manage NNA servers [GL:XI#2526] – SG
Updated SNMP configuration tuning to add Ubuntu-specific MIB directories on Ubuntu installs [GL:XI#17] – JS
Updated SNMP Trap OID validation to format numeric OIDs properly [GL:XI#2434] – BB
Updated terminology in Nagios Network Analyzer wizard to better fit Legacy and 2026+ NNA [GL:XI#2507] – SG
Updated the filters button for Neptune theme reports from the settings gear to a filter list for usage clarity [GL:XI!2496] – BB
Updated the Nutanix CE wizard to allow customizable host names for VMs and host machines [GL:XI#2508] – BS
Updated the SNMP Walk Jobs modal to send new parameters for improved walk output [GL:XI#2357] – JS
Updated the SNMP Walk Wizard with pagination and filters to improve performance and usability [GL:XI#2357] – JS
Updated the XI installer [GL:XI#2513] – CN

2026R1.4 - April 22, 2026

New Network Switch and Router Wizard now makes monitoring network devices distributable with Nagios Mod-Gearman, new Nutanix Community Edition plugin and Wizard, added support for latest SNMP security, and a whole big list of fixes and updates all around. [Video Overview]

Security

Improved error handling to prevent disclosure of file and directory existence [GL:XI#2446!2300] – BB
Resolved a security issue involving improper handling of the Host parameter [GL:XI#2446!2347] – BB
Resolved a vulnerability by adding content security policy to pages [GL:XI#2446!2346] – BB
Resolved a session locale vulnerability and strengthened input validation and security-related checks [GL:XI#2446!2292] – BB
Resolved many instances of potentially vulnerable third-party links [GL:XI#2446!2353] – BB
Resolved an injection in pageparts.inc.php [GL:XI#2446!2296] – BB
Set SameSite=Lax on session and TFV cookies (PHP 7.3+) for CSRF mitigation [GL:XI#2446!2325] – BB

Added

Added a new and improved Network Switch and Router Wizard [GL:XI!2245] – BR
Added an installation complete banner to RPM install script. [NOISSUE] – KF
Added new plugins (check_throughput | check_snmp_interface_status) that monitor throughput and port status on switch/router interfaces [GL:XI!2245] – BR,TG
Added support for Views/Profiles for NNA 2026+ in the Nagios Network Analyzer Wizard [GL:XI!2282] – SG
Added the ability to favorite wizards on the Configuration Wizards page [GL:XI#2415] – BR
Added the ability to go straight to the SNMP Walk Wizard from the SNMP Walk Jobs page [GL:XI#2355] – BR
Added the ability to toggle the global status of Smart Dashboards [GL:XI#2279] – ZR
Added the Nutanix CE Wizard [GL:XI!2364] – BS
Added the option Create Smart Dashboard to the Nagios Network Analyzer Wizard [GL:XI#2441] – ZR

Fixed

Fixed a broken documentation link on the system profile page [GL:XI#2454] – BR
Fixed an issue causing metric visibility selection to reset on performance graph pages [GL:XI#2389] – ZR
Fixed an issue in the Nagios Network Analyzer Wizard where cached views from sources could display in step 1 while sourcegroups are selected – SG
Fixed an issue where a ‘*’ Lucene query in the Nagios Log Server Wizard would not return correct results [GL:XI#1104] – BR
Fixed an issue where bad MIBs would cause excessive logs to appear in log files [GL:XI#2469] – BR
Fixed an issue where check_nna.py reported incorrect values when using views/profiles [GL:XI!2410] – SG
Fixed an issue where migrating from an old system and then running a backup/restore process would break the process_perfdata script [GL:XI#2276] – BR
Fixed an issue where mismatched time units in downtime scheduling could incorrectly indicate that downtime was already set [GL:XI!2329] – BB
Fixed an issue where Network Status Map loaded incorrectly [GL:XI#2486] – EK
Fixed an issue where soft states would not show up in the Executive Summary page when include soft states is selected [GL:XI#1057] – BR
Fixed an issue where the Mobile Text verification code expiration timer was a negative number [GL:XI#2457] – BR
Fixed an issue where the vSphere CPU and memory checks would give more than just usage [GL:XI#2477] – BS
Fixed an issue where time parsing errors could break pages [GL:XI!2328] – BB
Fixed an issue where time zones were formatted incorrectly on the install page [GL:XI#2453] – BR
Fixed an issue where using a duplicate name in the Bulk Renaming Tool would result in a page-breaking 500 error [GL:XI#2458] – BR
Fixed an issue with manage_services.sh where MariaDB was not being accounted for properly [GL:XI#1118] – BR
Fixed an issue with the backend cache monitoring causing it to error out [GL:XI#2482] – BR
Fixed an issue with the LDAP / AD integration where subdirectories could occasionally fail to display properly [GL:XI#2442] – JS
Fixed CSS and links in Email Settings page [GL:XI#999] – ML
Fixed CSS mismatching logo issue on Manage Service Group menu [GL:XI#1093] – ML
Fixed setup_influx.sh for an issue with the initial installation of 1.12.3 [NOISSUE] – KF
Fixed SNMP Wizard dropping privacy protocol on error [GL:XI#2407] – BS

Removed

Removed options for SNMPv3 from the Windows SNMP Wizard [GL:XI!2367] – ZR

Updated

Updated Azure SSO to support US Government Azure tenants [GL:XI#2028] – BB
Updated install process to kill immediately when trying to install on a deprecated system [GL:XI#1981] – BR
Updated Nagios Plugins to 2.5 – CB
Updated NCPA wizard(s) socket timeout error message and increased default timeout value [GL:XI#1872] – CPD
Updated the Discord and Slack Wizard’s layouts to be consistent with other wizards [GL:XI#953, 955, 2421] – BR
Updated the Enterprise Features comparison modal [GL:XI#2373] – ZR
Updated the popular wizards on the Home Page to more accurately reflect the most popular wizards [GL:XI!2352] – BR
Updated the SNMP Walk Jobs page and SNMP Wizard to support a wider range of encryption protocols [GL:XI#2473] – BR, ZR

2026R1.3.1 - April 9, 2026

Fixes installation and upgrade failures caused by a PECL-SSH2 dependency issue.

Fixed

Fixed an issue causing installations and upgrades to fail due to a dependency issues with the Pecl-SSH2 package – BR

2026R1.3 - March 24, 2026

New Proxmox Wizard, a new generic Data Table dashlet type, more and better dashboard management options, plus lots and lots of fixes, updates, and removals.

Security

Fixed an XSS vulnerability in the login page [GL:XI!2281] – BB
Fixed an XSS vulnerability with Performance Graphs [GL:XI#2375] – BB

Added

Added a new Manage Smart Dashboards page, allowing admins to manage all users’ Smart Dashboards [GL:XI!2269] – ZR [Video Overview]
Added a search bar to the Manage Components and the Manage Plugins pages [GL:XI!2251] – BR
Added migration script to nagiosxi/scripts directory [NoIssue] – KF
Added support resources to the home page of Neptune theme [GL:XI!2256] – BR
Added the Data Table dashlet for Smart Dashboards [GL:XI#2353] – ZR [Video Overview]
Added the Proxmox Wizard, with special thanks for the inspiration to Sam Napier [GL:XI#2331] – BS [Video Overview]

Fixed

Fixed a CSS issue on the login.php page [GL:XI!2283] – BB
Fixed an issue causing content to be incorrectly sized on the Color Correction theme [GL:XI#2390] – ZR
Fixed an issue causing data source options to not display correctly under certain circumstances on the Graph Dashlet for Smart Dashboards [GL:XI!2262] – ZR
Fixed an issue causing links in some dashlets to redirect within the dashlet frame rather than the main window for Smart Dashboards [GL:XI#2399] – ZR
Fixed an issue causing the Legacy Dashboard Wizard to not function as intended [GL:XI!2267] – ZR
Fixed an issue where API imports of invalid configs failed silently but still returned a success response [GL:XI#2361] – EK
Fixed an issue where dependency rpm was not being installed [GL:XI#2439] – KF
Fixed an issue where Premium Features could be enabled on a free license [GL:XI#2426] – BR
Fixed an issue where routing could break due to mishandling of raw URLs [GL:XI!2276] – BB
Fixed an issue where some configuration files were missed during server migration [GL:XI#2401] – EK
Fixed an issue where the Add new user menu would have the Enable Notifications checkbox remain checked when unchecking Create as a Monitoring Contact [GL:XI#2392] – BR
Fixed an issue where the backup and restore process would not do so for the AD/LDAP integration [GL:XI#1321] – BR
Fixed an issue where the checkbox inside the Schedule Reports page would not work properly [GL:XI!2249] – BR
Fixed an issue where the modern charts in the Bandwidth Usage Report were not consistent with the old charts [GL:XI#2410] – BR
Fixed an issue where the MongoDB Wizards wouldn’t work on Ubuntu [GL:XI#2435] – BB
Fixed an issue where the NRDS directory used the /tmp directory for installing libraries meant for building [GL:XI!2242] – BR
Fixed an issue where the SNMP trap component would require fields for v2 that do not exist [GL:XI#2431] – BR
Fixed an issue where the SSO login button would still appear if the last tenant was deleted [GL:XI!2240] – BB
Fixed an issue with the NNA Wizard letting misconfigured instances progress though the wizard [GL:XI#2395] – BS
Fixed authentication issues with check_mongodb_3.py [GL:XI#2417] – BR

Removed

Removed a duplicate message from the SNMP Walk Jobs table when no jobs exist [GL:XI#2348] – JS
Removed DES options from the snmptrapsender component for systems where it is unavailable [GL:XI#2433] – BR
Removed left and right margins for wizards on the Neptune theme [GL:XI#2409] – JS
Removed support for CSP10 license key – CN

Updated

Moved the Import Smart Dashboard button to the new Manage Smart Dashboards page [GL:XI!2305] – ZR [Video Overview]
Updated CSS for new NagVis themes to improve legibility [GL:NagVis#40] – EK [Video Overview]
Updated default user options to allow for home page modification by default [GL:XI#2047] – BR
Updated Nagios Core to 4.5.12 [GL:XI!2270] – EK

2026R1.2 - February 24, 2026

Security

Fixed an XSS vulnerability with certain query parameters on the login page [GL:XI#2362] – CN
Added hide/show button to several sensitive text fields in Configuration Wizards [GL:XI#2363] – BR
Fixed several XSS and MitM vulnerabilities [GL:XI!2044,GL:XI!2044] – BB
Fixed several SQL injection vulnerabilities [GL:XI!2080] – BB

Added

Added Configuration Wizard and Plugins for Red Hat OpenShift – LG
Added a search filter to the SNMP Trap Wizard – [GL:XI#2208] – BR
Added credentials verification to vSphere Wizard [GL:XI!2063] – BS
Added experimental XI helper – AL
Added a combo box to replace some dropdown menus in NagVis [GL:NagVis!40] – BR, EK
Added handling for expired client secrets to SSO and the ability to migrate to a new key – BB
Added InfluxDB v1 test module and installation script – KF
Added line graph, stacked area graph, and legend options to the Graph dashlet on Smart Dashboards [GL:XI#2292, #2179] – ZR
Added new dark and light themes in NagVis [GL:NagVis!38] – NL, EK
Added new vSphere plugin [GL:XI#1852] – BS
Added no-click login feature via the option 'Bypass Login Page' for Automatic Login [GL:XI#2365] – ZR
Added pagination, search, and filters to the Group configuration mode for SSO [GL:XI#2334,2339,2347] – BB
Added preview image box when hovering over images in NagVis [GL:NagVis#31] – BR, EK
Added SVG support for NagVis shapes [GL:NagVis!34] – BR
Added the ability for SNMP Walk Jobs to handle walking SNMP devices that do not send sequential OIDs [GL:XI#1985] – JS
Added the ability to add dashlets to Smart Dashboards via the Dashify Button and Available Dashlets page [GL:XI#2207] – ZR
Added the ability to collapse the secondary navbar in the Neptune themes [GL:XI#2278] – BB
Added the ability to give SNMP Walk Jobs names [GL:XI#1985] – JS
Added the ability to redirect to status pages on click for the Statistic, Gauge, Pie Chart, and Bar Chart dashlets for Smart Dashboards [GL:XI#2252] -ZR
Added the ability to select a Smart Dashboard as the default dashboard when navigating to the Dashboards page [GL:XI#2144] – ZR
Added the ability to use custom actions via NagVis shapes [GL:NagVis!32] – BS, EK
Added tuning to SNMP Configuration to improve MIB translations [GL:XI#2326] – JS

Fixed

Fixed a number of bugs with SSO configurations in niche edge cases [GL:XI#2334,2339,2347] – BB
Fixed an incorrect label for unreachable hosts on the Pie Chart dashlet for Smart Dashboards [GL:XI!2117] -ZR
Fixed an issue causing the Manage Smart Dashboards page to fail to load on non-Neptune themes [GL:XI!2125] – ZR
Fixed an issue causing PHP warnings for the alert history V2 API endpoint [GL:XI!2096] – ZR
Fixed an issue in the Linux Server Wizard where an empty host name would result in broken html [GL:XI#2309] – BR
Fixed an issue in the Nagios Network Analyzer Wizard where the graph on step two would overlap with other elements [GL:XI#2301] – BR
Fixed an issue where the proper permissions were not being granted for the database, causing some scripts to error out [GL:XI#2317] – BR
Fixed an issue where the Network Report page would show a blank screen if the NNA Server was unreachable – [GL:XI#1986] – BR
Fixed an issue where the Upgrade scripts would call on the remote MSSQL Server [GL:XI#2088] – BR
Fixed an issue where RPM scripts would not work properly on cloud images of Red Hat Linux [GL:XI#1246] – BR
Fixed an issue where auto-discovery would not work upon upgrade on systems that we installed using the RPM method [GL:XI#2328] – BR
Fixed an issue where character affected by html_escape in 'ifalias' would break the Switch and Meraki Switch Wizard [GL:XI#1950] – BR
Fixed an issue where config imports could create invalid conifgs [GL:XI#1873] – EK
Fixed an issue where an empty announcement banner could crash XI – BB
Fixed an issue where entering an Enterprise key with an existing license key would result in an error [GL:XI#2286] – BR
Fixed an issue where disabling an LDAP server would not disable users associated with that server [GL:XI#2364] – BR
Fixed an issue where running the NCPA Wizard with multiple hosts would result in a hostname validation error [GL:XI#2374] – BR
Fixed an issue where several check commands were not being properly run (when done manually) [GL:XI#2377] – BR
Fixed an issue where legacy reports would return a 500 error [GL:XI#2381] – BR
Fixed an issue where reports were accessible with an invalid license [GL:XI#2386] – BR
Fixed an issue where service graphs would not appear due to a divide by zero error [GL:XI#2239] – BR
Fixed an issue where user IDs could be parsed wrongly for individually configured SSO users, causing wrong configurations [GL:XI!2142] – BB
Fixed an issue with performance graphs where critical and warning ranges would not show on graphs | As well as unreadable text | As well as a critical error in the graph [GL:XI#404] – BR
Fixed several V2 API issues with permissions for Smart Dashboards [GL:XI#2372] – ZR
Fixed tour cards not showing up in languages other than English [GL:XI#1859] – BR

Updated

Implemented pagination and search for SSO group management with SSO [GL:XI#2334,2339,2347] – BB
Improved error boundary technical details to be more informative and added buttons to copy and download information about the error [GL:XI!2130] – BB
Improved SNMP Walk Wizard visibility on smaller screens [GL:XI#1985] – JS
Improved stability of the user interface and several pages – BB, CN, ZR
Updated Legacy Reports menu to prevent confusion with other menu items with the same names [GL:XI#1784] – AW
Updated SNMP and NCPA Wizards to properly quote wrap community strings [GL:XI#1955] – JS
Updated the email subscription feature to automatically detect and update the subscription statuses if a user changes their email [GL:XI#1481] – BB
Updated the following Wizards: DigitalOcean, Google Cloud, Linode, Microsoft Azure, and the Rackspace Cloud Wizards to show the same information as the NCPA Wizard when configured with NCPA [GL:XI#2258] – BR
Updated the MSSQL Query Wizard to use TDSVersion option [GL:XI#1945] – BR
Updated the vSphere wizard to support new plugin [GL:XI#2302] – BS

Removed

Removed ability to change names of monitorable OIDs on SNMP Walk Wizard [GL:XI#1985] – JS

2026R1.1.1 - January 20, 2026

Added

Added input verification to the SNMP Walk Job operation in the CCM [GL:XI!1984] – BR
Added information on the server's operating system in the V2 API [GL:XI!2077] – BR
Added verification to check SNMP connection for SNMP Wizard [GL:XI#1982] – BR
Added AES-256-C authentication protocol for SNMP Walk Jobs [GL#XI2223] – BR

Fixed

Fixed an issue where the "Show only import directory" check box in the Import Config Files page would not work properly [GL:XI#2186] – BR
Fixed an issue with labels on pie charts overlapping with the lines pointing to them [GL:XI#2152] – BS
Fixed an issue with Multistacked Performance Graphs not displaying anything when a single data option is selected [GL:XI#2213] – BS
Fixed an issue where the Hostgroup Status Summary Legacy Dashlet was scaling too aggressively [GL:XI#2196] – BR
Fixed an issue where the Smart Dashboards page had incorrect URLs in the Schedule Reports menu [GL:XI#2280] – BR
Fixed an issue where the Tactical Overview page had several unreadable text boxes across all themes [GL:XI#2202] – BR
Fixed an issue where multiple checkboxes would be made for each VM in the Guest Selection tab [GL:XI#2285] – BS
Fixed an issue where the tab key would submit the current form once focused on the Next button in Configuration Wizards [GL:XI#1936] – BR
Fixed an issue where scheduled reports would not work when port 80 is disabled and use_https is true [GL:XI#2131] – BR
Fixed an issue where pdf reports would not attach a pdf for emails using the Microsoft with OAuth2 send method [GL:XI#1927] – BR
Fixed an issue where CSV reports would not send in scheduled reports [GL:#2296] – BR
Fixed an issue where the Use_HTTPS variable in the config file would not be set during install [GL:XI#2299] – BR
Fixed an issue where classic dashlets in the Smart Dashboard system would not be as responsive when resizing [GL:XI#2298] – BR
Fixed an issue where the popup for an invalid or expired license key when navigating to a Configuration Wizard would be broken [GL:XI#2290] – BR
Fixed an issue where Oracle upgrades failed due to unexpected lsb_release string [GL:XI#2256] – KF
Fixed an issue with the vSphere plugin leaving stale sessions in vCenter [GL:XI#1765] – BS
Fixed an issue causing dashlets in Smart Dashboards to display incorrect colors on the Color Correction theme [GL:XI!2087] – ZR
Fixed an issue where systems with remote databases would have partially broken upgrades – BB
Fixed an issue where the Network Switch / Router Wizard would not collect data for Cisco Nexus Devices [GL:XI#1916] – BR
Fixed an issue in the Birdseye view where the states of hosts would not properly update in real time [GL:XI#1910] – BR
Fixed an issue in the Migrate Server page where the progress table was not consistent with the theme [GL:XI#2311] – BR
Fixed an issue where NMG sync would fail while errantly attempting to escalate to root locally [GL:XI!2068] – GW
Fixed an issue where AD/LDAP users could be imported with an invalid email address [GL:XI#2323] – BR
Fixed an issue where upgrades would partially fail if some tables in the nagiosxi database were using the MyISAM engine by updating those tables to InnoDB – BB
Fixed situations where the Pie Chart and Bar Chart dashlets did not display error info for an improper configuration [GL:XI#2260] – ZR
Fixed Performance Graphs failing to load [GL:XI#2297] – BS

Updated

Updated External Sign-On (SSO) PHP warning to no longer include link to out of date documentation – BS
Updated DUO Component CA Certificates [GL:XI#2330] – BR
Updated DUO Component Version to work with new certificates [GL:XI!2122] – BR
Updated links within DUO Component with up-to-date instructions [GL:XI!2110] – BR
Updated smart dashlet tooltips to show up regardless of dashlet size [GL:XI2027] – BR
Updated the vSphere Wizard with a link to documentation instead of hardcoded commands – BS
Updated the SNMP Walk Job Modals | As well as the SNMP Wizards to hide passwords [GL:#2128] – BR
Updated validation to AD/LDAP to include preventing invalid characters in XI usernames [GL:XI#2284] – JS

Removed

Removed broken port type from menu in the Network / Switch Router Wizard and its derivatives. – KF
Removed php-imap from dependency lists. – KF

2026R1.1 - December 16, 2025

Security

Changed ownership of constants.inc.php to fix a privilege escalation vulnerability (Thanks to Cory Billington for reporting this) [GL:XI#2189] – CN
Updated Active Directory wizard to prevent storing creds unnecessarily (Thanks to Daniel Moura, Guilherme d'Ávila and Paulo Victor for reporting this) [GL:XI#2056] – JS

Added

Added UI pagination for AD/LDAP [GL:XI#1502] – JS
Added the ability to search for hosts, services, hostgroups, and servicegroups when configuring a Smart Dashlet – BR
Added support for NNA 2026 to the Nagios Network Analyzer wizard [GL:!1939] – GW
Added SSO support for configuring users via groups with AAD [GL:XI#1966,2026] – BB

Fixed

Fixed an issue where Nagios Mod-Gearman commands would fail due to incorrect log file permissions [GL:XI!1945] – GW
Fixed an issue where the "Add to My Views" button did not work properly in any theme besides Neptune [GL:XI#2228] – BR
Fixed an issue causing users with insufficient permission to be able to view the titles of Global Dashboards from the Home Page Options page [GL:XI#2243] – ZR
Fixed an issue with scaling for the Graph Explorer and Capacity Planning dashlets on Legacy Dashboards [GL:XI#2218] – ZR
Fixed an issue where the NagVis link would redirect the user to the wrong URL if nagiosxi was in the address [GL:XI#2266] – EK
Fixed an issue where the list of currently selected LDAP users wasn't properly updating [GL:XI#1502] – JS
Fixed an issue causing the "Switch to Modern" button to not refresh the page in some cases [GL:XI#2275] – ZR
Fixed an issue where LDAP entities with the "Person" type weren't properly displaying usernames and type icons [GL:XI#1502] – JS
Fixed an issue causing the premium feature popup to display incorrect information on configuration wizards [GL:XI#2151] – ZR
Fixed an issue where users could get permanently locked out of XI until they deleted their cookie [GL:XI#1863] – BB
Fixed an issue in init-mysql where disable_log_bin was not added by MySQL configuration adjustments [GL:#2244] – KF
Fixed an issue where the vSphere plugin would make all services uppercase [GL:XI#2257] – BS
Fixed an issue causing some items to incorrectly appear as a link on search for Neptune themes [GL:XI#2274] – ZR
Fixed an issue that made hovered options in dropdown search menus unreadable [GL:XI#2259] – BR
Fixed an issue where the Home Page Mod Link would not work for Neptune Themes [GL:XI#2242] – BR
Fixed an issue with FQDN validation in CCM Run Check Command [GL:XI2160] – BR
Fixed an issue causing font size to be smaller than expected for performance graphs [GL:XI#2205] – BS
Fixed an issue where an asterisk would appear in hostnames in the operations center [GL:XI#2206] – BR
Fixed unreadable text popup in the Alert Stream report when there's no data – BR
Fixed numerous issues with SSO, including large userbases [GL:XI#1966,2026,2246] – BB
Fixed cases where the Treemap, Bar Chart, and Pie Chart Smart Dashlets would be unable to filter host and service data [GL:XI#2236] – ZR
Fixed overlapping text on exported graph legends [GL:XI#2164] – BS
Fixed PHP warnings in vSphere wizard for PHP 8.x [GL:XI#1962] – BS
Fixed several issues related to default language handling that could result in 404 errors [GL:XI#2268] – CN, BR, BB

Removed

Removed deprecated VMWare Configuration Wizard and plugin – CN

Updated

Updated AD/LDAP component to dynamically detect UID or CN as the base RDN [GL:XI#1502] – JS
Updated the Neptune home page to feature trial resources for users with a trial license [GL:XI!1927] – ZR
Updated link in Admin > System Information > Check for Updates to the most up-do-date documentation [GL:XI#2248] – BS
Updated the Bar Chart Dashlet in Smart Dashboards with various improvements to usability [GL:XI#2170] – BR, CN
Updated Status page headers to allow more space for host/service titles [GL:XI#2264] – ZR
Updated install page to make theme selection easier [GL:XI#2219] – CN
Updated SSO to drastically improve performance for logging in and configuring users – BB

2026R1.0.1 - November 11, 2025

Security

Fixed a Command Injection vulnerability within the following wizards: Zabbix Agent, Esensors Websensor, MongoDB Database, MongoDB Server, MySQL Query, Postgres Database, Postgres Query, and Postgres Server (Thanks to Vladislav Berghici of Trend Micro Research for reporting this) [GL:XI#2192,#2193,#2194] – CJD

Added

Added ability to group OIDs by either interface or MIB name in SNMP Walk Wizard [GL:XI#1985] – JS
Added ability to select multiple datasources in Smart Dashboard Graph dashlet [GL:XI#2167] – ZWR
Added ability to select Smart Dashboards as the XI home page via Home Page Modification [GL:XI!1852] – ZR
Added ability to use relative URLs when creating a View [GL:XI#2062] – DN
Added character limits to dashboard and dashlet titles for Smart Dashboards [GL:XI#2133] – ZR
Added update users endpoint to the v1 API [GL:XI!1862] – AC
Added Y axis labeling so the Graph in Smart Dashboards knows when to use the data labels better and adds custom labels [GL:XI#2166] – ZWR

Fixed

Fixed a plugin issue causing incorrect latency and execution time values to be returned [GL:XI2025] – DN
Fixed a broken Edit Settings link for the Custom Variable Tab in the Manage Components page [GL:XI#2185] – DN
Fixed an issue where legacy striped tables do not have colors set in light themes [GL:XI#2102] – JC
Fixed an issue causing status cells on the Neptune home page to not filter the Host/Service Status page based on selected status type [GL:XI!1846] – ZR
Fixed an issue causing a flicker when adding dashlets [GL:XI#2145] – ZWR
Fixed an issue causing 2014 and Classic themes to be unable to access pages written in React [GL:XI#2178] – ZR
Fixed an issue where the Smart Dashboard Treemap dashlet could load inaccurate data [GL:XI#2165] – JC
Fixed an issue where the path was wrong for the Mod Gearman popup [GL:XI#2168] – ZWR
Fixed an issue causing gauges on Legacy Dashboards to not render with PHP version 8.4 [GL:XI#2176] – ZR
Fixed an issue where the Smart Dashboard Graph dashlet's tooltip doesn't have a needed space [GL:XI#2177] – ZWR
Fixed an issue that was causing some bar graphs to render as line graphs [GL:XI#1974] – DN
Fixed an issue where the banners did not show in fullscreen [GL:XI#2110] – ZWR
Fixed an issue where new views couldn't be added in non-Neptune themes on the views page and in the top-right menu due to a race condition. [GL:XI#2159] – BB
Fixed an issue where users couldn't log in due to duplicate IDs on the login page – BB
Fixed an issue causing installs to fail in some IPV4 only environments [GL:XI#2020] – DN
Fixed an issue causing improper text overflow for long dashboard and dashlet titles [GL:XI!1901] – JC, ZR
Fixed an issue where tooltips weren't wrapping properly – BB
Fixed an issue where rrd export could target a nonexistent field, breaking performance graphs [GL:XI#2181] – JC
Fixed an issue where tray alert would show empty content [GL:XL#2155] – JC
Fixed an issue where the Nagios plugins for Nagios Mod-Gearman did not build – CB
Fixed several routing issues [GL:XI#2103,#2115,#2136] – BB

Updated

Updated value field of xi_options in database to accommodate more text [GL:XI#2137] – JC
Updated tray alert to show for non-admin users [GL:XL#2155] – JC
Modified critical status color and link colors to be more readable in non-Neptune themes [GL:XI#2162] – JC
Removed 5.x.x conditionals from installation/upgrade process – KF
Improved installation/upgrade logging – KF
Updated system profile script – CD

2026R1 - September 24, 2025

Security

Fixed an RCE vulnerability with the Run Check Command in the CCM (Thanks to “D3LT4” for reporting this)[GL:XI#1969] – JS
Fixed a Command Injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards (Thanks to Cory Billington for reporting this) [GL:XI#1953] – JS

Updated

Updated Dashboards Menu to support Legacy and Smart Dashboards in Neptune [GL:XI#2003] – ZWR
Updated Dashboards Menu to support Legacy and Smart Dashboards in Modern [GL:XI#2011] – ZWR
Reduced padding on Gauge Dashlet [GL:XI#2008] – JC
Improved error handling app-wide [GL:XI#1874] – BB
Updated the fullscreen toggle button to include a tooltip on hover [GL:XI#2040] – DN
Updated NagVis default config to enable all default context menu actions [GL:NagVis#27] – DN
Updated dashboard wizard to navigate to new dashboard after creation [GL:XI#2069] – CPD
Moved the export menu icon in Multistacked Performance Graph to match the others in Graph Explorer [GL:XI#2000] – DN
Renamed the “History” tab on Status Detail pages to “Notification History” for clarity [GL:XI#2049] – DN
Updated SNMP Walk wizard to group OIDs by Interface rather than MIB Type [GL:XI#1985] – JS
Updated Gauge Dashlet styling in Legacy Dashboards [GL:XI#2014] – MK

Added

Added Configuration Wizard for Meraki Switches – KF
Added Smart Dashboards – GW, ZR, ZWR, CPD, MK, JC, BB
Added Global Dashboard system for Smart Dashboards [GL:XI#2015] – ZR
Added Smart Dashboard exporting and importing [GL:XI!1732] – CPD
Added the following dashlets for Smart Dashboards: Graph dashlet [GL:XI!1708] – CPD
Bar Chart dashlet [GL:XI#1697] – JC
Gauge dashlet [GL:XI!1716] – ZR
Pie Chart dashlet [GL:XI!1741] – JC
Statistic dashlet [GL:XI!1698] – ZR
Text dashlet – ZR
Treemap dashlet [GL:XI#2012] – JC
URL dashlet – ZR
Alert Heatmap dashlet [GL:XI#2005] – CPD, MK
Added support for existing dashlets in Smart Dashboards [GL:XI!1728] – JC
Added default website host: “Google” – JC
Added default hostgroups: “Websites” and “Switches” – JC, MK
Added default servicegroups: “Web Services” and “SSL Certificates” – JC, MK
Added new home page for Neptune themes [GL:XI#2010] – ZR, JC
Added ability to change dashboard icon color in Neptune – BB
Added dashboard wizards for Smart Dashboards and Legacy Dashboards [GL:XI#1795] – CPD
Added usage statistics with opt in/out [GL:XI#1387] – LG
Added NagVis custom actions to allow remote restarts of properly configured Windows and Linux machines [GL:NagVis#12,13] – EK
Added options to enable experimental features for future use [GL:XI#2013] – ZR
Added hover border for Legacy dashlets with transparent backgrounds (GL:XI#2016) – MK
Added error logging to SSO – BB
Added “re-run job” feature to SNMP Walk Jobs page [GL:XI#1985] – JS
Added new digital clock dashlet to replace world time clock for Legacy Dashboards [GL:XI#2006] – ZWR
Added “How to Use” Nagios Library article links to wizards [GL:XI#2116] – LG
Added a “Getting Started” notification at login for first time users with link to a getting started guide [GL:XI#2063] – LG

Fixed

Fixed NagVis icon scalability [GL:NagVis#16] – DN
Fixed navigation issue with “Legal” link in the footer [GL:XI#2103] – DN
Fixed a PHP Warning in the Website wizard [GL:XI#2081] – JS
Fixed an issue where passwords containing special characters were not being properly escaped by various Wizards [GL:XI#1955] – JS
Fixed an issue where the host and service status pages would not properly show pending hosts and services [GL:XI#232,#260] – AC, GW, TL
Fixed an issue where privileged help links were being shown to non-admin users [GL:XI#1994] – DN
Fixed an issue with the cloud-vm, linux-server and ncpa wizards, where checked interfaces would be hidden [GL:XI#1967] – AF, LG
Fixed a grammar issue with “the the” on Wizard Step 5 [GL:XI#1967] – LG
Fixed an issue where the RSS dashlet could no longer receive data feeds [GL:XI#1894] – DN
Fixed an issue where the permalink dialog box would not close when switching pages in Modern theme [GL:XI#1892] – AF
Fixed an issue where EC2 instances were displayed in the wrong region [GL:XI#1973] – LG
Fixed DNS Query wizard losing user data coming back from step four [GL:XI#525] – HM
Fixed DHCP wizard losing user data coming back from step four [GL:XI#525] – HM
Fixed an issue where logins via SSO weren’t being displayed properly on the manage users page [GL:XI#2054] – BB
Fixed an issue where you could not add websites with the website configwizard [GL:XI#2099] – CPD
Fixed an issue with the Tour displaying on top of the Login notifications in Neptune [GL:XI!1815] – LG
Fixed an issue where various Help links were navigating to outdated resources [GL:XI#2052] – DN
Fixed an issue where a missing PHP timezone could prevent the CCM from successfully applying changes [GL:XI#2135] – JS

2024R2.2.1 - September 5, 2025

Fixed

Fixed an issue where the Website wizard would always error on Step 1 [GL:XI#2081] – JS

2024R2.2 - September 3, 2025

Security

Updated SourceGuardian loaders to now support PHP versions up to 8.4 – CB, GW

Fixed

Fixed an issue where Nagios Mod Gearman install was blocked by local GPG checks [GL:XI#2029] – GW

2024R2.1 - August 12, 2025

Security

Fixed an XSS vulnerability with certain parameters in the Graph Explorer feature (Thanks to Marius Lihet for reporting this) [GL:XI#1968] – JS

Updated

Updated the SNMP Walk Wizard to use jobs created by the SNMP Walk Jobs page [GL:XI#1474] – JS
Improved functionality of step 2 of the SNMP Walk Wizard with MIB grouping and select all [GL:XI#1474] – JS

Removed

Removed support for Ubuntu 20 due to EOL [GL:XI#1836] – LG

Added

Added Nagios Mod-Gearman integration [GL:XI#1242] – DA, GW
Added support for new license levels [GL:XI!1710] – LG
Added an “SNMP Walk Jobs” page to manage SNMP Walk scans separately from the SNMP Walk Wizard [GL:XI#1474] – JS

Fixed

Fixed an issue where users without a home dashboard would have null dashboards added when copying, editing, or deleting a dashboard [GL:XI#1975] – BB
Fixed an issue where check_radius.py returns an invalid radius attribute [GL:XI#1282] – RA,NN
Fixed an erroneous log message writing to Step 1 of the Kubernetes Wizard [GL:XI!1707] – LG
Updated version logic for logrotate config changes to always reapply when upgrading to or above this version [GL:XI#333] – JS
Fixed an issue where the capacity planning report graphs would not stay open in full screen [GL:XI#1989] – GW
Fixed an issue where the page used to import SSO users was unusable when many users existed [GL:XI#1966] – BB, GW

2024R2 - July 3, 2025

Security

Fixed security issue in WinRM wizard (Thanks to Leo Trinh for reporting this) [GL:XI#1361] – DA
Changed ownership on process_perfdata.pl to prevent permission escalation (Thanks to Cory Billington for reporting this) [GL:XI#1613] – JS

Updated

Updated system profile script – KF
Updated wizard search bar to now sort based on closeness rather than alphabetically [GL:XI#1862] – JC
Updated the edit map menu in NagVis, so that it can be accessed anywhere with a right click – RM
Updated forum support link in NagVis to point towards Nagios Support Forums [GL:OSNV5] – EK
Updated relative positioning in NagVis to work with all map elements except lines [GL:OSNV9] – EK
Updated Highcharts to version 11.2.0 – [GL:XI#573] – JM

Added

Added SSO integration with Azure AD [GL:XI#124,#125,#1374,#1359,!1168] – BB, SG
Added a banner that notifies users when they are approaching EOL [GL:XI!1175] – AC
Added support for automatically applying CSP license [GL:XI!1174] – DA
Added support for check_nrpe to the NSClient++ wizard and updated its status to non-legacy [GL:XI!1205] – BB
Added Generic Plugin Wizard [GL:XI!1197] – DA, BB
Added search bar and filtering options to Available Dashlets page [GL:XI#1791] – ZR
Added support for premium wizards [GL:XI#1395] – LG, GW, SG
Added Kubernetes Wizard to monitor Kubernetes Clusters through NCPA. [GL:XI:!1213] – LG
Added the ability to subscribe to updates, tips and tricks via email settings. – BB
Added the ability to deploy NCPA v3 [GL:#1663] – GW
Added missing support in NagVis for Nagios custom variables with an NDO backend [GL:OSNV11] – EK
Added Zabbix Agent Wizard – AH, NS

Fixed

Fixed issue where offline install and upgrade copied files it didn’t need to – DA
Fixed an error with upgrading RPM’s [GL:XI#1445] – DA
Fixed an issue causing PHP warnings for the EOL banner [GL:XI!1206] – AC
Fixed a backup/restore issue with newer versions of MariaDB. – KF, BB
Fixed UserAgent and Host request headers for HTTP/1.1 call. [#1364] -CD, KF
Fixed issue where dependency deprecation breaks the the wizard [#1314] – KF
Fixed an issue where highchart dashlets could not be added from the template dashboard [#1925] – GW
Fixed an issue where Top / Recent Wizards would try to show deleted wizards [GL:XI#1901] – BB
Fixed an issue where some commands were left unsorted [GL:XI#1944] – EK
Fixed an issue where the Twilio Text tab is blank under Notifications Methods [GL:#1938] – RA, KF
Fixed an issue where the Twilio was not processing country code correctly [GL:#1219] – RA, KF
Fixed an issue where Chromium wasn’t installing properly on RPM installs, preventing PDF downloads – CB, BB

2024R1.4.4 - June 6, 2025

Security

Updated NagVis to the latest open source version with new features and security fixes. [GL:NagVis#8] – EK,DN

Updated

Updated behavior when clicking on map icons in NagVis so that links open in new tabs. [GL:NagVis#3] – EK
Updated NagVis demo maps to new American maps [GL:NagVis#2] – EK
Updated passive check wizard with useful messages about configuring unconfigured objects, making it easier for users to configure and troubleshoot passive checks in Nagios XI – BB

Removed

Removed support for CSP50 licensing

Added

Added Prometheus Wizard – TL
Added documentation to help AWS EC2 users setup the correct IAM permissions for EC2 check data from AWS [GL:XI#1412]
Added documentation to help AWS EC2 users setup EC2 instances to allow XI to receive Disk Check data from AWS [GL:XI#1357]

Fixed

Fixed permalink generation for all reports [GL:XI#1890] – BB
Fixed an issue in the CCM where selected templates were not parsed to determine whether fields should be required [GL:XI#1759,#1879] – BB
Fixed an issue where several required fields were not being validated in the CCM [GL:XI#1896] – BB
Fixed an issue in the check for updates where the link for Nagios XI Upgrade Instructions was pointing to v5 doc [GL:XI#1902] – RM
Fixed dependency issues for scheduled backups for users trying to upgrade PHP (pecl-ssh2) [GL:XI#1776,#1905] – NN, LG
Fixed an error with upgrading RPM’s [GL:XI#1445] – DA
Fixed an issue where incorrect data was displaying in the instance list of the AWS EC2 wizard [GL:XI#826,#1846,#1817] – LG
Fixed a query hanging issue for the AWS EC2 wizard by adding a reasonable timeout when querying Instance data [GL:XI!1638] – LG, CN
Fixed an issue where the AWS Boto3 requires Python 3.8+ [GL:XI!1638] – LG

2024R1.4.3 - May 21, 2025

Security

Fixed a fatal PHP error in NagVis from geomaps without source files [GL:NagVis#4] – EK

Updated

Updated tooltips on Available Dashlets page -ZR

Fixed

Fixed an issue with the Network Switch / Router wizard where Bulk Configuration options were reversed for SNMPv3 vs v1 and v2 [GL:XI#1882] – JS
Fixed an issue where Event Log and Notifications reports reloading would make them unusable if Auto-Running was disabled [GL:XI#1883] – BB
Fixed an issue where Event Log and Notifications reports wouldn’t generate permalinks properly [GL:XI#1475] – BB
Fixed an issue with map names overlapping in the NagVis sidebar [GL:NagVis#6] – EK
Fixed an issue with the Session Timeout so it can now be set to unlimited (0) [GL:XI#1631] – LG
Fixed an issue where required fields in the CCM would block saving even if a template was present [GL:XI#1759,#1879] – BB

2024R1.4.2 - May 13, 2025

Security

Fixed an issue with BPI configuration and log files (Thanks to M. Cory Billington for reporting this) [GL:XI#1613] – JS
Fixed a permissions insecurity for nagios.service (removed execute permissions) [GL:XI#1392] – NN
Fixed an issue with the unsafe use of the serialize PHP function [GL:XI#1400] – NN
Fixed an issue where an API key was shown to users without API access in Neptune themes [GL:XI#1845] – NS
Update nagvis to 1.9.44 (numerous security fixes and more) [GL:XI#1608, GL:OSNV3] – LG

Updated

Moved dashboard help and favorite buttons into the menu button and right click menu [GL:XI#1754] – TL
Updated the dashlets minemap and bbmap to have scale buttons – CJD, BB
Updated SNMP plugins for the Linux SNMP and Windows SNMP wizards [GL:XI#22] – TL
Updated the check_xml plugin’s help menu and verbose debug output to be more useful [GL:XI#1297] – TL
Updated the OpenAI wizards styling [GL:XI#1394]
Updated the OpenAI wizard to use a new plugin [GL:XI#1394] – CJD
Updated vsphere wizard pyvmomi module install instructions [GL:XI#1818] – CJD
Updated highlight effects when hovering ‘Add to dashboard’ button [GL:XI#1768] – ZR
Updated custom text dashlet to have a character limit [GL:XI#1633] – CJD
Updated Windows SNMP wizard timeout to 10 seconds [GL:XI#1270] – CJD
Updated CCM to display service name when deleting a service [GL:XI#1214] – CJD
Updated enterprise feature warning banner to be consistent between themes [GL:XI#1391] – CJD
Updated Powershell plugins to the latest Powershell version in nagios-windows-plugins [GL:XI#1196] – MPB, RP

Removed

Removed old plugin check_ncpa.py from cloud-vm wizard [GL:XI#1671] – LG
Removed Capacity Overview dashlet enterprise warning message [GL:XI#1687] – CJD
Removed various fonts from the Custom Text dashlet that caused errors on Linux and Mac systems [GL:XI1665] – CJD
Removed jQuery 3.3.1 [GL:XI#1562] – TL
Removed superfluous buttons from Highcharts dashlets [GL:XI1611] – ZR
Removed out of date restore_defaults script that restored XI to defaults incorrectly [GL:XI#1857] – NN
Removed external Highcharts exporting [GL:XI#1356] – TL
Removed the plus symbol from the list of illegal characters [GL:XI#598] – CJD
Removed mibdepot link [GL:XI1547] – NS
Removed unwanted options from Multistacked performance graph [GL:XI#1592] – AL
Removed “Show Errors” button in “Apply Configuration” and always display errors [GL:XI#1844] – JJ
Removed border from theme preview image [GL:XI#1865] – JJ

Added

Added the ability to reconfigure existing dashlets on a dashboard [GL:XI#1676] – TL
Added the ability to auto-arrange dashlets on a dashboard via the menu button and right click menu [GL:XI#1753] – NS, TL
Added scrollbars to the Minemap dashlet – TL
Added scrollbars to the BBmap dashlet – CJD
Added new monitoring options in the OpenAI wizard – CJD
Added the ability to click the entire preview image to add a dashlet to a dashboard on the Available Dashlets page [GL:XI#1768] – ZR
Added the ability to toggle dashlet backgrounds in Neptune themes – TL, BB
Added popup to login page allowing users to set the language for their entire instance, previously limited to login page only [GL:XI#1778] – AW
Added documentation notice about NCPA configuration for Docker in Docker wizard [GL:XI#851] – RP

Fixed

Fixed OpenSSL package issue for CentOS 9 [GL:XI#1855] – SG, GW, TL
Fixed vsphere wizard to display data properly on the datastores page [GL:#NOISSUE] – NN
Fixed an issue where the Custom URL dashlet would not allow other Nagios XI pages to be embedded [GL:XI#1781] – TL
Fixed an issue where the Linux SNMP and Windows SNMP wizards had improper timeout durations [GL:XI#1824] – TL
Fixed an issue where the ‘Not Authorized’ error message was not styled in the Neptune theme [GL:XI#1812] – TL
Fixed tour cards rendering off screen on small screens in the Modern theme [GL:#1668] – HM
Fixed an issue where the content of custom dashlets would appear outside of the dashlet [GL:XI#1811] – TL
Fixed an issue where graphs on the Capacity Planning page would be blank if the host had no data [GL:XI#326] – TL
Fixed an issue where services were being added incorrectly in SNMP wizard [GL:XI#810] – HM
Fixed a styling issue on dark themes where Alert Timeline text would be too light [GL:XI#1830] – CJD
Fixed an issue where not having a default input and output rate on the Switch & Router wizard would break Step 2 [GL:XI#1828] – TL
Fixed an issue in certain wizards where finishing with a template lost user service selections [GL:XI#746] – HM
Fixed misspelling of Deutsch in language dropdowns [GL:XI#1787] – AW
Fixed an issue where an LDAP server password with certain characters would malform bash command [GL:#1149] – HM
Fixed an issue where dashboards would not resize when a dashlet was resized beyond the visible area [GL:XI#1610] – TL
Fixed an issue where the Administrative Tasks dashlet did not render all elements when Important Tasks are present for the user [GL:XI#1814] – HM
Fixed an issue where some CCM forms would not populate fields with a value of 0 [GL:XI#1476] – TL
Fixed an issue where the Modern Dark theme did not have dark scrollbars [GL:XI#1789] – TL
Fixed an issue not allowing .bmp files to be uploaded to custom-includes [GL:XI#1849] – NN
Fixed an issue where dashlet titles would appear when ‘Hide Title’ was clicked [GL:XI#1622] – TL
Fixed an issue where the Add View form would not reset after submission [GL:XI#1698] – TL
Fixed an issue where help and favorite icons were visible in improper locations [GL:XI#1504] – TL
Fixed Performance Graph not showing any data on creation [GL:XI#1694] – NS
Fixed an issue where the NCPA wizard form would break on small screens [GL:XI#1308] – NN
Fixed text wrapping in the CCM Select option buttons [GL:XI#1700] – ZR
Fixed an issue where form selections were being lost on step two when a user encountered an error in NCPA wizard [GL:XI#1497] – HM
Fixed an issue in the XML plugin where URLs would break when using the -R option [GL:XI#1295] – CJD
Fixed an issue where trial extensions would not function properly [GL:XI#1797] – CN, TL
Fixed an issue in the Auto Configure settings where checkboxes didn’t save input [GL:XI#1151] – CJD
Fixed an issue where the World Map layers icon overlapped the favorite icon in Modern themes [GL:XI#1641] – TL
Fixed an issue where the Neptune theme wasn’t using individualized Host icons [GL:XI#1503] – HM
Fixed an issue with SOAP causing many PHP-FPM error messages [GL:XI#1842] – NN
Fixed an issue where dashboard colors would break when adding many dashlets in quick succession [GL:XI#1514] – NS
Fixed an issue where the config menu dropdown remained open/nav bar elements stayed darkened when user ends tour on steps with it open [GL:XI#1585] – HM, NS
Fixed an issue where the “Do not Apply Configuration” tooltip doesn’t dismiss in Configuration Wizards [GL:XI#1649] – TL
Fixed an issue where the SLICENSE.TXT popup would not appear on the 2014 and Classic themes [GL:XI#1659] – TL
Fixed an issue where the Watchguard wizard wasn’t properly adding selected ports [GL:XI#1147] – NN
Fixed an issue where the Monitoring Engine Stats dashlet had incorrect preview images [GL:XI#1629] – TL
Fixed an issue where hosts selected in Auto Discovery results didn’t transfer over to the deploy agent screen [GL:XI#1368] – CJD
Fixed an issue where adding a new View would display a success message when no view was added [GL:XI#1679] – TL
Fixed an issue where an incorrect error message would display on performance graphs [GL:XI#1628] – TL
Fixed opacity in the Custom URL dashlet [GL:XI#1644] – AL
Fixed bandwidth usage report PDF downloading to properly show highchart graphs [GL:XI#1685] – NN
Fixed API – Common Solutions page typo and added missing information [GL:XI#1566] – CJD
Fixed an issue where a Dashlet would not remain on top of other Dashlets when brought to the front [GL:XI#1767] – TL
Fixed an issue where the Undo and Redo buttons would be hidden behind Dashlets on Dashboards [GL:XI#1639] – AL
Fixed an issue where SLA Report PDFs were being cropped erroneously [GL:XI#1528] – HM
Fixed an issue where the Operations screen would remain dark in the Neptune Light theme [GL:XI#1703] – HM
Fixed an issue where the Enterprise banner would overlap data in Report PDFs [GL:XI#1525] – NN
Fixed an issue where users would be erroneously redirected to the “Home Page” Dashboard when adding/removing a Dashboard from favorites [GL:XI#1505] – NN
Fixed certain dashlets to comply with Color Correction theme [GL:XI#1612] – CJD
Fixed an issue where system timeout settings could be set to negative values [GL:XI#1603] – TL
Fixed an issue where the Printer and Website Wizards were not saving data when going back from step four [XI:#1587] – HM
Fixed an issue where new disk usage checks would not have default warning and critical thresholds in the Linux SNMP Wizard [GL:XI#1183] – TL
Fixed an issue where the custom Dashboard background color was not working properly on non-Neptune themes [GL:XI#1654] – MK
Fixed an issue where the current value of an OID would not be fully visible in the SNMP Walk wizard [GL:XI#1386] – TL
Fixed an issue where upgrading NagVis would fail due to incorrect file paths [GL:XI#1490] – LG
Fixed an issue where the default layout directive was not being respected for the Network Status Map [GL:XI#1758] – NN, CJD
Fixed an issue where the Alert History dashlet showing history before the XI instance was created [GL:XI#1593] – AL
Fixed an issue where dashboard names would not wrap properly, causing the name to be cutoff [GL:XI#1760] – ZR
Fixed an issue in Website Wizard where the checkbox label checked an incorrect checkbox [GL:XI#1783] – HM
Fixed an issue where the Highchart Dashlet’s context menu was not fully visible when the dashlet was small [GL:XI#1696] – TL
Fixed an issue where Help button dropdown in the upper right of the interface was displaying on every reload [GL:XI#1664] – HM
Fixed an issue where the navigation header items in the tour darken incorrectly in step 7 [GL:XI#1777] – HM
Fixed an issue where Tours wouldn’t reset properly in the Neptune theme [GL:XI#1554] – NS
Fixed an issue in Graph Explorer that caused input form formatting to break [GL:XI#1520] – NS
Fixed Host and Service History not showing up properly in the History tab of the respective Detail pages [GL:XI#1799] – NS
Fixed Nagios Core login alert displaying on unified pages when the user is already authenticated in Nagios XI [GL:XI#1350] – NS
Fixed various Firefox Neptune theme issues/inconsistencies [GL:XI#1427] – NS
Fixed various visual bugs in the BBMap Dashlet [GL:XI#1660] – AL, CJD
Fixed font consistency in the Manage Users table header [GL:XI#1763] – HM
Fixed various bugs with the functionality and user experience of using Dashboards and Dashlets – BB
Fixed an issue where the configuration menu for the Custom Text dashlet would appear off-screen [GL:XI#1623] – CJD
Fixed an issue in NagVis where users couldn’t properly exclude members or states [GL:XI#1496] – EK
Fixed an issue where the application footer wasn’t being properly stuck to the bottom of the browser window [GL:XI#1604] – NS
Fixed a required field styling issue in Configuration Wizards [GL:XI#1521] – CPD
Fixed the Hypermap Dashlet so multiple can be on the same Dashboard without errors [GL:XI#1773] – CJD
Fixed an issue where a Wizard could be added to favorites more than once [GL:XI#1597] – EK
Fixed a typo in Add New User page [GL:XI#1762] – CJD
Fixed an issue where the Permalink and Popout options lost filter selections for the Event Log and Host Notification pages [GL:XI#1475] – NS
Fixed the CCM Add Command Help Overlay styling to match other Help Overlays [GL:XI#1507] – EK
Fixed a visual bug where the View Host Status Details button icon for localhost would fail to show [GL:XI#1517] – JC
Fixed an issue in the Ubuntu version check to prevent unsupported versions from passing initial validation [GL:XI#1808] – NS
Fixed an issue where users could not edit Graph Templates due to incorrect permissions [GL:XI#1582] – NN
Fixed an issue where ampersands (&) were not being displayed properly [GL:XI#1646] – NN
Fixed an issue where the Introduction Tour would not continue to the Wizard Tour in the Neptune theme [GL:XI#1809] – NS
Fixed an issue where Dashlet contents would be off-center after resizing the Dashlet [GL:XI#1816] – NS
Fixed an issue where the Birdseye view would stay dark in the Neptune Light theme [GL:XI#1625] – NS
Fixed an issue where the minimize button would be rendered behind banners in the Modern and Modern Dark themes [GL:XI#1645] – NS
Fixed issue in the vSphere plugin where dividing by zero was possible when checking VMFS [GL:XI#1498] – CJD
Fixed an issue in the MySQL Server Wizard where input boxes would change sizes on input [GL:XI#1550] – NS
Fixed an issue where users could input long Dashboard names and crash the system [GL:XI#1680] – NS
Fixed an issue where the Network Status Map was positioned incorrectly [GL:XI#1756] – CJD
Fixed an issue where required fields in the Core Configuration Manager were not being treated as required [GL:XI#1759] – CJD
Fixed an issue where the “Remove” tooltip stays on screen after removing a View on the Manage My Views page [GL:XI#1678] – CJD
Fixed an issue where the “More Components” tooltip was appearing off-screen [GL:XI#1519] – CJD
Fixed an issue where the same warning banner appears twice in Classic and 2014 themes on Schedule New Page [GL:XI#1651] – CJD
Fixed an issue where clicking outside of a popup didn’t close the popup window [GL:XI#1634] – CJD
Fixed an issue preventing PDF report downloads [GL:XI#1509] – JS
Fixed an issue where Host icons overlap on Detail pages when the “Acknowledged” icon is also present [GL:XI#1225] – CPD
Fixed a storage calculation issue with disks over 2TB in the Windows SNMP plugin [GL:XI#506] – NN
Fixed an issue in the NCPA Plugin that would cause out of bounds errors [GL:XI#1431] – RP
Fixed Operations Center tooltips not disappearing if they are visible when the table refreshes [GL:XI#1529] – NS
Fixed an issue causing “Gateway Timeout” errors to not be styled properly in the Neptune theme [GL:XI#1078] – DN
Fixed an issue where logging out would not always preserve the user’s selected language [GL:XI#1513] – DN
Fixed an issue where the hover effect flickered when hovering “Dashify” buttons on Dashlets [GL:XI#1558] – MK
Fixed an issue where deleting or inactivating the last service in a service group caused an Apply Configuration error [GL:XI#677] – RP
Fixed an issue of text wrapping causing contents to spill out of container [GL:XI#1755] – AL
Fixed an issue where banners were being blocked by dashlets in the Classic and 2014 themes [GL:XI#1617] – EK
Fixed offloaded database upgrade failure due to multiple host entries in MySQL user table [GL:XI#1331] – CPD
Fixed an issue where unversioned python scripts in Capacity Planning wouldn’t work properly [GL:XI#1244] – RP
Fixed an issue in NagVis that was preventing new users and new roles from being added [GL:XI#1822] – DN/AW
Fixed an issue with Commands being sorted improperly when reinstalled [GL:XI#789] – EK
Fixed Python 3 support for MongoDB monitoring wizards [GL:XI#1437] – RP, JJ
Fixed an issue where no results would be displayed when filtering by service under specific circumstances [GL:XI#1875] – RP
Fixed column-statistics error in backup_xi.sh on Debian [GL:XI#1309] – KF

2024R1.4.1 - March 7, 2025

Fixed

Fixed dashlet upgrading to work properly – BB
Custom dashlets will now behave as they always did prior to 2024R1.4 – BB

2024R1.4 - March 6, 2025

Security

Fixed a text injection vulnerability with the login page [GL:XI#1493] – LG

Updated

Updated default theme to Modern Dark – TL
Updated several dashlets to no longer have scroll bars – TL
Updated Custom URL Dashlet to display a cross-origin error message when applicable – TL
Updated the link to Nagios Documentation on the pre-login landing page – TL
Updated Answer Hub links to documentation to proper links [GL:XI#1526,#1527,#1534,#1539,#1540,#1542,#1546,#1549] – SG
Updated dashlets to scale dynamically – CN, BB, MK, TL, CJD, NS, ZR, AL

Removed

Removed the Internet Traffic Dashlet – TL
Removed auto-deletion of generated reports for PDF download to prevent report downloading errors in Chrome [GL:XI#1388] – JS

Added

Added the ability to export and clone dashboards within a dashboard via the menu button – CN, TL
Added the ability to export and clone dashboards within a dashboard via right-click menu – BB
Added the ability to add dashlets to dashboards via the menu button and right-click menu – BB
Added the ability for dashlets to snap together – TL, AL
Added cleanup_reports.php cronjob to clear out report PDF downloads daily [GL:#1388] – JS
Added Custom Text Dashlet – CJD
Added show and hide title buttons to dashlets on Neptune themes – CJD
Added a dropdown menu for dashlet controls on very small dashlets – TL
Added escaping for “!” characters in SNMP community strings for the SNMP, SNMP Walk, Linux SNMP, and Windows SNMP Wizards [GL:XI#1488] – JS
Added escaping for “!” characters in NCPA tokens in Wizards [GL:XI#811] – JS

Fixed

Fixed an issue where the Network Analyzer Wizard would fail to display contents when a server is using a invalid certificate [GL:XI#1452] – SG
Fixed an issue where the Network Analyzer Wizard would fail to connect to a server with an invalid certificate [GL:XI#1470] – SG
Fixed an issue where long service names would overlay other columns in the service status table [GL:XI#1477] – SG
Fixed an issue where text in Network Analyzer chord diagrams in Neptune Light wasn’t readable [GL:XI#1425] – SG
Fixed an issue where validation broke normal functionality of the Custom URL Dashlet [#1501] – JS
Fixed an issue where the process name check functionality of the Legacy Linux Wizard was using the wrong plugin and did not have warning and critical functionality [GL:XI#1311] – JS
Fixed an issue where the Nagios Documentation linked to a deprecated URL – TL
Fixed an issue causing php errors in BPI for systems with php 8+ [GL:XI#1441] – SG
Fixed an issue where adding a new Tool to the Tools menu would sometimes replace an existing tool instead [GL:XI#1380] – JS
Fixed an issue preventing admin users from modifying Tools in the Modern theme [GL:XI#1450] – JS
Fixed an issue preventing non-admin users with monitoring engine access from viewing the Event Log [GL:XI#1388] – JS
Fixed an issue where dashlets would not appear on top of other dashlets when clicked – TL
Fixed an issue where dashlet show and hide title buttons were not working on Modern themes – CJD
Fixed an issue where errors would index the incorrect line number in Mobile Carriers – [GL:XI#1518] – SG
Fixed an issue where form inputs would be cut off in email reports page while using Neptune theme [GL:XI#1516] – SG
Fixed an issue where refresh intervals were cut off in Neptune theme [GL:XI#1530] – SG
Fixed an issue where the ‘=’ character in a username/password would break connections for the vSphere plugin – BB
Fixed an issue where the check command test function in the CCM would sometimes produce false negatives [GL:XI#811] – JS
Fixed checkbox alignment in Neptune theme in the add to my reports page [GL:XI#1531] – SG
Fixed php errors being thrown in performance graphs on distributions with php 8.3+ [GL:XI#1275] – SG
Fixed mysqldump syntax check in ccm_snapshot.sh – KF

2024R1.3.4 - February 14, 2025

Updated

Increased size of dashlet snapping grid on dashboards – CN
Updated styles in CCM to use proper theme colors – CD

Added

Added titles to dashlets in Neptune theme – CN
Added tooltips in several Configuration Wizards – TL
Added “View UI Documentation” button to in-page help – SG
Added error messages to dashlets for missing data – NS

Fixed

Ensure dashlet added to dashboards are always on top of other dashlets – CN
Fixed issue where help and favorite icons on dashboards were hidden by dashlets – SG
Fixed issue where dashlets could be moved outside of accessible bounds – CN
Fixed issue where dashlet backgrounds were not properly sized – CN, GW
Fixed tooltip text color in Configuration Wizards in Neptune Light – SG
Fixed issue where dashlets would shift position on dashboards when changing themes – MK

2024R1.3.3 - January 22, 2025

Updated

Made Modern the default theme on new installations – DA

Removed

Removed the requirement for a trial key to be entered before starting a trial – CN

2024R1.3.2 - December 12, 2024

Security

Fixed directory traversal within core config snapshots (Thanks to Cory Billington for reporting this) [GL:XI#1370] – DA
Fixed RCE in WinRM Wizard (Thanks to Leo Trinh for reporting this) [GL:XI#1361] – DA
Updated NRPE tarball to 4.1.3 – CB

Added

Include all required packages in offline installs [GL:XI#1259] – DA

Fixed

Fixed an issue where the option ellipses were being pushed out of view from long favorite names [GL:XI#1349] – SG
Fixed an issue with exporting pie charts with Neptune themes [GL:XI!1172] – SG

2024R1.3.1 - November 12, 2024

Security

Fixed a security vulnerability in history content tab (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1338] – DA
Fixed Neptune Tools allowing protocols other than HTTP and HTTPS (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1325] – DA
Fixed user enumeration vulnerability in deprecated backend API (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1326] – DA
Added host header verification option in security settings [GL:XI#1334] – DA

Removed

Removed the ability for read only users to add their own tools (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1324] – DA
Removed exclusion of net-snmp package on RHEL/Oracle 8 systems [GL:XI#1066] – SG
Removed superfluous links from Capacity Planning graphs – CN

Added

Added CSRF protection to favorites component (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1339] – DA
Added the ability to set TDS version in MSSQL Wizards and plugin. [XI:#1288] – CN,SG
Added NCPA 3 support in Ansible roles for the Deploy Agent feature. [GL:XI!1106] – MPB

Fixed

Cleaned up upgrade scripts [GL:XI!1121] – DA,BB
Cleaned up many PHP warnings displayed in logs across the application [GL:XI#1345] – JS
Fixed an issue where custom includes were not applied correctly in Neptune themes [GL:XI#1313] – SG
Fixed an issue where updating contacts created by template in the CCM could sometimes fail [GL:XI#1333] – JS
Fixed some checkboxes and UI interactions throughout the Neptune theme [GL:XI!1134] – DA
Fixed upgrade scripts in the case where the installtype variable isn’t determined. [GL#1352] – JM
Updated checking of xi-itype file during upgrades [GL:XI!1132] – DA
Updated Neptune Network Error Handling [GL:XI!1111] – DA
Updated styling for dialogs and fixed a variety of small errors with the Neptune theme [GL:XI!1128] – DA

2024R1.3 - October 15, 2024

Security

Fixed an issue with external help resource links opening in current window instead of a new tab [GL:XI#916] – GW

Updated

Updated Alert History Dashlet to correctly reflect the current theme [GL:XI#1145] – GW
Updated birdseye to choose dark mode when theme is set to Neptune [GL:XI#1197] – GW
Updated deployment script to install the Nagios repo’s GPG key to resolve deployment errors [GL:XI#947] – BB
Updated the UI in the Local Backup Archives and Manage Views pages [GL:XI#893] – GW

Added

Added check for NEB modules before upgrading [GL:XI#1307] – DA
Added enter functionality to Neptune search and improved search results [GL:XI#1190] – DA
Added graphs to Network Reports [GL:XI#413] – DA
Added support for Debian 12 [GL:XI#576] – AC
Added the ability to set TDS version to support different version of MS SQL [XI:#1288] – CN

Fixed

Fixed an issue where a plugin for the Network Switch / Router Wizard was not being copied to the correct directory on install & upgrade [GL:XI#1280] – CN
Fixed an issue where some Wizards did not display saved templates [GL:XI#580] – GW
Fixed an issue where systems without the xi-itype file could not upgrade [GL:XI#1315] – DA
Fixed an issue where users could encounter a broken page with SQL errors when adding custom variables [GL:XI#605] – GW
Fixed an issue with a link in the service status details page redirecting to the current page [GL:XI#1140] – GW
Fixed an issue with broken buttons in graph context menus in Graph Explorer – CN
Fixed custom includes not reflecting edits in the interface without refreshing the page [GL:XI#1231] – GW
Fixed Modern Gauge Dashlet title and toggle [GL:XI#733] – GW,DA
Fixed PHP warnings and search functionality and made a UI improvement on MRTG File Management page [GL:XI#1233] – GW
Fixed service names incorrectly being converted to lowercase [GL:XI#1248] – GW
Fixed three instances of links being shown to unauthorized users [GL:XI#1102,1069,1070] – GW

2024R1.2.2 - September 24, 2024

Security

Fixed a vulnerability to host header injection attacks [GL:XI#1216] – JS
Removed unnecessary percent markers from NCPA and Linux Server Wizards [GL:XI#1260] – JS

Updated

Updated jQuery from 1.12 to 1.13.2 [GL:XI#1218] – CN
Updated Nagios Plugins to version 2.4.12 – DA
Updated default error behavior when network requests fail [GL:XI#1159] – DA
Updated styling of licensing messages on first login [GL:XI#1191] – DA
Updated the vSphere Wizard’s “Datastore usage” metric to more accurately reflect the metric [GL:XI#1201] – BB

Removed

Removed download options that were erroneously added to highcharts graphs [GL:XI#1064] – DA

Added

Added a script to fix db corruption [GL:XI#1217] – LG
Added help text to upgrade.sh [GL:XI#1257] – ATC

Fixed

Fixed an issue where the vSphere plugin’s -list-datacenters option wasn’t functioning properly – BB
Fixed an issue where the vSphere plugin’s -list-clusters option wasn’t functioning properly [GL:XI#1170] – BB
Fixed an issue where the vSphere plugin would be unable to connect on certain OSs due to pyVmomi version – BB
Fixed an issue where service groups could not be edited in the CCM in some cases [GL:XI#1254] – CN
Fixed an issue where install/upgrade could be prevented from succeeding on EL9 if xinetd was present [GL:XI#1040] – JS
Fixed an issue where auto-login would not work with certain languages set [GL:XI#1164] – JS
Fixed an issue where timeouts when sending emails weren’t being handled properly [GL:XI#1103] – CN
Fixed an issue where loading the mail settings page would cause PHP errors when OAuth credentials are empty – BB
Fixed an issue where upgrade scripts could run on a non-corresponding installation type [GL:#1122] – CN
Fixed an issue where logrotate config was sometimes not being properly modified – [GL:XI#333] – JS
Fixed an issue where Neptune theme ad/ldap edit erroneously displayed password field [GL:XI#1251] – LG
Fixed an issue where users could see an unhelpful error when BBMap Dashlet does not get any data [GL:XI#1052] – JS
Fixed an issue where PDFs from scheduled emails would sometimes be corrupted based on Program/External URL [GL:XI#1161] – JS
Fixed an issue with SELinux and reporting backend [GL:XI!1022] – DA
Fixed an issue with the Linux Server Wizard would not display plugins on Step 2 [GL:XI#1121] – JS
Fixed broken pipe errors with backup generation [GL:XI#1117] – DA
Fixed timezone changing issues on Ubuntu 24 [GL:XI#1250] – DA
Fixed missing MIBs on Ubuntu 24 [GL:XI!1073] – DA
Fixed PHP error in Capacity Planning reports [GL:XI!1025] – SAW
Fixed CCM routing in the Neptune theme [GL:XI#1199] – DA
Fixed PHP error when deploying an agent [GL:XI!1051] – DA
Fixed formatting issues where scheduled emails and other pages would be sent with bad links back to XI [GL:XI#1161] – JS
Fixed various log file permissions [GL:XI!1066] – DA

2024R1.2.1 - August 29, 2024

Updated

Updated UX for downloading reports as PDFs – DA

Removed

Removed php-imap from EL9 dependencies [GL:XI#1261] – BB

Fixed

Fixed NRDP upgrades failing when trying to run the XI update again [GL:XI#1269] – DA
Fixed dependency conflict between chromium and mysql on Ubuntu [GL:XI#1271] – DA
Fixed an issue where a modified php.ini file could break installation or upgrade [GL:XI#511] – JS
Fixed MySQL password saving on repeated usage of the full install script [GL:XI#1253] – DA

2024R1.2 - August 13, 2024

Security

Added support for ModSecurity Web Application Firewall [#1084] – DA
Fixed privilege escalation via nagvis.conf (Thanks Exodus Intelligence for reporting this) [GL:XI#1207] – SAW
Improved validation in Docker Wizard and mitigated NULL poisoning vulnerability on systems with older PHP distributions (Thanks Exodus Intelligence for reporting this) [GL:XI#1206] – SAW

Updated

Update framework for several pages [GL:XI#1049,#1050,!828] – SG, GW
Improved Graph Explorer’s Neptune theme by putting graph management controls in a sliding drawer [GL:XI#1008] – LG
Improved Graph Explorer’s Multistacked performance graph by adding grouping by hostgroup/servicegroup [GL:XI#1008] – LG
Improved recognition of WEBP images when uploading via the Custom Includes component [GL:XI#1095] – DA
Improved Network Switch/Router Wizard to allow monitoring by Interface Name or Description [GL:XI#344] – SAW
Updated MySQL configuration to include default settings for max_allowed_packet, max_connections, and open_files_limit [GL:XI#1080] – GW
Updated NagVis to resolve PHP deprecations [GL:XI!919] – GW
Updated SLA Report and SLA Dashlet for Neptune [GL:XI!904] – GW
Updated nagios-plugins to version 2.4.10 – DA
Improved validation in several NRDP server plugins (Thanks Exodus Intelligence for reporting this) [GL:XI#1208] – SAW

Deprecated

Deprecated Debian 10, CentOS Stream 8, and EL7 [GL:XI!980] – GW

Added

Added Neptune Light theme [GL:XI#1028] – SG
Added configuration Wizard to monitor Windows via WinRM [GL:XI#1172] – AC
Added support for Ubuntu 24 [GL:XI#577] – GW, JM
Added History tab to Home->Details->Host Details and Host->Details->Service Details [GL:XI#897] – LG
Added Home->Incident Management->Mass Downtime page to schedule and remove downtime en masse [GL:XI#1044] – GW
Added ability for Nagios-Core-only contacts to use Nagios XI’s mailing configuration [GL:XI#339] – BB
Added new `filter` parameter to the `v1/config/host` REST API endpoint [GL:XI#1017] – LG
Added the ability to view data from Home->Graphs->Performance Graphs as a table [GL:XI#1005] – SG, CN
Added the ability to download from Home->Graphs->Performance Graphs as a CSV [GL:XI#1007] – SG
Added the ability to download Timestacked and Multistacked graph data from Home->Graphs->Graph Explorer as a CSV [GL:XI#1011,1010] – SG
Added filtering by Hostgroup or Servicegroup to Home->Graphs->Performance Graphs [GL:#1006] – CN
Added filtering by Hostgroup or Servicegroup to several dashlets [GL:XI#1053,!949] – GW
Added the ability to enable/disable PHPMailer debugging via the interface [GL:XI#175] – GW
Added inbound mail processing for systems that lack the PHP-IMAP library [GL:XI#61/1059] – BB

Fixed

Fixed an issue in the NCPA Wizard where typing a hostname into the “address” field would cause configuration to fail [GL:XI#1124] – SAW
Fixed issue with snmptrapsender component mistakenly indicating it wasn’t installed [GL:XI#1094] – DA
Fixed an issue where the “import config files” checkbox did not function when using the Neptune theme [GL:XI#1112] – SG
Fixed the PDF generation for the Bandwidth Usage Report [GL:XI#1079] – LG
Fixed an html issue on the report pages [GL:XI!897] – LG
Fixed a Neptune Dashlet offset when dashlets were stacked on Host & Service Status pages [GL:XI!897] – LG
Fixed a Neptune issue for Service Status of a down Host would have a background color on the Host Status Summary [GL:XI!897] – LG
Fixed an issue in the Switch/Router wizard where SNMP v3 credentials could be used to scan networked devices even when SNMP v1/v2 were selected [GL:XI#1215] – SAW
Fixed issue where LDAP would not show users properly [GL:XI!952] – AC

Core Config Manager (CCM) 3.5.0

Added support for MRTG configuration file management [GL:XI#48] - SAW

2024R1.1.5 - July 23, 2024

Security

Restrict RPM and offline deployments and servers with a proxy configured from performing source upgrades via web interface [GL:XI#1126,#1160] – SG
Fixed XSS vulnerabilities on Hostgroup and Servicegroup status pages (Thanks to Samuel Lima for reporting this) [GL:XI#1155] – CN,DA

Fixed

Fixed an issue where graphs could not be removed from multistacked performance graphs [GL:XI#1135] – GW
Fixed missing “Query” input in MSSQL Query Wizard [GL:XI#629] – SAW
Fixed Help->Check for Updates spinning forever when using the Custom Logo Component [GL:XI#1132] – SAW
Fixed an issue where the Neptune theme’s search bar would fail to complete the search [GL:XI#1119] – DA
Fixed the Manage MIBs page failing to load in most non-English languages [GL:XI#1156] – SAW
Fixed check_snmp_storage_wizard.pl so that it always shows performance data in a consistent order [GL:XI#1072] – SAW
Fixed log messages and other output when running background jobs and scripts [GL:XI#1117,!953] – DA
Fixed issue where an incorrect language value would cause the front end to not render [GL:XI#!944] – DA

Core Config Manager (CCM) 3.4.0

Add support for ‘*’ to dependent services - SAW
Add support for ‘!’ (exclusion) to dependent services - SAW

2024R1.1.4 - June 12, 2024

Updated

Prevent postfix being unable to start from stopping the install process [GL:XI#1137] – DA

Added

Added verification before upgrades to ensure that Nagios Core configuration is applied and valid – SAW

Fixed

Fixed issue in NagVis where a user could use schemes other than http as a hover url (Thanks to Márk Rákóczi for reporting this) [#1062] – DA
Fixed issue in Admin->Check for Updates where the interface would not indicate a successfully completed update – SAW
Fixed issue where new API could halfway complete upgrading, rendering the application unusable [GL:XI#1131] – SAW

Core Config Manager (CCM) 3.3.1

Fix regression where setting max_check_attempts (among others) to 3 caused the entry to disappear from the applied configuration text file [GL:XI#1133,#108] - SAW

2024R1.1.3 - May 28, 2024

Security

Fixed XSS in Capacity Planning component (Thanks to Márk Rákóczi for reporting this) [GL:XI!834] – DA
Fixed both XSS in Executive Summary report and ajaxhelper endpoint that was too open (Thanks to Márk Rákóczi for reporting this) [GL:XI#1046] – DA

Updated

Improved report options and fixed various associated issues [GL:XI#897,#899,#905] – GW
Improved the UX of applying configurations in the CCM to make it faster and easier [GL:XI#1027] – BB
Several minor interface improvements [GL:XI#593,#867,#868,#869,#870,#871,#872,#874,#875,#877,#880,#884,#887,#889,#890,#898,#900,#902,#903,#906,#913,#919,#920,#921,#922,#923,#926,#927,#930,#932,#934,#935,#936,#938,#939,#940,#942,#943,#945,#947,#948,#949,#959,#961,#962,#964,#967,#968,#969,#971,#974,#975,#979,#981,#1004,#1043,#1067,!868] – GW,SAW,DA
Updated icons on the My Tools and Common Tools page [GL:XI#918] – KV
Updated icons in the Announcement Banners page [GL:XI#925] – KV
Updated icons in the AD/LDAP page [GL:XI#924] – KV
Updated required versions and corrected various versioning issues across several components – GW
Updated and fully released the vSphere Wizard – BB
Updated default log rotation to include new report exporting backend’s log files [GL:XI!863] – DA
Do not allow jinja2 templates in migrate_core.yml (Thanks to Márk Rákóczi for reporting this) [GL:XI#1063] – DA
Fixed inability to set custom URL and title for the Neptune theme in the Home Page Modifications component [GL:XI#632] – DA
Fixed inability to use the manage dashboards page in all themes [GL:XI!795] – DA

Removed

Removed the scroll bar from a number of dashlets that shouldn’t have it [GL:XI#1002] – GW

Added

Added default log rotation settings for snmptrapsender.log [GL:XI#860] – SAW
Added default MRTG configuration when installing or upgrading Nagios XI via RPM package [GL:XI#782] – SG

Fixed

Fixed an issue where some dashlets would not save dimensions altered by the user [GL:XI#1001] – GW
Fixed a crash in the database maintenance background job [GL:XI#1031] – SAW
Fixed an issue in the NRPE Wizard where the NRPE command would always use the default settings [GL:XI#1042] – SG
Fixed an issue where swap metric would not load unless the user manually set the graph’s viewport [GL:XI#983] – GW
Fixed an issue in Host/Service Details where “View Performance Graphs” would fail to load when the service’s name was “/” [GL:XI#790] – SAW
Fixed an issue where files with capitalized file extensions could not be uploaded to Admin->Custom Includes [GL:XI#816] – SAW
Fixed an issue in the NLS Wizard where it would fail to connect if NLS was configured to use HTTPS [GL:XI#793] – SG
Fixed incorrect SNMP version in checks configured by the Watchguard configuration Wizard [GL:XI#1034] – SAW
Fixed an issue where monitoring objects could not inherit from templates when configured via the API [GL:XI#108] – SG
Fixed issues with ‘$’ and ‘!’ in ncpa tokens and escaped values in Docker Wizard [GL:XI#855] – SG
Fixed issues with ‘$’ and ‘!’ in ncpa tokens in Cloud VM, Hyper-V, Java Application Server, and Windows Event Log Wizards [GL:XI!739] – SG
Fixed a non-working fallback when users add AD/LDAP certificates on systems with older versions of OpenSSL [GL:XI#1074] – SAW
Fixed an issue in the Network Switch / Router Wizard where user-inputted whitespace in the IP Address field would cause the Wizard to fail [GL:XI#792] – SAW
Fixed an issue in the Network Switch / Router Wizard where the table in the second page was not readable on the Modern Dark theme [GL:XI#720] – SAW
Fixed an issue where users without permission could add hosts and services in the Core Config Manager [GL:XI#846] – CN
Fixed bulk entry in the Network Switch / Router Wizard [GL:XI#777] – SAW
Fixed an issue where users in nested Organizational Units were not found when importing users from AD/LDAP – [GL:XI#72] – CN
Fixed an issue where HTML tags would be displayed in error feedback when applying configurations [GL:XI#1023] – CN
Fixed an issue where bulk modification would not work with multiple options [GL:XI#631] – GW
Fixed an issue where the Bulk Modifications tool could not find relationships when one or more objects had a ‘#’ in its name [GL:XI#797] – CN
Fixed two cases where the Bulk Modification tool would crash on clicking “Find Relationships” and while trying to remove Custom Variables [GL:XI#603] – JS
Fixed an issue where NDO failed to start when using an offloaded database [GL:XI#95] – CN
Fixed an issue where a user’s password change would cause a user ID (and not username) to be logged in the Audit Log [GL:XI#1056] – SAW,AC
Fixed an issue where non-authorized users could access Wizards via Popular Wizards [GL:XI#734] – GW
Fixed an issue where RPM upgrades from before 2024R1 would incorrectly encrypt inbound NRDP tokens [GL:XI#844] – DA
Fixed an issue where uploading a plugin with the same name as an existing plugin would replace the plugin with no warning [GL:XI#676] – SG
Fixed broken link in Esensors Websensor Wizard – SAW
Fixed deprecated code in RSS Dashlet [GL:XI#578] – SAW
Fixed issue with views URLs in the Neptune theme [GL:XI!807] – DA
Fixed permissions in users endpoint in the new V2 API (Thanks to Márk Rákóczi for reporting this) [GL:XI#1036] – DA
Fixed an issue where phpmailer.log did not have the correct permissions [GL:XI#856] – LG
Fixed an issue in network reports, network queries, and the NNA Wizard where network requests were silently failing when Nagios XI was configured with HTTPS and NNA was configured with HTTP [GL:XI#852,#1015,#1014] – SG
Fixed an issue in the Alert History Dashlet where all cells would show as red in when no state changes had occurred [GL:XI#859] – SAW
Fixed Backup and Restore across Linux distributions that use different database collations. [GL:XI#361]- LG
Fixed an issue where the “User Sessions” page would show spurious session entries [GL:XI#695] – DA
Fixed an issue where a password change wouldn’t invalidate other sessions (Thanks to Jack Eli for reporting this) [GL:XI#850] – DA
Fixed an issue in the NCPA Wizard where users could not utilize the same plugins, services and products more than once for service checks. [GL:XI#785] – KV
Fixed an issue in the NCPA Wizard where the Wizard would crash when the network connection to NCPA was inconsistent [GL:XI#551] – LG
Fixed unencrypted v3 SNMP passwords from SNMP Trap Sender component [GL:XI#557] – DA
Fixed PHP 8 deprecation warnings – DA
Fixed an issue where the words “Enterprise License” were erroneously displayed [GL:XI#1054] – LG
Fixed an issue where the Neptune theme was missing from the Audit Log’s “Send to Nagios Log Server” page [GL:XI#1051] – LG
Fixed a Ubuntu 22 Install issue [GL:XI#1073] – JM
Fixed issues with scaled dashlets going outside of their boundaries [GL:XI!853] – DA
Fixed missing language packages on RPM installs on Enterprise Linux 8 [GL:XI!889] – DA
Fixed restoring XI from a backup when all passwords are the same [GL:XI#1091] – DA

Core Config Manager (CCM) 3.2.5

Fixed an issue where timeranges could not be removed from timeperiods [GL:XI#1003] - SAW
Fixed an issue where indrect servicegroup relationships were not being found, allowing bidirectional relationships to be created erroneously [GL:XI#996] - CN

2024R1.1.2 - April 23, 2024

Security

Fixed an issue where unused API endpoints posed a security vulnerability (Thanks to Márk Rákóczi for reporting this) [GL:XI#1036] – DA

Fixed

Fixed an issue where any user could modify an insecure login ticket (Thanks to Márk Rákóczi for reporting this) [GL:XI#1037] – DA
Fixed an issue where the login form would submit to the current url and not login.php (Thanks to Kevin De Frene for reporting this) [GL:XI#1041] – DA

2024R1.1.1 - March 27, 2024

Fixed

Fixed an issue where the Neptune theme would crash on CentOS 8 and RHEL 8 – SAW

2024R1.1 - March 26, 2024

Security

Fixed XSS in page-missing.php (Thanks to Adam Kues from Assetnote for reporting this) [GL:XI#849] – DA

Updated

Replaced wkhtmltox reporting backend with chromium [GL:XI#795] – DA

Deprecated

Deprecated Folder Watch Wizard [GL:XI#832] – JS

Removed

Removed “Download as JPG” button for all reports

Added

Added new Neptune UI theme – AC,GW,KV,LG,DA,CN,SAW,SG,SNS,BB,JS
Added new vSphere configuration Wizard [GL:XI#313] – JL,BB,SG
Added new Alert History Dashlet (calendar view) [GL:XI!488] – SAW
Added the ability to select metric to view in Metrics Dashlet [GL:XI#15] – GW

Fixed

Fixed broken Wizard favorites and added duplicate removal to favorites [GL:XI#502/564] – GW
Fixed issue where the Mail Server wizard would fail to apply configuration after completion [GL:XI#827] – CN
Fixed issue with Network Report where records variable was not converting from object to array [GL:XI#549] – GW
Fixed deprecation warnings when using “My Reports” page on newer linux distributions – SAW
Fixed issue where the Amazon EC2 Wizard would timeout [GL:XI#826] – CN
Fixed an issue where upgrades would fail when HTTP was disabled [GL:XI#783] – SAW
Fixed SSH Proxy Wizard issue that prevented services from being added correctly [GL:XI#833] – JS
Fixed several issues in the Bulk Host Import Wizard [GL:XI#820] – SG
Fixed several issues in the Passive Check Wizard [GL:XI#831] – SG,SAW
Fixed several issues in the Passive Objects Wizard [GL:XI#834] – KV
Fixed an issue with restoring XI2024R1 to another XI2024R1 server [GL:XI#572] – LG, DA
Fixed an issue with randomized folders in backup tarball [GL:XI#818] – DA
Fixed an issue where a fatal php error was thrown while editing my reports – SG

Core Config Manager (CCM) 3.2.4

Fixed white-on-white input and button text in CCM login page on Modern Dark theme [GL:XI#719] - SAW

2024R1.0.2 - February 21, 2024

Security

Fixed XSS in Nagios Core command expansion page (Thanks to Joran LEREEC for reporting this) [GL:XI#654] – DA
Fixed a SQL injection vulnerability in favorites component. (Thanks to Jarod Jaslow for reporting this) (CVE-2024-24401) [GL:XI#667] – DA
Fixed a privilege escalation vulnerability from nagios to root (Thanks to Jarod Jaslow for reporting this) (CVE-2024-24402) [GL:XI#668] – DA
Fixed a privilege escalation vulnerability in autodiscover_new.php (Thanks to Wahab Khadir for reporting this) [GL:XI#669] – DA

Deprecated

Deprecated Ubuntu 18 [GL:XI#579] – DA

Fixed

Fixed issue with column statistics table not existing with offloaded databases and backups [GL:XI#247] – DA
Fixed an issue where users would not be able to upgrade when they had offloaded databases [GL:XI#584] – DA
Fixed an issue where backups would fail due to a full tmp directory [GL:XI#602] – DA
Fixed an issue where recurring_downtime.php would exit because of it’s own pid [GL:XI#693] – DA

Core Config Manager (CCM) 3.2.3

Fix a regression from XI 2024R1.0.1 where the “Remove all” button was broken on some overlays - SAW

2024R1.0.1 - January 16, 2024

Security

Fix an privilege escalation vulnerability in the System Profile component (Thanks to Matthew Bach from Hack The Box Ltd for reporting this) [GL:XI#532] – KF
Fixed XSS vulnerability in NOC screen (Thanks Cosmin-Constantin Cojocaru for reporting this issue) (CVE-2023-51072) [GL:XI#568] – DA
Removed world read permissions from resource.cfg [GL:XI#256] – DA

Updated

Corrected formatting of admin-provided user data [GL:XI#548] – JM
Improved icons and help text in page footer [GL:XI#530] – GW
Improved troubleshooting experience for AD/LDAP debugging [GL:XI#474,GL:XI#585] – SAW,SG
Improved performance on systems that monitor many NCPA nodes by adjusting check_ncpa.py timeout [GL:XI#507] – SG
Disallow use of wildcard selector for restricted CCM users [GL:XI#174] – GW
Updated icons in the System Component Status dashlet [GL:XI#529] – GW
Fix an issue with dark mode in user macros page [GL:XI#524] – SG
Restored “Home” menu link when Custom Logo component is in use [GL:XI#550] – CN

Removed

Removed uses of deprecated strftime function [GL:XI#489] – JS

Added

Added timestamps to logs found in /usr/local/nagiosxi/var/ [GL:XI#65] – CD
Added convenience script to load MySQL passwords from configuration files [GL:XI#509] – DA

Fixed

Fixed an issue where users would not be able to upgrade to XI 2024R1 if they changed their root MySQL password [GL:XI#588] – SAW
Fixed an issue where the CCM would prevent some valid service dependencies from being configured [GL:XI#113] – GW
Fixed UI visibility issues when using the Migrate Server feature in dark mode [GL:XI#435] – KV
Fixed minor UI issues when completing a configuration Wizard [GL:XI#538] – GW
Fixed an issue in BPI where dropdown chevron was pointing in the wrong direction on page refresh [GL:XI#513] – GW
Fixed PDF report generation on reports with large amounts of data [GL:XI#350] – DA
Fixed missing debug logging in the AD/LDAP configuration on Enterprise Linux 8 and 9 [GL:XI#442] – DA
Fixed inconsistent file permissions related to the Network Switch/Router Wizard on Ubuntu [GL:XI#471] – SG
Fixed issue where the SLA Report, Capacity Planning Report, and Audit Log were incorrectly blocked for some users with valid enterprise trials [GL:XI#522] – GW
Fixed Graph Explorer icons not working for hosts that have a space in their hostnames [GL:XI#470] – GW
Fixed PHP warnings when adding a service in the CCM [GL:XI#484] – GW
Fixed an issue where timezone changes were not correctly applied on Enterprise Linux 9 [GL:XI#458] – GW
Fixed two cases where the Bulk Modifications tool would crash when modifying more than 200 hosts or services [GL:XI#373] – JS
Fixed an issue where the recurring downtime background job would have mutliple processes running at once [GL:XI#309] – SG
Fixed an issue where the recurring downtime background job would log errors when modifying empty host groups [GL:XI#309] – SG
Fixed an issue where Highcharts graphs would use online exporting when local exporting was selected [GL:XI#29] – AC
Fixed an issue where MRTG files would not have the correct permissions set on upgrades [GL:XI#38] – BB
Fixed a divide-by-zero issue and some warnings in metrics component [GL:XI#512] – GW
Fixed an issue where new user tours would sometimes fail to reset [GL:XI!426] – BB
Fixed an issue where the notifications history page would not save parameters when saved as a view [GL:XI#146] – BB

2024R1 - December 6, 2023

Security

Improved security of default database password generation (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#424] – DA
Improved security of randomly-generated text, including API keys (Thanks to Abdulmohsen Alotaibi for reporting this) [GL:XI#433] – DA
Improved security of Ansible Vault credentials in Nagios Core-to-XI migration tool (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#426] – DA
Fixed vulnerability with time-based port scanning on ftp connections in Scheduled Backups component (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#422] – DA
Fixed a security issue in migrate.php that allowed root code execution from user input (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#415] – DA
Fixed an XSS vulnerability in the graphexplorer component (Thanks to Pankaj Kumar Thrakur for reporting this) [GL:XI#468] – DA
Fixed a security issue with backup_xi.sh allowing deletion of arbitrary directories (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#428] – DA
Fixed some missing access controls in the Nagios XI 5 API (Thanks Matthew Bach and Hack The Box Ltd for reporting this) (CVE-2023-51124) [GL:XI#520] – SAW

Updated

Improved multiple-selection widgets in several configuration wizards [GL:XI#444, GL:XI#475] – PhW
Improved authorization requirements when editing USER and System Macros in the CCM (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#425] – DA
Improved input validation in send_to_nls.php script (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#427] – DA
Updated login page [GL:XI#394] – CN
Moved the help menu to a dropdown in the upper-right corner of the screen [GL:XI#455] – SG
Disabled web SSH Terminal by default (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#416] – DA

Removed

Removed DROP and DELETE permissions from the Nagios XI user for the auditlog table (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#420] – DA
Removed support for PostgreSQL – SAW

Added

Added tours for the homepage and wizards [GL:XI#402] – BB
Added the ability to view the most used and most recently used configuration wizards [GL:XI#462] – GW
Added Colorblind theme for users with red-green colorblindness [GL:XI#453] – JS
Added a page to enable/disable notifications for hosts and services en masse [GL:XI#378] – SG
Added new home dashboard [GL:XI#397] – CN
Added client side form validation and updated appearance for most Wizards [GL:XI#300,XI#395] – LG
Added a new built-in “demo” dashboard and associated new dashlet [GL:XI#473] – GW
Added configuration wizard to monitor OpenAI Usage. [GL:#403] – PhW
Added configuration wizard to set up Slack notifications [GL:XI#399] – BB
Added configuration wizard to set up Discord notifications [GL:XI#400] – BB
Added new SNMP Trap Volume Dashlet – SAW
Added new Modern Gauge Dashlet – BB
Added an Enterprise top-level menu and page – [GL:XI#452] – KV
Added sticky header and sort by status to BBMap [GL:XI#448,#449] – LG

Fixed

Fixed incorrect table header in Configure->Core Config Manager->Hosts [GL:XI#477] – KV
Fixed PHP Warnings when adding a host in the CCM [GL:XI#483] – SAW
Fixed PHP warnings from use of deprecated split() function [GL:XI#467] – GW
Fixed PHP warnings when processing SNMP Traps in the Manage MIBs page [GL:XI#480] – SAW
Fixed an issue that allowed users with expired trial and enterprise licenses to access enterprise features [GL:XI#437] – GW
Fixed PHP warnings when adding a hostgroup in the CCM [GL:XI#483] – SAW
Fixed PHP warnings when adding a servicegroup in the CCM [GL:XI#481] – SAW
Fixed use of deprecated utf8_encode() in Locale selection and CCM Audit Log [GL:XI#491] – SAW
Fixed use of deprecated functions in CCM log management [GL:XI:#490] – SAW
Fixed plaintext storage of sensitive information in the database (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#421] – DA

5.11.3 - November 1, 2023

Security

Fixed an XSS in the custom logo component (Thanks Astrid Tedenbrant and Outpost24 for reporting this) [GL:XI#412] – BB
Fixed a Remote Code Execution vulnerability in the Core Config Manager (Thanks Abdulmohsen Nasser Alotaibi for reporting this) [GL:XI#383] – SNS
Fixed an XSS vulnerability in the Graph Explorer component (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#384] – SG
Fixed an XSS vulnerability in bandwidthreport component (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#385,#463] – SG
Fixed an XSS vulnerability in Bulk Modifications component (Thanks Aleksey Solovev from Positive Technologies and Abdulmohsen Nasser Alotaibi for reporting this) [GL:XI#386] – SG
Fixed a CSRF and XSS vulnerability in the custom-includes component (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#387] – BB
Fixed a CSRF and XSS vulnerability in the hypermap replay component (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#388] – BB
Fixed an XSS vulnerability in the CCM (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#389] – BB
Fixed several SQL injection vulnerabilities in the Bulk Modifications Tool (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#390] – SG
Fixed a shell injection vulnerability in the Manage MIBs page (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#392] – SG
Fixed an XSS vulnerability in Manage Users (Thanks Oliver Brooks and Colin Brum from NCC Group for reporting this) [GL:XI#429] – BB
Fixed a PHP code injection vulnerability in the graph template editor (Thanks Oliver Brooks and Colin Brum from NCC Group for reporting this) [GL:XI#430] – BB
Fixed a Remote Code Execution vulnerability in the Core Config Manager (Thanks Abdulmohsen Nasser Alotaibi for reporting this) [GL:XI#383] – SNS

Updated

Improved UX of the Operation Center configure sound modal [GL:XI#370] – SG

Added

Added the ability to modify homepage settings when a dashboard is set as the homepage – BB

Fixed

Fixed an issue where phantomjs was not working properly on an offline upgrade – CB
Fixed an issue with unhelpful error messages in email settings [GL:XI#363] – AC
Fixed an issue in Executive Summary where the report would be named incorrectly for [Host Only] and [All Services] reports [GL:XI#340] – SAW
Fixed an issue in State History where the report would show service states when [Host Only] was selected [GL:XI#340] – SAW
Fixed typo in Performance Settings – SAW
Fixed an issue where Homepage Customization would indicate that it was disabled when it was enabled [GL:XI#376] – BB
Fixed an issue where Homepage Customization cog would not show in the dashboard view [GL:XI#376] – BB
Fixed an issue that caused “Send Test Email” button to break if “From Address” was invalid [GL:XI#367] – BB
Fixed an issue that caused performance graphs to display an incorrect “Max” value [GL:XI#336] – BB
Fixed an issue where host and service statuses would be partially truncated on Ubuntu [GL:XI#259] – BB
Fixed an issue where the Announcement Banners table looked broken when there were no banners configured [GL:XI#358] – SG
Fixed an issue that caused errors to show when using a dashboard as the home page – BB
Fixed an issue where Deploy Agent would fail when deploying to an Ubuntu minimal install [GL:XI#177] – BB
Fixed an issue that was causing browser console errors on the Email page – BB
Fixed an issue where the Host status detail page was showing OK when a service was Pending [GL:XI#352] – BB
Fixed an issue where adding/editing a command in the CCM would have a broken page – BB
Fixed an issue where CCM forms could show errors when editing commands or services – BB
Fixed an issue where Bulk Modifications -> Add Parent Host would break on PHP 8 [GL:XI#375] – BB
Fixed missing dependency (php-pecl-ssh2) in Scheduled Backups [GL:XI#290] – BB
Fixed missing authorization controls in Unconfigured Objects (Thanks Oliver Brooks and Colin Brum from NCC Group for reporting this) [GL:XI#419] – BB

5.11.2 - September 11, 2023

Security

Added security setting to block remote sites from loading via xiwindow parameter [GL:XI#302] – DA
Fixed XSS in Custom Logo component (Thanks Astrid Tedenbrant and Outpost24 for reporting this) (CVE-2023-40932) – AC
Fixed SQL injection vulnerability acknowledging an announcement banner (Thanks Astrid Tedenbrant and Outpost24 for reporting this) (CVE-2023-40931) – SG
Fixed SQL injection vulnerability in the accouncement banner configuration interface (Thanks Astrid Tedenbrant and Outpost24 for reporting this) (CVE-2023-40933) – BB

Updated

Fixed an issue where the side menu wouldn’t automatically update when scheduled reports were added or deleted [GL:XI#331] – DA
Fixed an issue that would sometimes cause dashlets to reappear on the Home page when deleted [GL:XI#85] – SNS
Improved clarity of error messages in CCM when attempting to modify a host with broken sql tables [GL:XI#173] – SG
Updated verbiage in the Mountpoint Wizard for clarity [GL:XI#110,#279] – DA
Updated styling on the home page [GL:XI#169] – DA
Updated verbiage surrounding custom variables to be more consistent [GL:XI#151] – SG
Updated modal presented when acknowledging problems for clarity [GL:XI#299] – SG
Removed Alert Cloud Dashlet because Flash is no longer supported [GL:XI#164] – SNS

Deprecated

Deprecated WMI and Web Transaction [GL:XI#317] – SNS

Removed

Removed Nagios News Feed Dashlet [GL:XI#298] – SNS
Removed autcomplete from Wizard Address Field [GL:XI#87] – SNS

Added

Added fuzzy search to the Configuration Wizard page – SNS
Added the ability to resize some dashlets [GL:XI#285] – SNS
Added “Maximum Downtime History Age” to performance settings [GL:XI#287] – SAW

Fixed

Fixed an issue that caused sound settings to not display correctly in the operation center [GL:XI#24] – SG
Fixed an issue with logrotate permissions for the CentOS 9 OVA [GL:XI#197] – DA
Fixed an issue with password reset emails not containing correct URLs [GL:XI#23] – DA
Fixed an issue where macro variables weren’t expanding properly in notes URLs [GL:XI#315] – SG
Fixed an issue where new users weren’t being shown existing banner messages [GL:XI#277] – SG
Fixed an issue with the announcement banner switch showing incorrect status on page load [GL:XI#266] – SG
Fixed an issue where the License Information screen would fail to load [GL:XI#249] – SAW
Fixed an issue with permissions in the Network Switch Wizard [GL:XI#347] – SG
Fixed an issue where several tables would not get truncated in a script for removing historical data [GL:XI#284] -TG
Fixed an issue in network switch wizard where the Bulk Configuration Settings were not handling mismatched field inputs [GL:XI#312] – SG
Fixed an issue in the update process where the settings would be unexpectedly reset upon upgrading in the oracle tablespace wizard [GL:XI#311] – SG
Fixed an issue where selected months would start with a comma under certain circumstances in recurring downtime [GL:XI#330] – SG
Fixed an issue in the views tab where the fullscreen button moved while in fullscreen during rotating views [GL:XI#163] – SG
Fixed an issue in dark mode where cloning a user and canceling the menu would display non-dark mode css [GL:XI#271] – SG
Fixed an issue in AD/LDAP where having more than 1000 users would cause layout issues [GL:XI#13] – SG
Fixed an issue causing reports to fail to run successfully [GL:XI#316,#296] – DA
Fixed an issue where users without enterprise feature can set snmp traps in the manage mibs interface [GL:XI#176] – SG
Fixed an issue where pages would throw console errors [GL:XI#258] – BB
Fixed an issue where a sufficiently large amount of logs would crash the audit log page [GL:XI#325] – DA
Fixed an issue where unused service and host check tables were enabled by default sometimes causing database corruptions [GL:XI#242] – SG
Fixed an issue where the Sans Rising Ports dashlet would create many DB access errors [GL:XI#338] – DA
Fixed an issue where SNMPv2-PDU had a bad trap definition [GL:XI#78] – DA
Fixed an issue where the redirect parameter on the login page wouldn’t work if the user was already authenticated [GL:XI#150] – DA
Fixed an issue where the application log would show database errors on systems that were integrated with deprecated products [GL:XI#303] -TG
Fixed an issue with the contact PUT endpoint in the API did not allow custom variables [GL:XI#115] – DA
Fixed an issue where XI would fail to export performance data graphs when offline [GL:XI#29] – SNS
Fixed an issue where the SLA page would render incorrectly due to some variable definitions [GL:XI#345] – SNS
Fixed an issue where Wizard Search did not catch quick inputs [GL:XI#265] – SNS
Fixed an issue where the Oracle Serverspace Wizard was overwritting settings on upgrades [GL:XI#343] – SG
Fixed an issue where the Oracle Query Wizard was overwritting settings on upgrades [GL:XI#342] – SG
Fixed an issue where Email Settings would fail to save but indicated that the credentials were saved [GL:XI#263] – BB
Fixed an issue where the services list on the Host Detail page was showing the display name instead of the service description [GL:XI#293] – BB
Fixed an issue where python was not defined in report scripts [GL:XI#307] – SNS
Fixed an issue where editing SNMP Trap Sender settings would break on PHP 8+ [GL:XI#149] – SG
Fixed an issue that could lead to a blank screen when editing service templates while utilizing PHP 8+ [GL:XI#334] – SG
Fixed an issue where Wizard fields with trailing whitespaces would break data visualizations [GL:XI#308] – SNS
Fixed an issue where whitespaces in the License Information page would cause problems [GL:XI#341] – SNS
Fixed an issue where adding a dashlet would break the page if a confirmation window was open [GL:XI#323] – BB
Fixed an issue where deleting multiple dashlets would cause console errors [GL:XI#324] – BB
Fixed an issue where sendmail couldn’t send to @localhost on PHP 8 [GL:XI#229] – BB
Fixed an issue where external redirects weren’t being blocked when using PHP 8 [GL:XI#199] – BB
Fixed an issue where the logrotate configuration wasn’t being updated properly [GL:XI#333] – BB
Fixed an issue where service descriptions weren’t displaying properly [GL:XI#293] – BB
Fixed an issue where the NCPA wizard would crash on PHP 8 [GL:XI#240] – BB
Fixed an issue where OAuth credentials could indicate that they succeeded when they failed if the user manually modified the files incorrectly [GL:XI#263] – BB
Fixed an issue where Highcharts graphs would show 0 for the Max: field in the labels [GL:XI#336] – BB
Fixed an issue with Email settings where it would check for SSL/TLS if None was selected [GL:XI#227] – BB
Fixed an issue where removing multiple dashlets would cause errors [GL:XI#324] – BB
Fixed an issue where Bootstrap popups wouldn’t close when switching tabs in the application [GL:XI#122] – BB

Core Config Manager (CCM) 3.2.1

Fixed issue allowing users to select inactive timeperiods [GL:XI#162] -AC
Fixed SQL injection vulnerability in the CCM Host and Service Escalation pages (Thanks Astrid Tedenbrant and Outpost24 for reporting this) (CVE-2023-40934) - DA

5.11.1 - June 28, 2023

Fixed

Fixed an issue where NDO would be misconfigured on upgrade – SAW
Fixed an issue where the NCPA configuration wizard would fail to load on some operating systems [GL:XI#123] – AC
Fixed an issue where the Autodiscovery configuration wizard would fail to load on some operating systems [GL:XI#123] – SS

5.11.0 - June 27, 2023

Updated

Changed BPI Groups page so that groups are sorted in descending status order. [GL:XI#160,#276] – PG, DA
Improved styling of “Email All Users” modal in dark mode on Manage Users page [GL:XI#250] – SG
Improved user experience in the SNMP Trap Interface [GL:XI#185] – PG
Improved performance in Capacity Planning report [GL:XI#52] – SNS
Updated nagios-plugins to version 2.4.5 – SAW

Added

Added the Windows SSH wizard to replace the Windows WMI wizard [GL:XI#117] – SNS
Added the ability to globally set number of hops in the Traceroute Action component [GL:XI#167] – PG
Added the ability to set system-wide banner messages [GL:XI#82] – SG
Added the ability to sort by additional parameters on the Manage Users page [GL:XI#80] – PG

Fixed

Fixed an issue in the help section where a duplicate document was being created [GL:XI#231] – AC
Fixed an issue in Report Management where negative page values caused an error to display [GL:XI#233] – SG
Fixed an issue with PostgreSQL to MySQL migration when the XI server was migrated across Linux distributions [GL:XI#230] – SAW
Fixed an issue causing an error on any page with a checkbox [GL:XI#238] – AC
Fixed an issue where TLS was always enabled when using SMTP on systems running PHP 7.4 or greater [GL:XI#237] – AC
Fixed an issue where removing certain optional dependencies would cause all dependencies to uninstall [GL:XI#241] – SAW
Fixed an issue where certain valid trial keys would fail to activate – SAW
Fixed a UI issue in Chromium-based browsers when mutliple banners are shown [GL:XI#275] – SG, DA
Fixed minor interface issue in Host and Service Status Detail pages [GL:XI#273] – SG
Fixed spelling error in scheduled backups [GL:XI#267] – SG

5.10.0 - May 16, 2023

Security

Added force mass immediate check functionality to the API [GL:XI#129] – DA

Updated

Improved readability for the SDESC/EDESC section of a defined trap in the SNMP Trap Interface [GL:XI#41] – PG
Fixed an issue where nagios.log was not included in the system profile [GL:XI#114] – CL
Disabled TRACE, TRACK, OPTIONS, HEAD methods for apache [GL:XI#57] – DA

Removed

Removed installation handling for unsupported operating systems [GL:XI#98] – SNS

Added

Added the ability to change service display names in the Bulk Renaming Tool [GL:XI#88] – CL
Added the ability to export and import dashboards [GL:XI#90] -AC
Added the ability to undo/redo recent changes when modifying dashlets – SNS
Added the CSV output type to the API [GL:XI#53] – CL,DA
Added the ability to send mail with OAuth2 using Microsoft – BB
Added the ability to send mail with OAuth2 using Google – BB

Fixed

Fixed an issue where Tools crashed when deleting added tools [GL:XI#128] – AC
Fixed an issue where certain dependencies would throw warning during installation [GL:XI#100] – SNS
Fixed an issue where links in BPI groups were incorrect [GL:XI#75] – PG
Fixed an issue where xml errors occured when using bulk renaming tools [GL:XI#88] – CL, BB
Fixed an issue where notify-host-by-email and notify-service-by-email would not send mail on CentOS Stream 9 [GL:XI#198] – SAW
Fixed an issue where adding a host or service to Nagvis would fail in MySQL 8 [GL: XI#106] – AC
Fixed an issue where the Nagvis component was not being upgraded to version 2.1.4 during an XI upgrade. [GL:XI#101] – AC
Fixed an issue where Autodiscovery and NCPA configuration wizards would break on systems running PHP 8 [GL:XI#123] -AC
Fixed an issue in the Manage MIBs page where one MIB entry showed two entries [GL:XI#77] – DA
Fixed an issue where certain logs would become cluttered when XI was offline [GL:XI#64] – PG
Fixed an issue where a white screen occurs when bulk-modifying contact groups on Ubuntu [GL:XI#170] – AC
Fixed an issue where LDAP/AD users had to conform to local password requirements [GL:XI#109] – AC
Fixed several issues with configuring SSL/TLS for AD/LDAP integration [GL:XI#4,5,112] – BB
Fixed an issue where dashlet borders were using Modern theme colors on Modern Dark theme when resizing [GL:XI#66] – AC
Fixed an issue where the Edit function of the SNMP Trap Interface was loading improperly [GL:XI#135] – PG
Fixed an issue in the profile script where Oracle system’s Linux distribution was incorrectly displayed [GL:XI#25] – SG
Fixed an issue where deactivating a service marked all services on that host as “not applied” [GL:XI#103] – DA
Fixed an issue where PHP-FPM would exhaust usable memory [GL:XI#152] – DA
Fixed an issue where the check_xi_update plugin would fail on PHP 8 [GL:XI#134] – SNS
Fixed an issue where feedback messages were not being displayed properly after applying bulk changes in the SNMP Trap Interface [GL:XI#183] – SG
Fixed an issue where phpmailer.log was not rotated, causing it to grow indefinitely [GL:XI#121] – SNS
Fixed several issues during installation while FIPS mode is enabled [GL:XI#139] – DA
Fixed SNMP Trap UI-UX on both edit and copy modals [GL: XI#188] – PG

Core Config Manager (CCM) 3.2.0

Added the ability to add and delete additional Arguments in CCM [GL:XI93] - PG
Fixed an issue where users were able to configure invalid service escalations [GL:XI#102] - AC
Fixed issue where a white screen would be displayed when editing contacts on Ubuntu [GL:XI#155] - AC

5.9.3 - February 1, 2023

Security

Fixed possible timing attack when using insecure ticket authentication (Thanks to Kevin Joensen of CSIS for reporting this issue) (CVE-2023-24035) -SAW
Fixed open redirect in Twilio component (Thanks Kevin Joensen and CSIS) (CVE-2023-24036) -SAW
Improve authentication token and salt generation (Thanks Kevin Joensen and CSIS) (CVE-2023-24037) -SAW
Update default php resource values [GL:XI#28] – SNS

Updated

Deprecate Debian 9 and Ubuntu 16.04 due to end-of-life [GL:XI#27] – SNS

Fixed

Fixed bad text wrapping in Availability Report graphs [GL:XI#73] -DA

5.9.2 - December 5, 2022

Updated

Made several improvements to RHEL/CentOS 8/9 compatibility -SAW,LG

Fixed

Fixed issues with missing timestamp with rrdtool xport [GL:XI#1] -LG
Fixed issues with NRPE 4.1.0 Upgrade – [GL:XI#26] -SAW
Fixed insecure auth token generation (Thanks to Kevin Joensen of CSIS for reporting this) -SAW

5.9.1 - August 31, 2022

Fixed

Fixed issues with MySQL tuning on Ubuntu 22 systems not adding the proper values in the config -JO
Fixed problem with SNMP traps in Ubuntu 22 not working properly due to permissions -JO

Core Config Manager (CCM) 3.1.9

Fixed issue with newer PHP 8+ systems having PHP fatal errors when editing objects -JO

5.9.0 - August 18, 2022

Security

Updated NRPE to 4.1.0 for security fixes -SAW

Updated

Updated PHP versions supported to include 8.0 and 8.1 -JO
Updated php.ini config options for new installs to have better defaults -JO

Added

Added support for CentOS 9 Stream / RHEL 9 and Ubuntu 22 systems -JO

5.8.10 - June 16, 2022

Updated

Updated max_connections, max_open_files, disable_log_bin in mysql_tune.sh -SAW
Updated install to give an error message on RHEL 8 systems when codeready-builder repo does not exist -JO

Fixed

Fixed issue where sometimes SID stored in $_COOKIE could cause invalid login token error until clearing cookies [TPS#15632] -JO
Fixed issue with SLA report causing not authorized error when selecting [Host Only] option [TPS#15734] -JO
Fixed an issue with previous cacerts directory fix [TPS#15713] -JO
Fixed issue with snmptt_service_results.php where it could create a file in place of the nagios.cmd pipe [TPS#15747] -JO
Fixed error in AD/LDAP integration where cert directory wasn’t properly being set on Ubuntu/Debian systems -JO

Core Config Manager (CCM) 3.1.8

Fixed issue with contact deletion where host/service configs were not being re-written on apply config [TPS#15744] -JO

5.8.9 - April 28, 2022

Security

Updated users account settings to require password confirmation to change email (CVE-2022-29270) (Thanks Alwin Warringa) -JO
Updated admin account settings to require password confirmation to change password and email (CVE-2022-29270) (Thanks Alwin Warringa) -JO
Fixed stored XSS security issue in Nagios BPI with the info URL not being escaped properly -JO
Fixed stored XSS security issue with command names having no encoding in the apply config error text -JO
Fixed stored XSS related to update checking -SAW
Fixed redirect on login page where redirect parameter urls could redirect user externally after login (CVE-2022-29272) (Thanks Alwin Warringa) -JO
Fixed scheduled report/send report email script allowing HTML code to be used in the message field (CVE-2022-29269) (Thanks Alwin Warringa) -JO
Fixed scheduled downtime page allowing read-only users to submit downtimes via crafted POST requests (CVE-2022-29271) (Thanks Alwin Warringa) -JO

Updated

Updated automysqlbackup script to default root mysql password if none is set [TPS#15739] -JO

Added

Added peer verification when loading external URLs -SAW

Fixed

Fixed issue in 5.8.0 upgrade for Debian and Ubuntu users -SAW

Core Config Manager (CCM) 3.1.7

Fixed copying of service object not copying excludes for Host/Hostgroups [TPS#15732] -JO
Fixed reflected XSS security issue in lock page Cancel button not urlencoding the returnurl value -JO
Properly fixed XSS security issue in search input on audit log page (thanks Hieu Tran(jkana101) from VCB STeam)) -JO

5.8.8 - March 8, 2022

Fixed

Fixed issue with Availability report rounding/data error in service averages in the data table [TPS#15609] -JO
Fixed issue in which NCPA CPU Usage metric did not display [TPS#15673] -PhW
Fixed both objects/servicestatus and objects/hoststatus to allow filtering by last_hard_state [TPS#15710] -JO
Fixed restore_xi.sh script to include all libexec plugins not just ones with file extension [TPS#15696] -JO
Fixed file permissions by having automysqlbackup script keep perms in /store/backups/mysql not world readable [TPS#15699] -JO
Fixed default mysql config file options during a clean install (does not get changed on upgrade) [TPS#15692,TPS#15698] -JO
Fixed AD ldapSlashes to properly fix escaping parens [TPS#15709] -JO
Fixed cacerts directory for AD/LDAP certificate management [TPS#15713] -JO

Core Config Manager (CCM) 3.1.6

Fixed issue where search was case-sensitive -JO
Fixed XSS security issue in search and deletion (thanks Hieu Tran(jkana101) from VCB STeam)) -JO

5.8.7 - November 2, 2021

Security

Updated migrate.php script to ensure that the nagios_bundler.py is not a security issue by copying it after tarball extraction -JO
Updated NSCA to version 2.10.1 to fix security issues -SAW
Fixed XSS vulnerability in Nagios Core ui by patching Core for XI systems with escape_string() -JO
Fixed XSS vulnerability in SSH Terminal page url parameter and the Account Information page api_key parameter -JO
Fixed XSS vulnerability in Audit Log page Send to NLS form -JO
Fixed security permissions issue with apache user and temp directory used by Highcharts -JO
Fixed security permissions issue with nocscreen component sounds directory -JO
Fixed manage_services.shs script vulnerability with systemctl not using the -no-pager option -JO
Fixed various security issues: (thanks [email protected] and [email protected] from Codesafe Team of Legendsec at Qi’anxin Group)
Fixed various XSS vulnerabilities in the auditlog.php admin page -JO
Fixed SQL injection possibility in mib_name parameter when uploading new MIBs in Manage MIBs page -JO
Fixed XSS vulnerability in the Admin > system performance settings page -JO
Fixed XSS vulnerabilities in the Admin > system settings page -JO
Fixed security vulnerability in nagiosna component in version 1.4.5 -JO
Fixed security vulnerability in MTR component in version 1.0.4 -JO
Fixed security issue in NRDS with version 1.2.8 -JO

Updated

Updated install to support Debian 11 systems -JO
Updated System Settings for “allow html” to separate options for status and comments under Other Settings and added a warning -JO
Updated NRDP to version 2.0.5 to fix issue with receiving spooled passive checks [TPS#15621] -JO

Fixed

Fixed issue with “Finish as Template” button not adding services do to new wizards using json encode/decode rather than serialize [TPS#15635] -JO
Fixed capactiyplanning.py giving out a lot of ValueErrors when pending checks are just starting to run -JO
Fixed issue where cloning user would not clone the user’s meta data [TPS#15617] -JO
Fixed bulk modifications issue when trying to remove Free Variables [TPS#15653] -JO
Fixed sysstat data on systemd systems when XML entities are in the output text causing the Admin > System Status to show “No Data” [TPS#15657] -JO
Fixed issue with cfgmaker with contact/location newlines causing it not to work [TPS#15666] -JO,SS

Core Config Manager (CCM) 3.1.5

Fixed Down stalking option not working for Host Templates in Alert Settings tab [TPS#15625] -JO
Fixed XSS vulnerability in ajax.php script -JO
Fixed issue with case insensitivity in regards to host/service names when importing configs (or running wizard) [TPS#15620] -JO

5.8.6 - September 2, 2021

Security

Updated NagVis component to version 2.0.9 to fix security issue (thanks Scott Tolley from Synopsys Cybersecurity Research Center (CyRC)) -JO
Fixed command injection security issue during installation of components, wizards, and dashlets in cmdsubsys -JO
(thanks Guillaume André of Synacktiv (https://synacktiv.com)) (CVE-2021-40345)
Fixed security issue in backend API auth where it was not properly authing the insecure login ticket -JO
Fixed security vulnerability with file permissions for the migrate nagios_unbundler.py script -JO
(thanks Guillaume André of Synacktiv (https://synacktiv.com)) (CVE-2021-40343)
Fixed SQL injection in the Manage MIBs admin page and Bulk Modifications page -JO
Fixed XSS security vulnerability in Manage My Dashboards page edit dashboard title attribute (thanks Matthew Dunn) (CVE-2021-38156) -JO
Fixed SSRF vulnerability in Scheduled Report URL when scheduled pages URL is outside the Nagios XI system
(thanks Ben Leonard-Lagarde (Modux)) (CVE-2021-37223) (TPS#15594) -PhW,JO

Updated

Updated Bulk Modifications Tool UI to use actual option names, and mirror UI from normal config page -PhW

Added

Added Stalking Notification and None options to Single Config Option for Bulk Modifications Tool [TPS#15597] -PhW

Fixed

Fixed issue with special characters in Top Alert Producers, State History, and Notifications reports [TPS#15599] -JO
Fixed built in DEV tools, so you can log values and monitor them through the web UI. -PhW
Fixed styling issue on the Check for Updates page when in Modern Dark theme -JO
Fixed issue in which deleting a host having an escalation caused an invalid config. -PhW

Core Config Manager (CCM) 3.1.4

Fixed reflective XSS in the test command due to double encoded html entities -JO
(thanks Amit Raut of Trend Micro Security Research working with Trend Micro Zero Day Initiative)

5.8.5 - July 15, 2021

Security

Fixed SQL injection vulnerability in Bulk Modifications Tool for some single config option types -JO
Fixed post auth RCE in autodiscovery due to path tranversal issue in job id -JO
Fixed possible insecurity in Nagios Mobile authentication where it would not exit/quit after redirecting unauthenticated users -JO
Fixed redirection vulnerability in login redirect url for some styles of urls -JO
Fixed vulnerability with xi-sys.cfg being imported from the var directory for some scripts with elevated perms -JO
Fixed insecure permissions on migrate.php and repairmysql.sh file (thanks Ben Leonard-Lagarde (Modux) & Lucas Fedyniak-Hopes (Modux)) (CVE-2021-36363, CVE-2021-36365) -JO
Fixed security issue with backup_xi.sh and manage_services.sh allowing using wildcards -JO
(thanks Ben Leonard-Lagarde (Modux) & Lucas Fedyniak-Hopes (Modux)) (CVE-2021-36364, CVE-2021-36366) -JO

Fixed

Fixed issue where critical or warning values in certain disk space metrics were rendered as green. -PhW
Fixed password email going out when AD/LDAP user is created without local password auth [TPS#15547] -JO
Fixed failed backup email sent when running a manual local backup [TPS#15546] -JO
Fixed timezone for Istanbul in utils-time.inc.php [TPS#15532] -JO
Fixed longserviceoutput macro not properly converting newlines to breaks in HTML email notifications [TPS#15537] -JO
Fixed issue when generating PDFs (and auth tokens in general) on usernames with uppercase letters in them [TPS#15542] -JO
Fixed display issue of host/service notes where double quotes were not displayed correctly [TPS#15543] -JO
Fixed issue with index.php page value not being properly validated before being passed to display page function -JO
Fixed issue where AD/LDAP wouldn’t search in base directory [TPS#15495] -JO
Fixed empty XML output when outputtype=xml for hostgroup/servicegroup API endpoints when there are no groups -JO
Fixed issue with manage_services.sh and restarting php-fpm on EL8 systems -JO
Fixed issue with Nagios Mobile not verifying a comment is set for scheduled downtime or acknowledge -JO

Added

Added extra folder name sanatization to the getprofile.sh script to make it more secure -JO

Core Config Manager (CCM) 3.1.3

Fixed SQL injection from improper escaping of values in search text -JO
Fixed timeperiod template name adding _copy_x to the template name even if empty which caused errors [TPS#15550] -JO

NDOUtils (NDO) 3.0.7

Added option “log_failed_queries” to ndo.cfg. Set this to 0 to disable failed query logging -SAW
Fixed issue where nagios_objects.name2 would occasionally be set to NULL -SAW
Fixed issue where leftover comments and other objects would cause hosts and services to continue showing in the database after deletion. [TPS#15549] -SAW
Widened all text columns significantly -SAW

5.8.4 - June 10, 2021

Security

Fixed vulnerability in getprofile.sh not clearing directory before creating profile -JO
Fixed SQL injection vulnerability in Bulk Modifications Tool -JO
Fixed XSS security vulnerability in about section -JO
Fixed security issue for config when upgrading system [TPS#15551] -JO

Updated

Updated getprofile.sh to delete a new profile’s folder before generating contents -JO

Fixed

Fixed install on newer Debian 9 systems due to default pip version [TPS#15535] -JO
Fixed issues with logrotate -JO,DC
Fixed getprofile.sh db_host value to properly pull from config.inc.php -JO,DC
Fixed restore_xi.sh using relative directory path -JO,DC
Fixed the “use” option to properly apply when using the config/contacts API endpoint -SS,JO

Core Config Manager (CCM) 3.1.2

Fixed XSS security vulnerability in CCM lock page functionality -JO

5.8.3 - March 31, 2021

Security

Updated email validation to require RFC 822 valid email addresses to fix possible security vulnerabilities -JO
Fixed XSS vulnerability in user Email Address field when on Send Test Notification page -JO
Fixed possible RCE vulnerability via Email Address not being properly validated (CVE-2020-24899) -JO

Updated

Updated jQuery to version 3.6.0 to fix minor issues -JO

Fixed

Fixed install process on Oracle Linux 8 due to mod_php being used instead of php-fpm like CentOS/RHEL -JO
Fixed config/ endpoints to properly display array of contacts (and other objects) when using append (+) in config [TPS#15509] -JO
Fixed argument quoting in mysqlrepair and restore_xi scripts -DC,JO
Fixed issue with Scheduled Backups sending local backup success email with SSH or FTP emails [TPS#15501] -JO
Fixed API help/example PUT config calls not working properly due to space not being url encoded [TPS#15505] -JO
Fixed scheduled reports jobs not changing with username change [TPS#15502] -JO
Fixed issue where masquerade button in the Manage Users page wasn’t working on some OS/PHP versions -JO
Fixed issues with MIB integration after upgrading to SNMPTT 1.4.2 [TPS#15376] -SAW
Fixed issues with Undo Trap Processing button [TPS#15500] -SAW
Fixed issue with downgraded ndo2db systems where limited users would not properly load data due to is_ndo_loaded failing -JO

5.8.2 - February 25, 2021

Security

Updated php.ini settings to add some more restrictive session options for better security -JO

Updated

Updated NRDP version to 2.0.4 to fix jQuery CVE and update Bootstrap version -JO

Removed

Removed deprecated code related to NDO 2 (get_db_backend_status, get_ndoutils_info_xml, API’s system/statusdetail dbbackend) -SAW

Fixed

Fixed issue with Enterprise message showing up on Rapid Response URL page even though it shouldn’t -JO
Fixed jquery 3 compat script not loading for wkhtmltopdf report generation when jQuery 1.x is disabled -JO
Fixed wkhtmltopdf delay/timeout not being set properly for page pdf generation -JO
Fixed default date, number, and week format set when creating a new user to match config settings [TPS#15428] -JO
Fixed special characters in ansible passwords with Deploy and Migrate scripts [TPS#15443] -JO
Fixed typo in Performance Settings Database tab [TPS#15446] -JO
Fixed issue with custom API endpoints not being passed the $args as an array -JO
Fixed Nagios Configuration location being passed to the migrate script when using advanced options in Migrate Server page -JO
Fixed Bulk Modifications Tool to make ARG8 work properly and fix checkboxes when setting a new command [TPS#15458] -JO
Fixed issue with snmptraphandling.py script not working properly with Python 3 [TPS#15461] -JO
Fixed My Scheduled Reports History tab to work properly with old PostgresQL installs of XI [TPS#15467] -JO
Fixed user permissions on newer MySQL servers to allow backup_xi.sh to do a mysqldump [TPS#15462] -JO
Fixed issue with backslash in service names not showing up when editing a Nagios BPI group [TPS#15457] -JO
Fixed snmptrapd not enabled/starting on some Debian and Ubuntu installations [TPS#15473] -JO
Fixed Two Factor email authentication in Nagios Mobile interface [TPS#15399] -JO
Fixed rrdexport API endpoint to allow passing the maxrows value to no longer be limited to the default [TPS#15433] -JO
Fixed issue installing on RHEL 8.3 due to codeready builder repo requirement [TPS#15463] -JO
Fixed permissions issues with Deploy Dashboards component -JO
Fixed permissions on the send_to_nls.php file to be owned by root and read only to other users -JO
Fixed Nagios BPI sync when applying configuration not waiting for NDO3 to load all data before running [TPS#15448] -JO
Fixed issue where php-fpm was not being restarted during CA cert add in LDAP/AD cert management page -JO

Core Config Manager (CCM) 3.1.1

Fixed issue where overlay would not allow scrolling for Free Variables list [TPS#15452] -JO
Fixed copying host/services with backslash in the name not copying the full name with backslash [TPS#15460] -JO
Fixed XSS security vulnerabilities in config_name and service_description on the Services page -JO
Fixed XSS security vulnerabilities in Overlay modals -JO
Fixed issue with writing out host with backslash in the host_name -JO

NDOUtils (NDO) 3.0.6

Increased performance for queries involving comment history and downtimes on large/long-running systems
Fixed error when adding downtimes which expire after 2038

5.8.1 - January 15, 2021

Fixed

Fixed issue with Admin > Manage Components page where the proper component name was not being set -JO

5.8.0 - January 13, 2021

Security

Fixed security vulnerability where PNP’s PHP templates were accessible from the interface -JO
Fixed stored XSS security vulnerability in My Tools page (thanks Matthew Aberegg) -JO
Fixed security vulnerability in Manage Plugins upload when using convert line endings option (CVE-2020-35578) (thanks Haboob Team) -JO
Fixed XSS security vulnerability in Nagios BPI config IDs (thanks Matt Aberegg) -JO
Fixed XSS security vulnerability in views url (thanks Matt Aberegg) -JO
Fixed XSS security vulnerability in SSH Terminal page (CVE-2021-25299) (thanks Nipun Gupta of Cloudfuzz) -JO
Fixed security vulnerability in Graph Template upload and PNP share directory (thanks Xinjie Ma from Chaitin Security Research Lab) -JO

Updated

Updated Rapid Response page sizing on mobile devices -JO
Updated Linux Server Config Wizard to use NCPA instead of NRPE -LG
Updated Highcharts to version 7.2.2 for bug fixes -JO

Added

Added Migrate Server utility to Admin section to migrate Nagios Core systems to Nagios XI -JO,SAW
Added new Configuration Snapshots page with ability to see raw diffs between configuration changes that have been applied -JO
Added services tab into Host Status Details page to see service status without leaving the page -JO
Added ability to deploy agents from the Auto Discovery tool and show if agents have been deployed to hosts that are discovered -JO
Added Microsoft 365 Config Wizard -LG
Added Linux Server Legacy Config Wizard that uses NRPE -LG
Added notification options to Scheduled Backups to notify via email when backups succeed or if they fail -JO
Added ease of use enhancements to the New Password input and Email User New Password checkbox in the Edit Users page -JO
Added Scheduled Reports History tab to My Scheduled Reports page and Report Managment section to view reports ran and the status -JO
Added ability to send URL parameters to PUT API config endpoints in case a parameter cannot be passed via the URL path -JO
Added support for deploying agents on Windows machines (if openssh server is enabled and configured) via Deploy Agents -JO

Fixed

Fixed Scheduled Backup logging so it logs output and errors directly into the scheduledbackups.log file when backups are ran -JO
Fixed issue with the coreuiproxy not properly working with URL encoded strings [TPS#15381] -JO
Fixed Scheduled Reporting logging file (/usr/local/nagiosxi/var/scheduledreporting.log) not being created by default -JO
Fixed Bulk Modifications Tool to properly apply check_command on host/services that do not have one [TPS#15385] -JO
Fixed Bulk Modifications Tool logging output not showing the proper host/service names in the audit log [TPS#15384] -JO
Fixed issue with forward slashes in name/definition of object configs in Nagios BPI [TPS#15356] -JO
Fixed service selection dropdown from changing sizes in Graph Explorer’s Multistacked graph tab [TPS#15368] -JO
Fixed issue with Auto Discovery not having Actions buttons if a running job finishes before moving off or refreshing the page -JO
Fixed theme/CSS issue with column sizes on large screens -JO
Fixed Ansible package installation on Ubuntu 18.04 LTS systems -JO
Fixed API endpoints config/host and config/service to make host_name and config_name values case sensitive -JO
Fixed changing timezone in EL8 systems not restarting php-fpm which causes php to have the wrong timezone until restarted -JO
Fixed issue with system/commands when using multiple command IDs [TPS#15408] -JO,SS
Fixed styling on Rapid Response page when using a trial enterprise license -JO
Fixed serial number for self signed SSL generated when selecting SSL option during install -JO
Fixed sysstat cron job cpu stats on newer versions of iostat in CentOS/RHEL systems -JO,DC
Fixed issue with Bulk Modifications Tool when removing a free variable where relationships would not show -JO

Core Config Manager (CCM) 3.1.0

Added checkbox in Import Config Files page that hides all configs outside of the import directory -JO
Added service excludes checkbox into Service Escalations -JO
Updated service object Misc Settings tab to remove config options that are not able to be set for services -JO
Updated Misc Settings information for how to use specific fields -JO
Fixed issue where object names with multiple spaces in a row would not import properly [TPS#15374] -JO
Fixed check command close button over the command output and command output sizing [TPS#15353] -JO
Fixed Service Escalations showing * for contact/contact group options since it is not usable [TPS#15403] -JO
Fixed Service not removing hosts properly when deleting a host and the service also has a hostgroup assigned [TPS#15415] -JO
Fixed excluding services, hosts, host groups from Service Escalations [TPS#15321] -JO
Fixed importing services on Service Escalations when host_name is set to * [TPS#15321] -JO
Fixed XSS security vulnerability with the Active/Actions buttons in the templates pages (thanks Matt Aberegg) -JO

5.8.0 - January 13, 2021

Security

Fixed security vulnerability where PNP’s PHP templates were accessible from the interface -JO
Fixed stored XSS security vulnerability in My Tools page (thanks Matthew Aberegg) -JO
Fixed security vulnerability in Manage Plugins upload when using convert line endings option (CVE-2020-35578) (thanks Haboob Team) -JO
Fixed XSS security vulnerability in Nagios BPI config IDs (thanks Matt Aberegg) -JO
Fixed XSS security vulnerability in views url (thanks Matt Aberegg) -JO
Fixed XSS security vulnerability in SSH Terminal page (CVE-2021-25299) (thanks Nipun Gupta of Cloudfuzz) -JO
Fixed security vulnerability in Graph Template upload and PNP share directory (thanks Xinjie Ma from Chaitin Security Research Lab) -JO

Updated

Updated Rapid Response page sizing on mobile devices -JO
Updated Linux Server Config Wizard to use NCPA instead of NRPE -LG
Updated Highcharts to version 7.2.2 for bug fixes -JO

Added

Added Migrate Server utility to Admin section to migrate Nagios Core systems to Nagios XI -JO,SAW
Added new Configuration Snapshots page with ability to see raw diffs between configuration changes that have been applied -JO
Added services tab into Host Status Details page to see service status without leaving the page -JO
Added ability to deploy agents from the Auto Discovery tool and show if agents have been deployed to hosts that are discovered -JO
Added Microsoft 365 Config Wizard -LG
Added Linux Server Legacy Config Wizard that uses NRPE -LG
Added notification options to Scheduled Backups to notify via email when backups succeed or if they fail -JO
Added ease of use enhancements to the New Password input and Email User New Password checkbox in the Edit Users page -JO
Added Scheduled Reports History tab to My Scheduled Reports page and Report Managment section to view reports ran and the status -JO
Added ability to send URL parameters to PUT API config endpoints in case a parameter cannot be passed via the URL path -JO
Added support for deploying agents on Windows machines (if openssh server is enabled and configured) via Deploy Agents -JO

Fixed

Fixed Scheduled Backup logging so it logs output and errors directly into the scheduledbackups.log file when backups are ran -JO
Fixed issue with the coreuiproxy not properly working with URL encoded strings [TPS#15381] -JO
Fixed Scheduled Reporting logging file (/usr/local/nagiosxi/var/scheduledreporting.log) not being created by default -JO
Fixed Bulk Modifications Tool to properly apply check_command on host/services that do not have one [TPS#15385] -JO
Fixed Bulk Modifications Tool logging output not showing the proper host/service names in the audit log [TPS#15384] -JO
Fixed issue with forward slashes in name/definition of object configs in Nagios BPI [TPS#15356] -JO
Fixed service selection dropdown from changing sizes in Graph Explorer’s Multistacked graph tab [TPS#15368] -JO
Fixed issue with Auto Discovery not having Actions buttons if a running job finishes before moving off or refreshing the page -JO
Fixed theme/CSS issue with column sizes on large screens -JO
Fixed Ansible package installation on Ubuntu 18.04 LTS systems -JO
Fixed API endpoints config/host and config/service to make host_name and config_name values case sensitive -JO
Fixed changing timezone in EL8 systems not restarting php-fpm which causes php to have the wrong timezone until restarted -JO
Fixed issue with system/commands when using multiple command IDs [TPS#15408] -JO,SS
Fixed styling on Rapid Response page when using a trial enterprise license -JO
Fixed serial number for self signed SSL generated when selecting SSL option during install -JO
Fixed sysstat cron job cpu stats on newer versions of iostat in CentOS/RHEL systems -JO,DC
Fixed issue with Bulk Modifications Tool when removing a free variable where relationships would not show -JO

NDOUtils (NDO) 3.0.5

Drastically reduced startup time for some systems
Fixed occasional long shutdown times in Nagios Core
Fixed segmentation faults related to severed MySQL connections
Fixed issue with service display_name being set to the service description

5.7.5 - November 12, 2020

Security

Fixed security issues with AngularJS 1.3.9 by upgrading to 1.8.2 -JO
Fixed various XSS security issues with older version of Bootstrap 3.3.x by upgrading to 3.4.1 in both Desktop and Mobile -JO
Fixed various XSS security vulnerabilities in Manage Users, Notification Settings, Agent Management, and Deploy Dashboard pages (thanks Namratha) -JO
(CVE-2020-27988, CVE-2020-27989, CVE-2020-27990, CVE-2020-27991)
Fixed privilege escalation security vulnerability with Auto-Discovery php script (thanks Chris Lyne of Tenable) (CVE-2020-28648) -JO
Fixed authenticated remote code execution in Auto-Discovery component (thanks Shahar Zini and Samir Ghanem from Skylight Cyber Security) -JO

Fixed

Fixed mobile redirect when trying to access the rapid response URL [TPS#15372] -JO

Core Config Manager (CCM) 3.0.8

Fixed various XSS security vulnerabilities in overlay and notification/check period -JO
Fixed issue with command escaping in Test Check Command [TPS#15167] -JO

5.7.4 - October 15, 2020

Security

Fixed SQL injection vulnerability in the edit page for SNMP Trap Interface (thanks Matthew Aberegg) -JO
Fixed CSRF security vulnerabilities in Manage MIBs page and SNMP Trap Interface (CVE-2020-5790) (thanks Chris Lyne of Tenable) -JO
Fixed RCE security vulnerability in the Manage MIBs page (CVE-2020-5791) (thanks Chris Lyne of Tenable) -JO
Fixed Command Argument Injection vulnerability in SNMP Trap Interface (CVE-2020-5792) (thanks Chris Lyne of Tenable) -JO

Fixed

Fixed issue with mysqladmin credentials not being set when creating a support Profile [TPS#15324] -JO
Fixed typos in Deploy Agent page [TPS#15336] -JO
Fixed issue with servicegroup_name not being populated in schedule downtime popup on Service Group Grid/Overview pages [TPS#15328] -JO
Fixed search box autocomplete not working on Host/Service Details pages -JO
Fixed Auto Discovery component when scheduling a recurring scan at either 12 AM or PM [TPS#15342] -JO
Fixed issue when updating a single component using the install button on the Manage Components page [TPS#15337] -JO
Fixed renaming objects via PUT request in API with only a name change causing apply config issues [TPS#15156] -JO
Fixed Recurring Scheduled Downtime for limited users services not showing up [TPS#15354] -SS,JO
Fixed Nagios BPI issues with newer systems with newer versions of git cmd using an invalid cmdline parameter -JO
Fixed issue with filtered output in SLA/Availability report when advanced options are set [TPS#15358] -JO
Fixed empty pending host/service check that could show up after hard system reset -JO

Core Config Manager (CCM) 3.0.7

Fixed various XSS sercurity vulnerabilities in the object edit pages (thanks Matthew Aberegg) -JO
Fixed various SQL injection security vulnerabilities in the object edit pages (thanks Matthew Aberegg) -JO
Fixed bug in the CCM Audit Log page which would not allow searching -JO

NDOUtils (NDO) 3.0.4

Fixed issue with downtime brokering on startup
Fixed logging of failed queries for WRITE_HOSTS/WRITE_SERVICES/WRITE_CONTACTS
Fixed blank host/service status rows that may get added during a hard restart

5.7.3 - September 3, 2020

Security

Fixed information tooltips in security popup during LDAP/AD user import [TPS#15247] -JO
Fixed XSS security vulnerability in Admin -> Manage Users (Thanks Christian Weiler) [TPS#15277] -SAW
Fixed XSS security vulnerability in Add/Manage Dashboard page and popup [TPS#15292]-JO
Fixed privilege escalation in backend scripts ran as root where some included files were editable by nagios user (CVE-2020-15903) (thanks ERNW) -JO
Fixed command injection vulnerability in report PDF Download (Thanks Christian Weiler) [TPS#15278] -SAW
Fixed privilege escalation vulnerability in getprofile.sh (Thanks Christian Weiler) [TPS#15279] -SAW

Added

Added missing scheduled downtime comment data to Host/Service Status Details pages [TPS#15190] -JO

Fixed

Fixed search on services page to properly search in a case insensitive way [TPS#15241] -JO
Fixed typo in Admin > Performance Settings max comment history age field [TPS#15227] -JO
Fixed library path for mrtg2, in cfgmaker. In some OS versions, the path needs to be ../lib64/mrtg2, instead of ../lib/mrtg2 [TPS#15213] -LG
Fixed library path for mrtg2, in mrtg. In some OS versions, the path needs to be ../lib64/mrtg2, instead of ../lib/mrtg2 [TPS#15213] -LG
Fixed parameter problem_has_been_acknowledged not working on hoststatus and servicestatus API endpoints [TPS#15256] -JO
Fixed backup/restore scripts to no longer copy over old nagiosmobile HTTPD config [TPS#15266] -JO
Fixed issue with the parameter host_object_id (host_id works) not working with objects API calls [TPS#15263] -JO
Fixed issue with Capacity Planning python script on Ubuntu 20.04 [TPS#15283] -JO
Fixed Inbound Email Processing when using Outlook and other clients that use Windows line endings [TPS#15285] -JO
Fixed clearner.php error on systems still running postgresql [TPS#15299] -JO
Fixed Host/Servicegroup summary dashlets commands link not working while they are inside dashboards [TPS#15196] -JO
Fixed Host/Service Details pages on smaller screen sizes having the record count/search bar overlap eachother [TPS#15304] -JO
Fixed issues with Dark Theme Highcharts graphs to be more readable and usable -JO

NDOUtils (NDO) 3.0.3

Fixed issue with version comparison in database upgrade script
Fixed issue with failed timed_event brokering on startup
Fixed issue with erroneous logging of notification brokering failures
Fixed improper handling of callback registration when some event types were disabled

5.7.2 - July 14, 2020

Security

Fixed security vulernability with audio import directory allowing php files to be uploaded/ran from that directory (thanks @TactiFail) -JO
Fixed XSS security vulnerability in background color in Dashboards (thanks @TactiFail) -JO
Fixed XSS security vulnerability in Config Management > Edit Config page in BPI component (thanks @TactiFail) -JO
Fixed XSS security vulnerability in Graph Explorer link url option (CVE-2020-15902) (thanks ERNW) -JO
Fixed RCE vulnerability with ajaxhelper.php when running certain commands through cmdsubsys (CVE-2020-15901) (thanks ERNW) -JO

Fixed

Fixed NDO issue where renaming hosts and services with uppercase/lowercase letters caused inconsistencies [TPS#15205] -SAW,JO
Fixed restricting access to auto deploy output JSON files -JO
Fixed brevity settings for objects/hoststatus and objects/servicestatus when using outputtype=xml -JO
Fixed issue with NDO connection in Nagios XI using latin1 as default charset instead of utf8 -JO
Fixed error updating audit log when removing a user [TPS#15172] -JO
Fixed warning/critical toggle button icon placement on Highcharts graphs with single dataset [TPS#15175] -JO
Fixed XML brevity causing isseus with Mass Acknowledge and other systems that rely on XML data [TPS#15179] -JO
Fixed displaying inactive objects that have been disabled in nagios_objects table -JO
Fixed issue where the “Check for Updates” button on Wizards/Components was not checking latest XI 5.7 versions -JO
Fixed Top Alert Producers report not showing on CentOS 8 / MySQL 5.7+ [TPS#15202] -JO
Fixed LDAP integration missing function causing a PHP error when trying to import users from LDAP -JO
Fixed backend cache causing problems when empty data was returned -JO
Fixed mod_gearman issue with NDO3 causing it to not use the mod_gearman module -SAW
Fixed ansible version issue for Auto Deployment component on Ubuntu 16 and Debian 9 systems [TPS#15200] -JO
Fixed issue with PHP 7 and Scheduling Queue page not showing up properly -JO
Fixed python setup for Ubuntu 20 systems which have both Python 2 and Python 3 installed -JO
Fixed NagVis installation issue with Ubuntu 20 and CentOS/RHEL 8 due to using Python 3 -JO
Fixed Manage Deployed Agents page where OS version would not always update or add when adding new agents [TPS#15192] -JO

NDOUtils (NDO) 3.0.2

Fixed host/service/contact tables being truncated on restarts (long-standing PENDING states in Nagios XI host/service status)
Fixed issue with writing contacts to object tables during startup when duplicate objects exist in the nagios configuration
Fixed issues around NDO trying to broker its own error logs when MySQL was disconnected or disabled
Fixed issues with NEB callback registration priority for Mod Gearman compatibility
Fixed issue where changing capitalization of an existing host/service would partially fail
Improved MySQL reconnection logic to increase chances of successful reconnection and reduce performance impact
Made previously compile-time debugging configuration available in ndo.cfg
Added more information to the logs when handling errors during startup
Added removal of inactive objects from the host/service/contact status tables instead of truncating them completelya

Core Config Manager (CCM) 3.0.6

Fixed security vulnerability with Static Config Editor allowing editing apache owned files outside static directory (thanks @TactiFail) -JO

5.7.1 - June 11, 2020

Security

Updated jQuery to version 3.5.1 to fix security vulnerabilities -JO
Fixed sourceguardian upgrade issue with old versions of XI on 32bit systems -JO

Fixed

Fixed non-admins not able to process host/service relations from the db causing the user to see no hosts/services -JO
Fixed issue with State History report causing a PHP error and would not display state data -JO
Fixed installation issue on RHEL 8 with redhat-lsb-core package installed -JO
Fixed resolving hostname in IP Mismatch popup check for systems with hostnames in the program URL -JO
Fixed styling issues on Configure main page when using Modern Dark theme -JO
Fixed the ndo2db manage_services.sh script status check to return a message since ndo2db was removed -JO
Fixed object status retries in the Performance Settings page not saving when set -JO
Fixed restore snapshot in CCM broker_module being overwritten with ndo2 version of broker module line -JO

NDOUtils (NDO) 3.0.1

Fixed failure on startup due to oversized subqueries in ndo_write_contact_objects, ndo_write_services_objects, and ndo_write_hosts_objects
Fixed errors when re-running the upgrade script for 2.1.3->3.0.x
Fixed “name1 is null” error messages during startup due to missing timeperiods.

5.7.0 - June 8, 2020

Security

Updated SourceGuardian loaders to now support PHP versions up to 7.4 -JO
Updated access methods for subsystems that needed random credentials and removed the Admin > “Security Credentials” page -JO

Updated

Updated NRDP to version 2.0.3 -JO
Updated NRPE to version 4.0.3 -JO
Updated Nagios Plugins to version 2.3.3 -JO
Updated objects API to no longer convert XML to JSON for a more consistent output and always returns the same structure at any result size [TPS#14740] -JO
Updated Bulk Modifications Tool to allow only setting certain arguments selected by checkboxes [TPS#14765] -JO
Updated layout on host/service status pages to maximize space and allow removing summary dashlets via page config settings -JO
Updated Hostgroup and Servicegroup command buttons to use popups instead of going to old Core proxy pages -JO
Updated restore_xi.sh script to ask for MySQL password when running if it cannot connect to MySQL [TPS#14294] -JO
Updated layout for LDAP/AD import user selection page to make more usable when selecting many users -JO
Updated Exchange config wizards to use NCPA instead of NSClient++ -LG,JO
Updated Windows Server/Desktop to use NCPA instead of NSClient++ -JO
Updated Legacy NSClient++ configuration wizard (used to be Windows Server/Desktop) -JO
Updated Availability report to increase speed by reducing the amount of data parsed when filtering -JO
Fixed Unconfigured Objects auto-configure templates to use ID to not cause config errors if template is deleted [TPS#14328] -JO
Fixed backend API using insecure login ticket (backend API is deprecated and will be removed in XI 6) [TPS#15087] -JO

Added

Added new Nagios Mobile interface that better integrates with Nagios XI -CN,SAW
Added support for CentOS/RHEL/Oracle 8 -JO
Added support for Ubuntu 20.04 LTS and Debian 10 -JO
Added NCPA agent deployment and updated NCPA config wizard -JO
Added notice to the login alert box that mentions if hostname or ip is valid in program url [TPS#2327] -JO
Added add and remove servicegroups to and from services in Bulk Modifications Tool [TPS#13587] -CN
Added ability to play sounds when state changes occur in the NOC screen [TPS#10777] -SAW
Added Audit Log messages for REST API calls [TPS#6913] -SAW
Added configuration options to send the Audit Log to Nagios Log Server [TPS#13942] -SAW
Added ability to set Dashboard backgrounds to transparent [TPS#14284] -JO
Added Config Management section to Nagios BPI component [TPS#14473] -JO
Added search box into LDAP/AD import page to decrease amount of users displayed and to find specific users [TPS#10230] -JO
Added new JSON configuration wizard -JO
Added new XML configuration wizard -JO

Fixed

Fixed issue with LDAP/AD select users toggle all/none checkbox not working properly -JO
Fixed limited LDAP/AD queries (PHP 5.3.x will require a search but will notify when limit is reached) [TPS#10230] -JO
Fixed resizing issue when updating dashlets in Capacity Planning tab in the host/service status details pages [TPS#15053] -JO
Fixed custom time range on SLA report to use proper time range specified [TPS#15048] -JO
Fixed issues with old RRDtool graphs not displaying properly in Performance Graph page [TPS#15076] -JO
Fixed certain NCPA checks running through test command causing wrong output -JO
Fixed CCM page in use message not clearing when on apply config page if they are expired [TPS#15163] -JO

5.6.14 - April 21, 2020

Security

Fixed postauth RCE issue with CCM test command function in command_test.php (X-Force 179405) -JO
Fixed postauth RCE issue in RRD exporting script export-rrd.php (X-Force 179404) -JO
Fixed issues with order by on SNMP Trap Interface SQL injections with a whitelist (X-Force 179406) -JO

Updated

Fixed installation issue with SUSE Extended Support for RHEL systems (Thanks Derek) -JO

Fixed

Fixed issue with CORS policy for API endpoints -JO
Fixed input filter text box in schedule host downtime page and CCM not working in Chrome [TPS#15073] -JO,SAW

5.6.13 - April 7, 2020

Security

Fixed post auth XSS vulnerabilities (CVE-2020-10819, CVE-2020-10820, CVE-2020-10821) -JO
Fixed security issues with Highcharts SVG generation -JO
Fixed RCE vulnerability in admin section’s NRDP/NSCA outbound check configuration (thanks @TactiFail) -JO

Fixed

Fixed minor usability issues with SNMP Trap Interface -SAW

5.6.12 - February 27, 2020

Fixed

Fixed issue with backups not properly generating due to tar creation errors -JO

5.6.11 - February 25, 2020

Security

Fixed unauthenticated XSS/SSRF in highcharts local exporting tool -SAW

Fixed

Fixed LDAP/AD integration CA certificate upload to allow both root and intermediate on same subject [TPS#14855] -JO
Fixed Bulk Modifications Tool add/remove free variables not setting last_modified value causing changes not to be written [TPS#14875] -JO
Fixed BPI removing host/services out of the groups when they are renamed [TPS#14929] -JO
Fixed unauthenticated username disclosure in suggest.php -SAW

5.6.10 - January 16, 2020

Security

Fixed RCE vulnerability with apache user code execution in Scheduled Reporting component (CVE-2019-20197) -JO
Fixed XSS vulnerability in Scheduled Reporting component and nocscreen (nocscreen can be upgraded from Admin > Manage Components) (CVE-2019-20139) -JO
Fixed login redirection to remove double slashes as part of redirection security parsing -JO

Core Config Manager (CCM) 3.0.5

Fixed several issues with importing service dependencies [TPS#14737] -SAW

5.6.9 - December 10, 2019

Fixed

Fixed CSS styling for host/service status tables in IE when using the dark theme [TPS#14653] -JO
Fixed issue in config/service API call that would not set free variables on already existing services [TPS#14660] -JO
Fixed service notes not showing in the Misc Info section of the Service Details page [TPS#14679] -JO
Fixed issue in AD/LDAP certificate management where certificates with binary data couldn’t be added [TPS#14690] -JO
Fixed the ndo preloading functions only searching for is_active=1 potentially causing duplicate objects on large systems -JO
Fixed issue with service/host filters not properly aligned on top of the table when hidedashlets=1 is set [TPS#14699] -JO
Fixed issue where Running “last week” report on first day of week gives wrong weeks data [TPS#14722] -SW
Fixed issue with search bar location when hideoptions is set [TPS#14735] -JO

Core Config Manager (CCM) 3.0.4

Fixed issue with CCM config imports that would delete all free variables when importing leaving only new ones -JO
Fixed form validation for object names and service descriptions to match the default illegal_object_name_chars directive in nagios.cfg -SAW

5.6.8 - November 5, 2019

Security

Updated SourceGuardian loaders to now support PHP versions up to 7.3 -JO
Updated jQuery to 3.4.1 and patched jQuery 1.12.4 for CVE-2019-11358 -JO
Fixed multiple security vulnerabilities that allowed nagios user command injections (thanks Jeremy Brown) -JO

Updated

Updated the getprofile.sh script to add the BPI configurations to the profile.zip -JO

Fixed

Fixed issue on SLA report where advanced options were not properly applying [TPS#14538] -JO
Fixed threshold/range function in check_rrdtraf plugin -CD,JO
Fixed issue with BPI sync checkbox being required when checking remove host/services that are missing on apply config [TPS#14590] -JO
Fixed negative numbers in Capacity Planning report and wizard -SAW
Fixed issue with overwriting user meta data on each page load causing LDAP/AD import blank screen for LDAP/AD users [TPS#14636] -JO
Fixed issue with BPI configuration comments and hash tags in hostgroup/servicegroup names -JO
Fixed issue where deleting multiple services from a host would cause only one to delete at a time during BPI sync [TPS#14649] -JO

5.6.7 - September 26, 2019

Added

Added IBM i service and custom sql config wizards on new installs -JO

Fixed

Fixed objects/bpi REST API output to properly display status text when there is HTML in the text [TPS#14406] -JO
Fixed issue with SNMPv3 checks using Perl on Ubuntu 18 systems [TPS#14432] -JO
Fixed problem where you cannot import time periods where timeperiod_name contains space [TPS#14440] -SW
Fixed logrotate configuration to set the user/group for xidebug.log and fix for snmptt log rotation -SW
Fixed issue with & used in BPI group name and when running plugin against that group [TPS#14464] -JO
Fixed issue where clearing and empty unconfigured objects list when there was no objects file would cause permissions issues on the file [TPS#14469] -JO
Fixed scheduled reporting for latest NagVis component so that scheduled pages can be sent as PDFs [TPS#14428] -JO
Fixed auth token and insecure auth token sessions to properly load user meta session data directly after login -JO
Fixed issue on EL7 systems where some output displayed by systemctl status during sysstat checks caused PHP XML parse warnings [TPS#14498] -JO

5.6.6 - August 20, 2019

Security

Fixed XSS and privilege escalation security vulnerability in Profile component and getprofile.sh script (CVE-2019-15949) (Thanks Jak Gibb) [TPS#14364] -JO

Fixed

Fixed issue where re-configuring objects page would not allow switching them back to notify immediately [TPS#14340] -JO
Fixed issue where Graph Explorer exporting would be broken after upgrades [TPS#14372] -SAW
Fixed BPI api_tool.php NDO wait timeout to allow for longer NDO startup times [TPS#14398] -JO
Fixed issue with dashlets that have been uploaded unable to be downloaded due to file permissions in tmp directory [TPS#14363] -JO
Fixed CCM form validation to allow backslashes in object names/service descriptions -SAW
Fixed MIB uploading/processing on Postgres-based systems [TPS#14365] -SAW
Fixed API DELETE methods not allowing URL path to be used like in the help section [TPS#14370] -JO
Fixed Bulk Modifications Tool find relationship listings to be sorted alphabetically [TPS#12156] -JO
Fixed logrotate configuration to set the user/group on systems except el6 which doesn’t require it -JO
Fixed issue with Recurring Scheduled Downtime not showing when services is set to only the * wildcard [TPS#14388] -JO
Fixed Nagios XI Bug Report: Config Wizard Template Notification Interval could not be set to 0 [TPS#14391] -SW
Fixed problem with reading multiple line hashes sent when an inbound email response is wrapped [TPS#14396] -JO
Fixed issue in Schedule Downtime page when deleting host/service group from list and it saying none are selected [TPS#14402] -JO

5.6.5 - July 18, 2019

Updated

Updated NRDP to version 2.0.2 to fix XML parsing causing passive check failures and no last check time -JO

Fixed

Fixed nagiosxi-deps to properly upgrade even if the install is from a version prior to XI 5 -SW
Fixed SLA dashlet not updating once sent to dashboard [TPS#14349] -SAW

5.6.4 - July 9, 2019

Updated

Updated NRDP to version 2.0.0 -JO

Fixed

Fixed issue with Bulk Modifications Tool where host/service templates would output SQL error when logging to audit log -JO
Fixed issue with Manage MIBs where duplicate MIBs would cause SQL error [TPS#14312] -SAW
Fixed Misc info section in services not populating hostname and service description macros properly [TPS#14296] -JO
Fixed Metrics component NCPA checks state status in the Summary and Gauges tabs [TPS14293] -JO
Fixed BPI sync issue when hostgroup and servicegroup have the same name [TPS#14291] -JO
Fixed API edit contact command not updating and not running the proper update function [TPS#14304] -JO
Fixed issue in API where editing services using PUT commands with / in their description doesn’t work [TPS#14311] -JO
Fixed issue with multiple commands in inbound email responses not scheduling downtime properly [TPS#14313] -JO
Fixed ramdisk issue with CentOS 6 installs and npcd not starting on restart [TPS#14318] -JO
Fixed restart_nagios_with_export.sh script lock file location to be the var directory instead of scripts -JO
Fixed issue with HTML in comments when sending HTML emails into the inbound email response system -JO
Fixed older postgres systems upgrading to newer versions having problems setting permissions on upgrade -SAW

Core Config Manager (CCM) 3.0.3

Fixed CCM database error when writing configs when a hostgroup of * for a service is selected [TPS#14334] -JO

5.6.3 - June 11, 2019

Security

Updated PHPMailer to version 5.2.27 for security fixes -JO

Fixed

Fixed sumoselect dropdowns to allow larger names in the selection boxes [TPS#14232] -JO
Fixed reset_config_perms.sh setting permissions for components folder in scripts directory -JO
Fixed Schedule Downtime services page not showing services when a user has a host and some unrelated services assigned [TPS#14253] -JO
Fixed upgrade error in ndoutils upgrade on old systems with non-standard MySQL port specified in config.inc.php -JO
Fixed an issue where imported SNMP Traps would not be associated with their parent MIB [TPS#14260] -SAW
Fixed issue with php upgrades on certain rhel systems not finding the proper php package name [TPS#14259] -JO
Fixed Custom Includes component folder permissions on upgrade [TPS#14266] -JO
Fixed issue with autotls being turned on by default in PHPMailer [TPS#14270] -JO
Fixed Graph Explorer icon permissions for hosts when a user does not have access to the host -JO
Fixed issue with Inbound Email Settings where selecting POP3 would not change the connection type -JO
Fixed usernames not syncing properly with the cgi.cfg and htpasswd.users files with uppercase characters [TPS#14273] -JO
Fixed scheduleddowntime API endpoint to accept passing multiple services with services[][] -JO
Fixed permissions on autodiscovery job folder from permissions changes to main autodiscovery script -JO
Fixed wording for STARTTLS encryption in LDAP/AD Integration component -JO
Fixed issue where session was not recorded in the database but wouldn’t be added until re-login -JO

Core Config Manager (CCM) 3.0.2

Fixed CCM database error when specifying database port number in the config.inc.php for nagiosql [TPS#14263] -JO
Fixed limited CCM users permissions not properly applying until after a new cached permissions call is made [TPS#14276] -JO

5.6.2 - May 15, 2019

Fixed

Fixed an issue where HTML e-mails were not handled correctly by the Inbound E-mail Processor [TPS#14205] -SAW
Fixed an issue where the Manage MIBs page would fail to load on Debian/Ubuntu -SAW
Fixed authenticator error message in cleaner.log when using Inbound E-mail Processor -TG,JO
Fixed alert screen checkbox in User Account Settings not set to checked by default -JO
Fixed issue with logrotate error from root:nagios var directory ownership -JO
Fixed enterprise features trial buttons on SLA and Capacity Planning report pages -JO
Fixed nxti.php script issues with SNMP Trap Interface on Debian systems -SAW
Fixed Scheduled Backups FTP backup limit deletion issue with PHP versions less than 5.6 -SS

Core Config Manager (CCM) 3.0.1

Fixed issue with default page limits and session page limits being set [TPS#14215] -JO
Fixed demo mode message and static directory location in Static Config Editor -JO
Fixed user language and translations not being applied for some variations of CCM user access types -JO
Fixed issue with Manage Users no result message and not allowing pagination or limiting -JO
Fixed config output of semicolon in check_command for config files to be escaped instead of url encoded [TPS#14225] -JO

5.6.1 - April 30, 2019

Fixed

Fixed style issue in Modern Dark theme re-configure notifications tab select boxes [TPS#14156] -JO
Fixed ownership permissions on folders and scripts and locations of sudo related scripts -JO
Fixed issue where newer NCPA versions checks were not showing up in metrics component [TPS#14032] -CN
Fixed issue where Validate SSL certificate checkbox in Inbound Email Settings would not allow being saved as unchecked -JO
Fixed FTP backup connection not using rawurlencode() for passwords causing connection problems -SS
Fixed error emails for inbound check commands to send out an error email when an email with no valid command is parsed -JO
Fixed upgrade issue where deps package would stop upgrade on systems without it [TPS#14184] -JO
Fixed issue with event_handler.php where the lock file would not be overwritten and stopped notifications being sent [TPS#14180] -JO

5.6.0 - April 18, 2019

Security

Added the config option in system settings > security to set the rapid response URL -JO

Updated

Moved Legacy Network Status Map link into Legacy Reports section in the Reports tab -JO
Fixed wording in deadpool emails to no longer say deleted if objects are to be deactivated -JO

Added

Added ability to acknowledge problems via email response [TPS#885] -JO
Added proper display name and alias resolution on host and service status and status detail pages -JO
Added Scheduling Queue page in Monitoring Process section [TPS#9566] -JO
Added a new Modern Dark theme which is the same as the current Modern theme but dark -JO
Added User Sessions page to show who is logged in, where they are, and IP address of logged in user [TPS#8732] -JO
Added higher page limits for Scheduled Downtime page and other pages including no limit [TPS#13530] -JO
Added ability to set host/services to inactive instead of deleting them with the Deadpool reaper [TPS#11390] -JO
Added more default checks on initial install [TPS#11013] -JO
Added Unconfigured Objects API endpoint (objects/unconfigured) [TPS#12181] -JO
Added scheduled downtime for child hosts as option for hosts in recurring downtime [TPS#13598] -JF,JO
Added configurable sql limit for the event_handler cron job -BH
Added ability for recurring scheduled downtime to update with host/service and hostgroup/servicegroup name changes [TPS#8060] -JO
Added callbacks: NOTIFICATION_EMAIL_SENT and NOTIFICATION_SMS_SENT and updated existing NOTIFICATION callback arguments -BH
Added performance data graphs to notification emails [TPS#12650] -BH
Added the ability to add/remove free variables in Bulk Modifications Tool [TPS#11775] -SAW
Added a configuration wizard and plugin for capacity planning [TPS#2173] – SAW
Added ability to show customvars in objects/host, objects/service, and objects/contact by sending customvars=1 in API request [TPS#12420] -JO
Added ability to schedule all hosts and/or services for hostgroups and servicegroups in Schedule Downtime page [TPS#10043] -JO
Added focus the first field of every page in the config wizards [TPS#11259] -SW
Added saving tactical overview configuration settings as a per-user setting. [TPS#6923] -SW
Added [datetime] macro to scheduled reports [TPS#9635] -SW
Added confirmation dialog when clicking the X on dashlets to confirm you want to delete the dashlet [TPS#7377] -SW
Added ability to edit alias and display_name on reconfigure host page and display_name on reconfigure service page [TPS#8724] -SW
Added better searching from host/service detail page to filter the displayed results instead of taking you back to the top level [TPS#13810] -SW
Added timestamp to filenames of downloaded and emailed PDFs, CSVs and JPGs [TPS#10680] -SW
Added ability to specify custom ports to scan in auto discovery [TPS#12383] -SW
Added downtime icons to Hostgroup Overview, Hostgroup Grid, Servicegroup Overview, Servicegroup Grid [TPS#10200] -SW
Added setting for trimming of Max Comment Age in Admin -> Performance Settings -> Databases [TPS#12313] -SW
Added /usr/share/snmp/ & /etc/snmp/ & /home/nagios to backup and restore scripts [TPS#10202] -SW
Added more time period options to Graph Explorer time period dropdown [TPS#13378] -JO
Added the ability to enable/disable the web GUI terminal [TPS#13690] -CN
Added notes, notes url, actions url in a Misc section on Host and Service details pages [TPS#13997] -JO
Added object type and states to Top Alert Producers as filter dropdowns like other reports -SS
Added ability to use config_name in api/config/services to update services with multiple hosts or hostgroups [TPS#13605] -JO
Added copying of all template and information linked to services when using Add Service in Bulk Modification Tool [TPS#13585] -JO
Added objects/timeperiod to the Objects API to show what time periods are available [TPS#13425] -JO
Added ability to set new user account information email text and subject in System Settings > User Accounts [TPS#11830] -JO
Added user’s API key allowing auth to Nagios Core JSON API endpoints via components/nagioscore/ui/(objectjson.php,statusjson.php,archivejson.php) [TPS#12717] -JO
Added “Create as Monitoring Contact” checkbox in Users edit page when applicable [TPS#14046] -SAW
Added new features to the Manage MIBs page [TPS#13946, TPS#4810] -SAW
Added ability for deleting multiple objects via the config API commands [TSP#10435] -JO
Added is_volatile to the list of single config options that can be changed in the Bulk Modifications Tool [TPS#14105] -JO
Added api/config options such as the PUT edit endpoints and added hostgroups and servicegroups [TPS#13425] -JO
Added right-hand alignment on system statistic dashlets (thanks Steve B) -JO
Added ability to select the default system theme on install -JO

Fixed

Fixed auto discovery status to no longer show throbber if it is waiting for it’s first scheduled run [TPS#7097] -SW
Fixed large systems with lots of limited users receiving duplicate key SQL error text in UI after apply config -JO
Fixed issue in Custom URL dashlet where it would not properly load certain pages when dashboard is exported as PDF -JO
Fixed re-configure “Edit in CCM” button when two services with the same name but have a different case -JO
Fixed Restart Nagios Core button in User Macros component not working properly -JO
Fixed Object Does Not Exist message on large systems when ndoutils database is loading with new adjustable performance setting [TPS#14108] -JO
Fixed scheduledowntime API endpoint not allowing author paramter to be set [TPS#14141] -SW,JO
Fixed issue in basic auth where username/user id would not be populated correctly (Thanks Mickey) -SAW

Core Config Manager (CCM) 3.0.0

Added deletion of services with host if services do not have hostgroups or other hosts attached [TPS#13537] -JO
Added proper audit logging to all the sections/actions that are performed [TPS#13495] -JO
Added ability to edit free variables instead of having to remove and re-add them [TPS#12054] -JO
Added Manage Service Groups and Manage Dependent Service Groups buttons to service dependency objects [TPS#9066] -JO
Added ability to import excluded hosts/hostgroups [TPS#14113] -JO
Added checkboxes for Host Groups and Service Groups in the CCM limited access permissions panel in user edit -JO
Added Service Groups to Service Escalation Objects [TPS#14136] -SAW
Added renaming of perfdata when a service or host is renamed [TPS#14143] -JO
Fixed issue where host/services applied to service groups would not show as Unknown for limited CCM users -JO

5.5.11 - February 28, 2019

Security

Fixed command injection security vulnerability in Autodiscovery script (CVE-2019-9164) (thanks Paolo Giai of Shielder) -JO
Fixed issue with permissions on config.inc.php and import_xiconfig.php allowing users to write to files (CVE-2019-9166) (thanks Paolo Giai of Shielder) -JO
Fixed an XSS vulnerability that can be passed in using the xiwindow parameter (CVE-2019-9167) (thanks Paolo Giai of Shielder) -JO
Fixed SQL injection when using Fuse Key and certain parameters (CVE-2019-9165) (thanks Paolo Giai of Shielder) -JO

5.5.10 - February 12, 2019

Security

Updated ADODB library to version 5.20.14 to fix bugs and XSS security vulnerability -JO

Updated

Updated Host and Service Status pages to hide dashlets by passing hidedashlets=1 in the URL -JO
Updated Japanese translation files -JO
Updated Graph Explorer fields to be searchable like other selectable dropdowns [TPS#13975] -SW,JO

Removed

Removed technicians’ diagnostic tool from SNMP Trap Interface -SAW

Fixed

Fixed CCM “Changes detected!” message now checks against each section, instead of specific config files [TPS#13970] -SAW
Fixed issues with Capacity Planning backend in preparation for configuration wizard and plugin [TPS#13817] -SAW
Fixed issue where parts of the SNMP Trap Interface would fail when using the XI 2014 theme [TPS#14024] -SAW
Fixed Object Does Not Exist error on Service Details page when using + in the service description [TPS#14003] -JO
Fixed services in Service Group which have the same beginning of a name on the same host not showing in config [TPS#14007] -JO
Fixed Unconfigured Objects not properly parsing host status check results [TPS#14009] -JO
Fixed Unconfigured Objects auto import host/service template selections not saving -SS
Fixed issue where the flash message bar would be underneath the help icon when help system is enabled -JO
Fixed URL links in PDF generated reports to properly use the external/internal URLs for links [TPS#14026] -JO
Fixed issue where enterprise restrictions weren’t activated properly in the SNMP Trap Interface [TPS#14025] -SAW
Fixed initial file permissions for auditlog.log when it is initially generated [TPS#14038] -JO
Fixed MySQL nagiosql errors in cmdsubsys.log for regular users with limited CCM access [TPS#14045] -JO

5.5.9 - January 17, 2019

Fixed

Fixed issue with Event Log decoding HTML elements improperly -JO
Fixed CCM imported service templates defaulting 0 for max_check_attempts, check_interval, retry_interval [TPS#13954] -JO
Fixed descriptions and raw data can be removed when editing a trap definition in SNMP Trap Interface [TPS#13971] -SAW
Fixed windows DOS line endings from user-inputted raw data in SNMP Trap Interface [TPS#13989] -SAW
Fixed an issue where table records would not load correctly in the SNMP Trap Interface using PostgreSQL -SAW
Fixed an issue in the SNMP Trap Interface where Trap Definitions could not be edited on systems using PostgreSQL [TPS#13968] -SAW
Fixed exporting perfdata when in two-column mode only rendering half of the graph [TPS#13979] -JO

5.5.8 - December 11, 2018

Security

Fixed XSS security vulnerabilities in rss_dashlet -JO
Fixed issue with nmap multiple IP addresses causing problems running because of security fix -JO,SS

Fixed

Fixed tmp directory for exporting RRD performance data -JO
Fixed UTF-8 characters in host/service names not allowing for external commands from the GUI to be processed [TPS#13833] -JO
Fixed upgrading Config Wizards due to wizards with the same directory name [TPS#13857] -JO
Fixed an issue where importing configuration from files/API would sometimes cause duplicate service definitions [TPS#13871] – SAW, JO
Fixed Availability dashlet to work like a normal dashlet and lookback period is properly set based on the report it’s created from [TPS#13841] -JO
Fixed lock file permissions for Core 4.2.4 (if users are using mod_gearman or had to downgrade to XI’s old version of Core) -JO

Core Config Manager (CCM) 2.7.4

Added icon to relationship popup for host/services that are inactive [TPS#13852] -JO
Fixed missing hosts/service from relationships popup when applied to groups that are set as inactive [TPS#13852] -JO

5.5.7 - November 13, 2018

Security

Fixed privilege escalation security vulnerability in MRTG graphing component by running as nagios user/group (thanks Daniel Sayk of Telekom Security) [TPS#13778] -JO
Fixed security vulnerability with API key regeneration function allowing non-admins to regenerate other user’s API keys (thanks Chris Lyne of Tenable) [TPS#13780] -JO
Fixed security vulnerability in BPI’s api_tool.php where the script could be accessed through the web server (thanks Chris Lyne of Tenable) [TPS#13780] -JO
Fixed security vulnerability in command subsystem with some commands not being escaped properly (thanks Chris Lyne of Tenable) [TPS#13780] -JO
Fixed security vulnerability in Auto Discovery component where some commands not being escaped properly (thanks Chris Lyne of Tenable) [TPS#13780] -JO
Fixed XSS security vulnerabilities in the interface (thanks Chris Lyne of Tenable) [TPS#13780] -JO

Fixed

Fixed old lock file location in snapshots by restoring lock file setting on snapshot restore [TPS#13795] -JO
Fixed Notes and Actions URL button links URL encoding in Host/Service Status pages [TPS#13802] -JO
Fixed Core issue (#572) causing service recovery emails to be sent when a initial notification wasn’t sent. [TPS#13805] -SW
Fixed Core issue (#575) where soft recovery states did not apply for services -JO
Fixed issue in API where hostgroup/servicegroup scheduled downtime would not schedule service downtimes [TPS#13818] -JO
Fixed BPI service group sync to not add empty service groups that cause an error on the screen [TPS#13777] -JO
Fixed BPI issue with the processing of subgroups applied to multiple groups failing to set proper status [TPS#13816] -JO

Core Config Manager (CCM) 2.7.3

Fixed issue with free variable escaping on CCM importing configuration files [TPS#13794] -JO

5.5.6 - October 30, 2018

Security

Updated PHPMailer to version 5.2.26 for security/bug fixes -JO

Added

Added documentation link to Deadpool Settings [TPS#11295] -SW

Fixed

Fixed Capacity Planning report issues with UTF-8 characters in host/service names -JO
Fixed auth/session checks in Capacity Planning API calls -JO
Fixed inconsistency with Hostgroup/Servicegroup members being pulled from the API causing dashlet issues in Fusion [TPS#13650] -SW
Fixed creating performance graph dashlet on host/service status pages causing page to scroll to top [TPS#13671] -JO
Fixed service config for ndoutils causing issues sometimes with starting when lock/sock exist -JO,BO
Fixed sorting of MIBS to be case in-sensitive [TPS#10281] -SW
Fixed default NRDP token to be set in config file on first visit to Admin -> Inbound Transfers [TPS#12198] -SW
Fixed Gauge Bug where gauge would not display of the value was just 0 [TPS#13757] -SW
Fixed Capacity Planning PDFs to have warning/critical lines when set to display automatically [TPS#13772] -JO

Core Config Manager (CCM) 2.7.2

Fixed not saving * selection for hostgroups and saving of negated hosts/hostgroups on services [TPS#13664] -JO
Fixed slow loading of objects (hosts/services/etc) on large systems due to no limits on main SQL query [TPS#13692] -JO
Fixed hosts and services menus go to the first page after a config is deleted or cloned [TPS#13766] -SW

5.5.5 - October 11, 2018

Fixed

Fixed adding new user creating a message that says current user should update their API key if they haven’t yet -JO
Fixed login link on rapid response URL when a ticket does not exist or has expired -JO
Fixed status check for NDO in BPI component API tool so that it properly sleeps after each call -JO
Fixed audit log max age value undefined default to 180 instead of 30 and added to performance settings -JO
Fixed an issue where notification settings would sometimes display incorrectly [TPS#13613] -SAW
Fixed an issue where hosts/services with forward-slashes (“/”) in their names would not reconfigure correctly [TPS#13607] -SAW
Fixed various PHP notices in error log -JO
Fixed issue with SLA report links not going to external (or program url if external is empty) when PDF is generated [TPS#13619] -JO
Fixed logging scheduled reporting pdf generation to wkhtmltox.log -JO
Fixed issue with reports/pages missing data in PDFs [TPS#13628] -JO
Fixed user permissions on non-active objects causing large/slow SQL queries on some systems -JO

5.5.4 - September 20, 2018

Security

Updated jQuery library to 3.3.1 due to security vulnerabilities with older jQuery versions [TPS#13541] -JO
Fixed XSS in auto login admin management page (Thanks Nathan Jones) -JO

Updated

Updated config.inc.php config value (set $cfg[‘old_browser_compat’] = 1;) to set jQuery to older version for IE 8 -JO

Fixed

Fixed cron for deadpool using old script that was not available on new installs -SW
Fixed misspelling in NXTI component when editing a defined trap [TPS#13558] -JO
Fixed issue with Recurring Downtime wildcards not working [TPS#13562] -JO
Fixed BPI output displayed when in problem state to not have HTML because output is too long [TPS#13552] -JO
Fixed malformed combined availability reports [TPS#13573] -CN
Fixed issue with configuraiton snapshot page permissions (Thanks Nathan Jones) -JO
Fixed issue with Nagios Core notifications during downtime -SW

5.5.3 - August 28, 2018

Fixed

Fixed nom script that runs automated config backups to use full nagios config check instead of nagios init script -JO
Fixed local backups not getting pruned [TPS#13474] -SW
Fixed issue with deadpool cron job not being able to delete host/services due to script changes -JO
Fixed SNMP Trap Interface issue with deleting defined traps on Postgres upgraded systems [TPS#13480] -JO
Fixed SLA report to have show/hide details links in hostgroup/servicegroup SLA reports [TPS#13479] -JO
Fixed SNMP Trap Interface issue where timestamps would sometimes show all zeroes [TPS#13508] – SAW
Fixed Manage MIBs “Process All Traps” button to use the same MIB conversion rules as the “Add to SNMPTT” option – SAW
Fixed SNMP Trap Interface issue where Show Test File Contents/Show Unknown Trap Log could freeze the browser – SAW

5.5.2 - July 26, 2018

Fixed

Fixed missing comments on hover for host/services on service detail page [TPS#13423] -JO
Fixed Scheduled Downtime page scheduling using full name not username like other places in GUI [TPS#13426] -JO
Fixed issue where scheduling some pages would cause PDF to have session timeout error [TPS#13427] -JO
Fixed dashboard background not working and background color selector in some browsers not showing shading [TPS#13432] -JO
Fixed performance graph title url link not working properly if service has url encoded name [TPS#13431] -JO
Fixed recurring downtime not able to read the recurring downtime configuration from older systems [TPS#13440] -JO
Fixed recurring downtime not properly scheduling services if host had any related downtimes [TPS#13441] -JO
Fixed issue in Nagios Core where scheduled flexible downtimes would not trigger downtime start -JO
Fixed bulk modifications tool to only shop the inheritance options when the configuration type allows them [TPS#13455] -JO

5.5.1 - July 12, 2018

Updated

Updated host and service details pages to show notes_url and actions_url links -JO
Updated notes_url and actions_url in host and service status/details pages to support some basic macro expansion [TPS#13387] -JO
Updated options in the BPI config settings to turn off automatic sync and object removal -JO

Fixed

Fixed issue in Schedule Downtime page where services won’t show if user is not a contact on the host [TPS#13374] -JO
Fixed missing fields in Audit Log for certain commands in cmdsubsys [TPS#13382] -JO
Fixed issue with Trial Extensions not applying if they weren’t a certain length [TPS#13379] -JO
Fixed auth token generation and login issue on upgraded PostgresQL systems -JO
Fixed SSL errors causing broken PDF reports on some systems configured for SSL -JO
Fixed issue where Nagios Core UI proxy would ask for authentication [TPS#13395] -JO
Fixed fix check_interval and retry_interval bug in Core 4.4.1 (Core Patch) -SW,JO
Fixed passive checks sending recovery email when host was previously UP (Core Patch) -SW
Fixed check_http causing certificate checks to fail if location was forbidden or had an error after check (Plugin Patch) -SW
Fixed metrics component to work with new NCPA wizard command names [TPS#13409] -JO
Fixed scheduled backups so that the proper amount of backups are retained in FTP/SSH backups -JO
Fixed tables for SNMP Trap Interface for upgraded systems -JO
Fixed sync and auto removing to run in BPI to their own cmdsubsys command that also checks if NDO is loaded [TPS#13407] -JO
Fixed display names on host and service status pages [TPS#13415] -SW,JO

Core Config Manager (CCM) 2.7.1

Fixed permissions not updating properly when a non-admin user creates a host/service object [TPS#13397] -JO

5.5.0 - June 28, 2018

Security

Added session timeout and keepalive settings to security tab in Admin > System Settings section [TPS#9938] -JO
Added insecure login security setting to allow old backend ticket-based auth on per-user basis -JO
Fixed minor XSS vulnerabilities [TPS#13211,13213] -JO

Updated

Updated backend for re-configure and apply configuration (reconfigure_nagios.sh) to no longer use wget [TPS#9908] -JO
Updated backend helper and deletion scripts (ccm_delete_objects.php) to no longer use wget [TPS#9908] -JO
Updated layout of profile.zip file and added timestamp to profile folder -JO
Updated Nagios Plugins to version 2.2.1 [TPS#11685] -JO
Updated NRPE to version 3.2.1 [TPS#11687] -JO
Updated NRDP to version 1.5.2 -JO
Updated NagVis version to 1.9.8 with auto-login Nagios modules -JO
Updated host and service detail menu links to say status instead, in line with the actual page titles [TPS#12059] -JO
Updated host and service SMS (text) message subject fields to be able to be blank [TPS#7099] -JO
Updated nagiosxi database username field to allow for 255 character long usernames [TPS#11608] -JO
Updated user passwords to a more secure algorithm/process [TPS#12158] -JO
Updated wording for display host/service aliases (to accurately reflect that they display the display name) [TPS#7112] -BH
Updated PDF and JPG report exports to use localhost/local url instead of internal url -JO
Updated permissions for sudo-ran scripts in fullinstall and reset_config_perms.sh [TPS#12730] -JO
Updated layout for Capacity Planning report to utilize the full screen size -JO
Updated API objects backend to use json_encode() instead of xml2json for PHP version consistency which also removed “list” from API output -JO

Added

Added mobile phone verification to be able to receive text message notifications (on upgrade, already entered numbers will be set to verified) [TPS#12042] -JO
Added the host and service notes_url and action_url icons/links to the host/service status pages in XI [TPS#7893] -JO
Added versions for Nagios Core, Nagios-Plugins, SSH Terminal, NRPE, NSCA, PNP, etc in profile [TPS#1456] -JO
Added installed components, wizards, and dashlets version numbers in profile [TPS#1456] -JO
Added ipcs command to profile [TPS#9108] -BH
Added audit logging for CCM -> Write Config Files [TPS#7954] -BH
Added ability to click username to edit user in Manage Users admin page [TPS#6186] -JO
Added state filtering into state history report [TPS#5970] -JO
Added removal of user’s scheduled reports from the apache cron tab when deleting a user [TPS#8239] -JO
Added SSH key authentication as a scheduled backup SSH authentication method [TPS#4689] -JO
Added encryption to the passwords that are stored from scheduled backups FTP and SSH auths [TPS#4689] -JO
Added number of checkpoints held as an option in performance settings under “Snapshots” [TPS#8345] -JO
Added new Manage Reports page to the Reports tab for admins to manage users scheduled reports [TPS#11609] -JO
Added checkbox in user’s Account settings section under Notification Methods to have emails send as plain text only [TPS#10895] -JO
Added two factor authentication for users by verifying the user received an email token [TPS#12189] -JO
Added setting for two factor authentication to remember a user and browser to skip two factor auth [TPS#12189] -JO
Added shellinabox as a replacement for Ajaxterm which has been removed for SSH Terminal enterprise feature [TPS#12202] -JO
Added setting in system settings > password & accounts to not allow old passwords to be used again when changing passwords [TPS#12132] -JO
Added allow SSL/HTTPS-only option on install [TPS#12073] -JO
Added table sorting to the downtime scheduling page [TPS#9194] -JO
Added auto configuration/import of unknown incoming passive checks if enabled in unconfigured objects page [TPS#2231] -JO
Added ability to select week format (week starts on Sunday or Monday) [TPS#8082] -JO
Added new datetimepicker to reports to easily be able to select times including hours, mins, and seconds [TPS#12048] -JO
Added commands (core), scheduleddowntime, auth servers into system API backend -JO
Added raw import, commands, into config API backend -JO
Added auth tokens for single-use login and ability to authenticate to an API endpoint -JO
Added automatic BPI sync (and remove missing hosts/service) on Apply Configuration in the CCM [TPS#6127] -JO
Added ability to activate product from inside the GUI without having to manually get activation code -JO
Added setting in system settings to disable renewal reminders for non-admin users -JO
Added a help document with instructions for updating and creating translations [TPS#12830] -JO
Added links to the host/service details pages for hostgroups and servicegroups [TPS#12055] -JO

Fixed

Fixed issue with host and service template filter search box in bulk modification tool [TPS#13163] -JO
Fixed links in notification report when host or service has an alias defined [TPS#13251] -JO

Core Config Manager (CCM) 2.7.0

Added CCM limited and full access via session for regular users (CCM ‘limited’ user) [TPS#13227] -JO
Added contact alias next to contact name in contact overlay when an alias exists [TPS#10049] -JO
Added services applied to hostgroups to the host services list on service groups [TPS#13158] -JO
Updated copying a service change the service name and not the config name [TPS#12270] -JO
Updated writing configs to no longer rely on pear library HTML_Template_IT [TPS#12386] -JO
Updated importing config search to be case-insensitive -JO
Fixed importing services with multiple objects finding the proper config name [TPS#13303] -JO

5.4.13 - March 13, 2018

Security

Fixed XSS vulnerability in views page -JO
Fixed RCE vulnerability in component download page (Thanks Bjoern Brixner at Telekom Security) -TM
Fixed vulnerability in NagiosQL (Thanks @iotennui, @BennyHusted, @0xC413 on twitter) [CVE-2018-8733,CVE-2018-8734,CVE-2018-8735,CVE-2018-8736] -JO,TM

Added

Added notification alteration callbacks -JO
Added notification template callbacks, updated documentation -BH

Fixed

Fixed NPCD not showing as running in systemctl on EL7 systems even though it is running [TPS#12924] -JO
Fixed command subsystem to only try to package and download components/dashlets/configwizards that exist -JO
Fixed enterprise only banner for sending single report emails [TPS#13025] -JO
Fixed permalink URL generation to use the proper location when sending xiwindow url [TPS#13036] -JO
Fixed scheduled report subject field to not append generic text when subject is set [TPS#13062] -JO
Fixed deadpool not running properly on it’s cron [TPS#13075] -SW
Fixed BPI calculation to use round() properly so groups > 1000 objects shows proper statuses [TPS#13078] -JO
Fixed dashboards disappearing with non-UTF8 names/titles (can use config.inc.php option $cfg[‘db_conn_utf8’] = 0; in some cases) [TPS#13051] -JO

Core Config Manager (CCM) 2.6.11

Fixed u option in service dependencies for execution_failure_criteria & notification_failure_criteria to reak Unknown instead of Unreachable -SW
Fixed hostgroup excludes on service management page [TPS#12952] -JO
Fixed CCM importing config name value in service definitions -JO

5.4.12 - January 16, 2018

Security

Fixed double percents (%%) in performance graph legends [TPS#12701] -JO

Fixed

Fixed url encoding in outbound NRDP checks [TPS#12742] -SAW
Fixed MRTG cron job arguments for lock file for EL7 in rpms [TPS#12865] -JO
Fixed flexible downtime duration setting in scheduled downtime page [TPS#12890] -JO
Fixed downtime duration column to show proper duration for fixed and fledible in scheduled downtime page [TPS#12890] -JO
Fixed install script not recognizing IP address on llipv6-only machines [TPS#8588] – SAW
Fixed upgrade from GUI where upgrade textarea would stop updating even though upgrade finishes [TPS#12571] -JO
Fixed htmlentities in SLA report breaking UTF-8 characters [TPS#12905] -JO

5.4.11 - October 31, 2017

Fixed

Fixed ampersand encoding in URLs on the views page [TPS#12526] -JO
Fixed perfdata graphs legend data units of measurement when first unit has none specified [TPS#12504] -JO
Fixed the acknowledgment/handled state icon in BPI -JO
Fixed issue where some groups would not get proper status checks (due to recursion) in BPI [TPS#12488] -JO
Fixed issue with utf8 character encoding with MySQL connections in Bulk Renaming Tool and elsewhere [TPS#12537] -JO
Fixed time stamp in eventqueue [TPS#12597] -SAW
Fixed issue with graph explorer dashify not checking NSP [TPS#12562] -SAW
Fixed Recurring Scheduled Downtime service descriptions with * in them not showing up in list [TPS#12616] -JO
Fixed alert histogram link in Nagios Core UI from host/service advanced section [TPS#12655] -JO
Fixed issue where XML for BPI was being read from cache only on API calls -JO,CN
Fixed issue where manually running a check command would display the value of potentially sensitive user macros [TPS#12673] -CN

Core Config Manager (CCM) 2.6.10

Fixed flap detection options values not showing properly in the CCM as selected [TPS#12654] -JO

5.4.10 - September 20, 2017

Fixed

Fixed recurring downtime services tab for users to correctly show downtimes they have created if they have service perms [TPS#12434] -JO
Fixed LDAP multiple naming contexts if context has no dc= in the name [TPS#12435] -JO
Fixed issue with IPv6 addresses not redirecting properly [TPS#12461] -JO

Core Config Manager (CCM) 2.6.9

Fixed new MySQLi database connection charset to be UTF8 [TPS#12441] -JO

5.4.9 - September 7, 2017

Security

Fixed XSS security vulnerabilities (Thanks Björn Brixner at Telekom Security, Sobolev Eugene, itpsl.org, H_D, PenGenKiddy, and RO421) [TPS#12285,TPS#12374] -JO

Updated

Updated Japanese language translations (thanks Suzuki) -JO

Fixed

Fixed language settings for user not showing up as translated -JO,SB
Fixed schedule downtime (and others) requirement check to trim data before doing field required checks [TPS#12303] -JO
Fixed some pages admin-only permissions -JO
Fixed AD/LDAP import when password complexity requirements are enabled [TPS#12334] -JO
Fixed unconfigured objects for host-only results [TPS#12361] -JO
Fixed installation on systems with non-standard CentOS/RHEL suoders file by trying to fix issues if possible [TPS#12380] -JO

5.4.8 - August 2, 2017

Security

Fixed XSS security vulnerability (thanks Olvieira Lima) -JO

Fixed

Fixed inconsistency with different object types in the API help examples for configs [TPS#12162] -JO
Fixed perfdata graph links for services with spaces in them [TPS#12170] -JO
Fixed host comment and acknowledgment icons not linking to the details page like the service ones [TPS#12184] -JO
Fixed some text inconsistencies in the bulk modifications tool [TPS#12172] -JO
Fixed auto-login button on main page not doing an auto login [TPS#12203] -JO
Fixed issue with SLA dashlet/report where certain custom time frames wouldn’t show up properly [TSP#12248] -JO

Core Config Manager (CCM) 2.6.8

Fixed issue when cloning timeperiods that have a ‘name’ value set (templates) [TPS#12159] -JO
Fixed the free variable number to update after closing the free variable box [TPS#12176] -JO
Fixed issue with importing host and service names with + in them [TPS#12161] -JO

5.4.7 - July 11, 2017

Security

Fixed various minor security issues [TPS#12112,12113,12117,12120] -JO

Updated

Updated encrypted files to work with PHP 7.0.x and 7.1.x -JO,SW

Fixed

Fixed issue with SLA report SLA Target value being set to an int [TPS#12079] -JO
Fixed issue in secured rapid response where URL was not passing proper parameters when users are redirected after login [TPS#12098] -JO
Fixed popup view of recent snapshots view action on the CCM splash page [TPS#12083] -JO
Fixed executive summary PDF and JPG download option not working [TPS#12105] -SS,JO
Fixed PDF generation missing some fonts on EL7 full installs [TPS#12104] -JO
Fixed get_xml_comments() in host and service ajax helpers to limit comment query down to only the objects that are visible [TPS#12064] -JO

5.4.6 - June 27, 2017

Updated

Updated languages to include Bulgarian translations (Thanks Ludmil) -JO, LL

Fixed

Fixed upgrade failing if no services or host config files existed in the main config directories [TPS#11921] -JO
Fixed issue on host/service status details pages where changing page limit from low to high showed no results found until refresh [TPS#11897] -JO
Fixed inactive contacts from being selectable on the contact list in bulk modifications tool [TPS#11950] -JO
Fixed link to CCM from “Re-configure” section in host/service details page to remove “Config Name” value when doing search [TPS#11700] -JO
Fixed dashlet refresh rates on object status pages to show up in “dashlet” tab in performance settings [TPS#11974] -JO
Fixed state history link in Top Alert Producers report page [TPS#12045] -JO

5.4.5 - May 31, 2017

Security

Fixed various minor security issues -JO

Updated

Updated re-configure service message and link for advanced configurations [TPS#11700] -BH
Updated validation for URLs to use internal PHP validation on PHP 5.2+ [TPS#11689] -JO
Updated BPI host and service group sync to actually remove host and service groups from BPI that have been deleted or have no members [TPS#11743] -JO

Fixed

Fixed issue with MySQL ports configured in-line inside config.inc.php [TPS#11688] -JO
Fixed Nagios BPI issue where adding new groups would cause spacing issues in the config [TPS#11721] -JO
Fixed issue with port for MySQL in automysqlbackup, repair, backup, and restore scripts [TPS#11754] -SS, JO
Fixed typos in API reference config object help section [TPS#11782] -JO
Fixed reset password sending username in GET parameters with password reset token [TPS#11793]
Fixed restore_xi.sh script to allow for overriding default password [TPS#9710] -BH

Core Config Manager (CCM) 2.6.7

Fixed result limit box in the CCM settings page to be a dropdown to match the CCM pages [TPS#11648] -JO

5.4.3 - March 16, 2017

Updated

tags [TPS#11244] -JO Fixed deadpool service filters regex match looking at hostname instead of servicename [TPS#11301] -JO

Fixed

Fixed Rapid Response not respecting acknowledgement defaults [TPS#11014] -BH
Fixed scheduled downtime where multiple hosts and “apply for all services” do not create host downtime and doubling services [TPS#11060] -JO
Fixed reset_defaults.sh to ask if user wants to reset before running [TPS#11065] -JO
Fixed gauge dashlet from not working on certain datastore names [TPS#10923] -JO, BH
Fixed extra memory usage that could hit php memory limit in graph explorer’s fetch_rrd function -JO
Fixed additional hard-coded database name in SQL query [TPS#10936] -JO
Fixed Schedule Downtime using the browser’s hostname instead of localhost for downtime query [TPS#11153] -BH
Fixed deadpool hostname escaping issue when running final stage deletion command -JO
Fixed deadpool cron run time from every 5 minutes to every minute [TPS#11230] -JO
Fixed sorting order in create and edit BPI group host/services member slection list [TPS#11204] -JO
Fixed permalink creation to create based on external url and urlencoded frame url [TPS#11198] -JO
Fixed command check test showing up as html entities in

Core Config Manager (CCM) 2.6.6

Fixed default page limit to be set properly [TPS#11026|11028] -JO, BH
Updated CCM Table to accurately display ‘Config Name’ instead of ‘Service Name’ [TPS#11170] -BH
Nagios Core
Fixed issue with flexible downtime disabling notifications for host/services (4.2.4 patch) -JO, JF

5.4.2 - February 7, 2017

Fixed

Fixed no output on repair_databases.sh script when locked -BH
Fixed no newline occasionally on API Error [TPS#10883] -BH
Fixed deadpool cron to use the default language set for the Nagios XI server in “User Defaults” [TPS#10764] -JO
Fixed license key wording when switching from FREE to licensed to give better information [TPS#10858] -JO
Fixed issue where the shown scheduled backup directory was set to /usr/local/nagiosxi in the interface [TPS#10868] -JO
Fixed license page enterprise license key display message [TSP#10860] -JO
Fixed issue with ndo2db upstart job conflicting with ndo2db init script [TPS#10882] -JO
Fixed issue where nagios.log cannot be read by the nagios group causing legacy report failures [TPS#10891] -JO
Fixed initial libexec plugin permissions on initial install [TPS#10900] -JO
Fixed perfgraph page to show dropdown options as “Last x days” to accurately reflect the lookback period [TPS#10902] -JO
Fixed issue with htmlentities on scheduled report message not displaying non-english characters correctly [TPS#10893] -JO
Fixed gauge not showing for Root Partitions [TPS#10923] -BH
Fixed issue with Bulk Mod Tool that used a hardcoded database name instead of one in config.inc.php [TPS#10936] -JO

5.4.1 - January 26, 2017

Security

Fixed PHPMailer security vulnerabilities by updating to 5.2.22 -JO
Fixed deployed, synced dashboards to automatically be removed when the dashboard is deleted by the source dashboard [TPS#10720] -JO

Updated

Fixed restore_defaults.sh inability to be ran outside of scripts/ dir [TPS#10605] -BH

Fixed

Fixed upgrade properly detecting mysql/mariadb [TPS#10603] -BH
Fixed restore_defaults.sh to take offloaded db into consideration, and now uses proper credentials [TPS#10627] -BH
Fixed issue in Safari that made scheduled downtime page not be able to select hosts/services [TPS#10617] -JO
Fixed issue where some systems would show ndo2db as not running in the GUI even though the daemon is running [TPS#10636] -JO
Fixed issue on AD/LDAP import page where errors were not displaying and server wasn’t re-selected on form submit [TPS#10640] -JO
Fixed issue with host/service detail table status page graphs exporting using Highcharts dropdown [TPS#10672] -JO
Fixed issue with Help System not loading help videos in systems using HTTPS [TPS#10697] -JO
Fixed issue with Help System where resizing the windows would empty the help popup -JO
Fixed empty or FREE license key giving invalid key message during trial time period on license page [TPS#10725] -JO
Fixed legacy network map from not changing map type when selecting type icons [TPS#10774] -JO
Fixed status map issues with single hosts (Core 4.2.4 update) [TPS#10808] -JO
Fixed profile component to have more logging lines and the more useful log files [TPS#10829] -JO

Core Config Manager (CCM) 2.6.5

Fixed services and escalations showing ‘unreachable’ opposed to ‘unknown’ [TPS#10589|10533] -BH, JO
Fixed issue where test commands did not work on systems with a php version less than 5.3 [TPS#10633] -SW
Fixed dropdown items per page not working when selecting “None” [TPS#10632] -JO
Fixed issue with CCM import not accepting commas even though it splots on them [TPS#10736] -JO

5.4.0 - December 28, 2016

Security

Fixed security type not being respected properly by LDAP/AD Integration component [TPS#8557] -BH
Fixed various XSS vulnerabilities (BPI url, Scheduled Backups url) -JO

Updated

Upgraded NRDP to version 1.4.0 -JO

Added

Added combined CSV export option for availability report [TPS#9682] -LG
Added support for offloaded databases in the repair_databases.sh script [TPS#6270] -BH

Fixed

Fixed email not being updated for XI Contact when XI User is updated [TPS#6291] -BH
Fixed issue where system status popup would show white text for non-admins who can view it [TPS#10055] -JO
Fixed issue with French translations in LDAP/AD import/manage servers pages [TPS#10473] -JO
Fixed issue spaces in mibs cause snmptt to fail (manage mibs page now replaces spaces with _ on upload) [TPS#10486] -JO
Fixed text on views popups to not have unprocessed html output in them [TPS#10499] -JO
Fixed issue with RRD exporting that would not work with : in the service description [TPS#10566] -SS, JO

Core Config Manager (CCM) 2.6.4

Fixed issue with ID and page number not being an int -JO
Fixed various XSS vulnerabilities (search bar and others) -JO
Fixed issue with returnUrl set to non-CCM url -JO
Fixed issue with importing contacts/contact groups not importing all contact options [MT#800] -JO
Fixed exclamation points being unable to be used in command arguments in CCM [TPS#9741] -BH

5.3.4 - December 14, 2016

Fixed

Fixed NTP on full install (was enabled but not started) -JO
Fixed apache cron permissions for backup and restore scripts -JO
Fixed sudo call for getprofile.sh call to use full path [TPS#10195] -JO
Fixed use of * character in AD/LDAP directory/group names [TPS#10238] -JO
Fixed cancel button on multiple pages still submitted form [TPS#10253] -SW
Fixed shell scripts to use full path [TPS#10278] -BH
Fixed alias being updated when ‘Name’ field changed on user update [TPS#10288] -BH
Fixed missing delete button image on unconfigured objects page -JO
Fixed perfdata graph sizing on availability report [TPS#10294] -JO
Fixed system status layout on 2014 and classic themes [TPS#10308] -JO
Fixed multiple styling issues with 2014 and classic themes -JO
Fixed XML escaping to work properly on large values [TPS#10355] -JO, BH
Fixed default last, avg, max values to be set for perfdata graphs [TPS#10359] -JO
Fixed shapes of highchart graph series data in tooltips will now match the legend in all template files [TPS#8017] -LG
Fixed perfdata graph dashlets to resize to default values [TPS#10413] -JO
Fixed non-standard ports for databases breaking upgrade [TPS#10440] -BH

Core Config Manager (CCM) 2.6.3

Fixed issue where some objects (timeperiods, commands) could not view relationship info in popup [TPS#10117] -JO
Fixed issue where Cancel button would not return to the view list when editing from a relationship link [TPS#10224] -JO
Fixed session tracking adding sessions from localhost (when scripts are ran on the CCM) [TPS#10380] -JO

5.3.3 - November 21, 2016

Updated

Updated Japanese translations (thanks Sasaki) -JO

Fixed

Fixed logarithmic perfdata graphs when having negative values in Highcharts [TPS#9966] -LG
Fixed postgres re-sequencing script in tools directory using the correct import_xiconfig script -JO
Fixed Bulk Modifications tool “find relationships” button JS errors -JO
Fixed legend in graphs not displaying properly when gray theme is used [TPS#10008] -BH
Fixed import not creating duplicate services when multiple hostgroups defined [TPS#9708] -BH
Fixed calendar not displaying properly occasionally in graph explorer [TPS#10098] -BH
Fixed issue where DB connection fails while waiting for MySQL to actually start and shows repair DB messages -JO
Fixed encoding issue on My Tools page [TPS#10161] -JO
Fixed encoding issues for French language on a couple pages -JO

Core Config Manager (CCM) 2.6.2

Fixed issue with service escalations page showing two * in selection box after saving the service escalation [TPS#10045] -JO
Fixed missing * option in host escalation hosts and host group options that are in service escalation [TPS#10046] -JO
Fixed not being able to delete objects from the XI GUI (Reconfigure Tab) [TPS#10078] -BH

5.3.2 - November 1, 2016

Security

Fixed various XSS vulnerabilities -JO
Fixed jQuery migrate XSS vulnerabilities (updated to 1.4.1) -JO

Fixed

Fixed bug in usermacro component where screen size would position the clear filter button in the wrong place [TPS#9842] -LG
Fixed translation issues on the mass acknowledgement “Check All Items” button after clicking [TPS#9838] -JO
Fixed modal sizing issues in bulk modifications tool [TPS#9870] -JO
Fixed translations in settings popout on the new status map [TPS#9847] -JO
Fixed automatically setting secure cookie value with SSL enabled -JO
Fixed clean install adding the postgresql backup script even though postgres isn’t installed [TPS#9878] -JO
Fixed add to my reports functionality when reports are added from other sections in XI [TPS#9849] -JO
Fixed login redirect url to validate redirection better -JO
Fixed permalink to use a relative location instead of a full URL for xiwindow variable -JO
Fixed nagiosql database name being set in sql schema for those who have a different db name [TPS#9910] -JO
Fixed event_meta base64 encoding when storing event_meta in the database -JO, BH
Fixed upgrade increase_open_file_limits.sh check on certain systems and stopped the script from exiting install -JO, BH
Fixed mrtg lock directory used in cron job to take volatile tmpfs directories into consideration -BH, JO

Core Config Manager (CCM) 2.6.1

Fixed issue with host/service escalations now showing set escalation options in the GUI [TPS#9873] -JO
Fixed CCM showing login screen when not logged into XI (must be logged into XI session to view CCM) (Thanks CK) -JO
Fixed swapped UP/UNREACHABLE on host escalations and OK/DOWN on service escalations pages [TPS#9916] -JO
Fixed issue with contact relationships popup not displaying the dependant icon for some objects -JO

5.3.1 - October 19, 2016

Security

Fixed issue where upgrade would stop if the open limits file (/etc/security/limits.conf) was not writeable -JO

Fixed

Fixed issue on clean XI install (or on upgrades if you upgrade component to 1.0.1) custom-includes component folder permissions [TPS#9705] -JO
Fixed issue on scheduled downtime page in older browsers and IE [TPS#9748] -JO
Fixed issue on scheduled downtime page that would allow user to submit endtime before starttime and auto update datetimepicker fields [TPS#9711] -LG
Fixed issue causing session timeouts on CentOS/RHEL 5.x systems [TPS#9727] -JO
Fixed issue with new status map requiring Nagios Core login information to view the page -JO
Fixed issue on scheduled downtime page where selecting via checkbox would not add the ID of the downtime to selected list -JO
Fixed PHP notices from SSL version constants that do not exist in PHP < 5.5 -JO
Fixed backup and restore scripts not keeping apache cron jobs (scheduled reporting / scheduled downtimes) [TPS#9774] -JO
Fixed scheduled downtime page to correctly put scheduled and removed downtime in audit log [TPS#9779] -JO
Fixed dashlet pin/unpin functionality on dashboards [TPS#9794] -JO
Fixed view rotation continuing while on manage views page by pausing view rotation when clicking link to page [TPS#9757] -JO
Fixed issue where title of perfdata graphs was showing up URL encoded -JO
Fixed issue in graph explorer on timeline graphs in IE -JO
Fixed bug in usermacro component causing detection to break when no system macros were selected -LG
Fixed Japanese translation issues in certain sections -JO

5.3.0 - October 3, 2016

Security

Added advanced setting for Availability report labeled “Do not show service data” that will force it to only show host data [TPS#8382] -JO
Added more user meta information for better security and auditing [TPS#9269] -JO
Added improved clickjacking security -JO
Fixed various minor security vulnerabilities (thanks John Page aka HYP3RLINX) -JO

Updated

Updated cmdsubsys auditlog to show username in the log message -LG
Updated scheduled downtime page to allow searching, filtering, and pagination -JO
Updated adding multiple hosts/services through scheduled downtime pages -JO
Updated performance graphs page to follow modern report/page format -JO
Updated all Highcharts graphs with new styling -LG
Updated API help section to explain how to filter object API calls -JO
Updated perfdata page with report-style layout -JO
Updated performance graphs popup layout on host/service status pages -JO
Updated Global Event Handlers to use considerably less memory -BH
Updated ADODB database library to version 5.19 -JO
Updated Japanese translations (thanks Sasaki) -JO
Fixed inability to delete deployed [screen] dashboards, and stopped them from being deployable [TPS#8862] -BH

Added

Added timepicker to some datepicker fields -JO
Added use of currently selected time format in datetimepickers in Reports and other areas -JO
Added export functionality to perfdata/timeline/stack graphs [TPS#2601] -BH
Added objects/rrdexport to API [TPS#2601] -BH
Added objects/cpexport to API (capacity planning data export) [TPS#8441] -JO
Added API Key regeneration function to user pages [TPS#7200..7203|7135] -BH
Added system/applyconfig to POST for API [TPS#7198] -BH
Added Highcharts default display type [TPS#7617] -BH
Added Callbacks for User Creation/Password Change/Deletion [TPS#7155] -BH
Added callback help section documentaiton -BH
Added names to list of system status icons in system status dropdown menu -JO
Added option in config.inc.php to allow php to connect with persistent or normal connections -JO
Added custom-includes component to include custom css, js, and images that won’t get overwritten on upgrade -JO
Added meaningful API messages -BH
Added logging to the auditlog when submitting a core command through the coreuiproxy using constants-nagioscore.inc.php [TPS#8147] -LG
Added the rest of the NSCA encryption methods to inbound/outbound transfer admin pages [TPS#8406] -JO
Added ability to download Capacity Planning graphs as CSV file with timestamp,value fields [TPS#8441] -JO
Added ability to disable/enable user accounts [TPS#6771] -BH
Added navbar search to default to the appropriate page depending on which category you click on in suggest box [TPS#8332] -BH
Added service search to navbar search box [TPS#8331] -BH
Added some basic default MySQL tuning options on fullinstall and an additional script for performing basic tune manually [TPS#8586] -BH
Added get_xml_backend cache to Performance Settings [TPS#8584] -BH
Added automatic increase of global and root user open file limits -BH
Added ability to add free variables via API [TPS#8675] -SS,BH
Added required current password field for non-admins to change passwords [TPS#8731] -BH
Added output to repair database scripts to inform user if they succeeded or failed [TPS#8701] -TL,JO
Added query documentation into API [TPS#8835] -JO
Added capacity planning data to be exported via the API [TPS#8441] -JO
Added ability to select multiple hosts/services to schedule downtime for on scheduled downtime page -JO
Added ability to put all services for a host into schedule downtime at once -JO
Added a new Core Component Usermacros for managing user and system macros in Nagios XI [TPS#9008] -LG
Added translation of USER macros to all eligible wizard input fields [TPS#6739] -LG
Added custom API endpoint functionality [TPS#8979] -BH
Added ability to save tabs selected on scheduling page report [TPS#9050] -BH
Added tab to system settings in admin section for password complexity, lockout, and max trials [TPS#8729..8730] -BH
Added more verbose logging for PHPmailer which shows action, method and referer and will include successfully sent messages [TPS#9136] -LG
Added snmptt restart to nagios init script [TPS#9234] -BH
Added improved warning/critical lines in Highcharts graphs which can be toggled on and off -LG
Added rel=”noreferrer” to target=”_blank” hrefs -BH
Added core detection for speeding up compilation during fullinstall/upgrade -BH
Added default cURL SSL connection type to TLSv1.2 and added editing setting in System Settings page [TPS#9483] -JO
Added clipboard.js and removed the old zclip jquery plugin which relied on ZeroClipboard -JO
Added options in global settings to customize Highcharts Avg/Max/Last values (or disable them) [TPS#9611] -JO
Added option in global settings to tell Highcharts graphs to ignore null values when calculating ‘Avg’ [TPS#9611] -JO
Added event_handler cron job to process events from DB queue -BH

Fixed

Fixed non-admin users who had large quantity of services recieving SQL error [TPS#7820] -BH
Fixed load_url function to send error messages to apache error_log instead of never giving an error message -JO
Fixed recurring downtime to not accept invalid days of month [TPS#8487] -BH
Fixed view start/stop reverting to English when different language is selected [TPS#7107] -BH
Fixed reports not respecting show host/service alias options [TPS#6518] -BH
Fixed buttons to show config changes and errors on Apply Configuration page merging together [TPS#6902] -JO
Fixed check_mssql to use PDO opposed to deprecated MSSQL_* functions [TPS#8633] -BH
Fixed nagiosxi DB engine type on newer versions of MySQL/MariaDB -BH
Fixed admin user not being added to CGI config if configuration cannot be applied [TPS#8819] -BH
Fixed searching for host in host status reverting to status detail [TPS#8867] -BH
Fixed xiprepimport tool saving comments in filename [TPS#8865] -BH
Fixed re-configure object (host/service) not respecting removing hostgroups/parent hosts/servicegroups [TPS#8931] -BH
Fixed slow Host/Service Status Details page load for non-admin users [TPS#9024] -SS,BH
Fixed newly scheduled pages sending corrupt .pdf files [TPS#8874] -JO
Fixed API help section that showed the improper usage of deleting a user [TPS#8634] -LG
Fixed SANS Internet Storm Center Top 10 Rising Ports dashlet to use new SANS backend [TSP#9044] -BH
Fixed Multistacked Graph Numbers displaying more than 3 decimal points on hover [TPS#9169] -BH
Fixed javascript searchable dropdown boxes to be easier to use and have proper styling -JO
Fixed unconfigure objects remaining in list even after pressing delete [TPS#9215] -BH
Fixed snmptt daemon restart on MIB upload on el7 systems [TPS#9237] -SS,JO
Fixed scheduled downtime showing a maximum duration of 9hrs (only a display issue) -JO
Fixed LDAP/AD component LDAP is_user to accept organizationalPerson and person [TPS#9272] -JO
Fixed LDAP/AD component issue with popup not centering [TPS#9272] -JO
Fixed invalid service configuration when using bulk host import to import a service with multiple hosts defined [TPS#9369] -BH
Fixed ‘this week’ time period in reports showing the last 8 days if a report is ran on sunday [TPS#9357] -JO
Fixed issue with the + symbol in hostnames not creating a proper URL to service details pages for services on that host [TPS#9443] -JO
Fixed process_perfdata.pl setting counters for output with ‘c’ values making graphs show up as 0 [TPS#9479] -JO
Fixed persistent comment/acknowledge checkbox on host/service details page [TPS#9488] -JO
Fixed issue where LDAP would not close if start TLS failed [TPS#9498] -JO
Fixed issue with perfdata that has a space in the value [TPS#9523] -SS,JO
Fixed scheduled backups local backups page to be sorted by timestamp -JO
Fixed event_handler scripts to push to DB queue for event_handler cron -BH

Core Config Manager (CCM) 2.6.0

Added ability to set host/hostgroups as “exclude” for services, service templates, host groups, service escalations, and host escalations [TPS#3966] -JO
Added icons for tools, configuration, and other nav links -JO
Added escape key binding to close overlays [TPS#8911] -BH
Updated theme to match the rest of Nagios XI (Modern) -JO
Updated splash page to have more information about current configuration -JO
Updated ‘Run Check Command’ to evaluate user macros [TPS#8264] -BH
Updated ‘Run Check Command’ to use cmdsubsys and execute as nagios user [TPS#6578] -BH
Updated ‘Run Check Command’ User Interface to be more intuitive and friendly and use NSP [TPS#9185] -BH
Fixed de-activating a contact from the edit page not respecting dependency check [TPS#8777] -BH
Fixed services table loading nothing if you delete all of a configs service definitions when selecting a config name from dropdown -JO
Fixed CCM not respecting etc/nagios.cfg illegal_object_name_chars [TPS#8864] -BH
Fixed various minor security vulnerabilities (thanks John Page aka HYP3RLINX) -JO

5.2.9 - June 14, 2016

Security

Fixed multiple security vulnerabilities -JO

Updated

Updated scheduled downtime to use XML backend as opposed to coreuiproxy for better speed on larger systems [TPS#8591] -BH

Fixed

Fixed issue in config/service API section not using the check_command argument [TPS#8629] -JO
Fixed notification preferences priority email checkbox to automatically set the email checkbox [TPS#8621] -JO
Fixed AD/LDAP component looking for proper structure names – now lowercase versions will show up [TPS#8563] -JO
Fixed AD/LDAP component root directory not showing user objects [TPS#8563] -JO
Fixed some instances of MRTG not using correct version [TPS#8635] -BH
Fixed windowssnmp plugins reverting on upgrade [TPS#8647] -BH
Fixed issue in CCM config writing where # did not actually need to be converted since it isn’t an in-line comment like ; -JO
Fixed bug in recurringdowntime.pl regarding days of week [TPS#8773] -BH

5.2.8 - May 24, 2016

Security

Fixed multiple security vulnerabilities [TPS#8372] -BH

Fixed

Fixed RHEL install issues [TPS#8215 && TPS#8214] -BH
Fixed config/service API section from requiring check_command (can be inherited) [TPS#8222] -JO
Fixed tools fullscreen button not working properly on iframes with domains that are not the same as the XI system -JO
Fixed Components “Install Updates” button returning improper code [TPS#8271] -BH
Fixed using ; and # in $ARGx$ values in the CCM [TPS#8292] -JO
Fixed certain pages not redirecting to login is session was timed out -SW
Fixed issue where non-admin users could not see all time periods for advanced settings in reports (but could in Core) [TPS#7974] -JO
Fixed no SNMPv3 being used in Switch Wizard since v2.3.0 [TPS#8325] -BH
Fixed usernames with spaces being unable to schedule downtime [TPS#8338] -SS,BH
Fixed some perl plugins being affected by a version compare [TPS#8365] -BH
Fixed dbmaint cron script not properly removing old events -BH
Fixed apache mod_rewrite section breaking ssl.conf when not standard base apache default with no VirtualHost defined [TPS#8457] -BH,JO
Fixed API not deleting some hosts correctly [TPS#8500] -BH
Fixed password reset token to have sane timeout properties -BH

5.2.7 - April 6, 2016

Fixed

Fixed performance graph issues -BH
Fixed bug causing “change username” confirmation to display when adding a user -BH

5.2.6 - April 1, 2016

Security

Fixed multiple security vulnerabilities -BH

Fixed

Fixed renewal reminder for greater than 3 year subscriptions -JO
Fixed bug in Availability report when exporting that did not follow downtime advanced options [TPS#7811] -LG
Fixed availability report showing wrong data when using different advanced options and exporting as a CSV [TPS#7894] -LG
Fixed scheduled downtime not submitting for all services on Hostgroup Summary/Overview > Hostgroup commands page -JO
Fixed blank error message in user edit page when trying to demote a user that can’t be demoted [TPS#7840] -JO
Fixed monitoring wizard bug when hiding notification delay, but not notification options [TPS#7825] -BH
Fixed histogram report not aligning proper dates/days of week/days of month with data [TPS#7864] -BH
Fixed multi-tenancy issue in Scheduled Downtime [TPS#7876] -BH
Fixed Metrics components not accounting for specific metric types for Linux SNMP [TPS#7883] -BH
Fixed fullscreen button causing weird display issues on host/service status pages [TPS#7947] -JO
Fixed scheduled downtime incorrectly scheduling downtime if core date_format was changed from default [TPS#7977] -BH
Fixed recurring downtime not properly adhering to days_of_week specified [TPS#7971] -BH
Fixed incorrect permissions on CCM settings.php [TPS#7992] -BH
Fixed internal server error in graphexplorer/ajax/datatypes -BH
Fixed cancel button updating user preferences [TPS#8015] -BH
Fixed host alias not showing up properly in Service Status page [TPS#8030] -BH
Fixed renaming a user that is defined as a contact casues snapshot to revert [TPS#8034] -BH

Added

Added CONFIGWIZARD_SKIP_OBJECTS_RECONFIGURE flag to allow configwizards ability to skip adding notification options, etc. [TPS#8026] -BH
Added current and max check attempt into utils-xmlstatus.php to verify soft/hard states from anywhere -LG

5.2.5 - February 19, 2016

Fixed

Fixed scheduled downtime solution only working on PHP versions 5.3.x -JO

5.2.4 - February 18, 2016

Security

Fixed security bug that would allow read access to system files -SW
Fixed potential SQL injection in notification search -SW
Fixed possible XSS in startdate and enddate fields in reports -SW
Fixed XSS injection possibility in menu system -SW
Fixed XSS injection possibility in my reports -SW

Fixed

Fixed system API endpoint to allow POST requests for applyconfig and importconfig -JO
Fixed restore_xi.sh script to use manage_services.sh instead of service -JO
Fixed two+ line title dashlet buttons not being clickable [TPS#7247] -JO
Fixed bug causing gethistoricalservicestatus backend cmd to not have a valid time -SW
Fixed GUI based upgrade to use proxy configuration -SW
Fixed SLA report PDF from duplicating table headers across multiple pages, overlaying other table items [TPS#7297] -SW
Fixed issue in BPI component where ; was being used instead of :: for services [TPS#7367] -SS
Fixed current outdated retention.dat not being added to backups causing program state to not be retained correctly [TPS#7416] -SW
Fixed admin users able to have “Read-only user” permission -JO
Fixed searching for hosts and services where object name contained : [TPS#7463] -SW
Fixed restore_xi.sh to work for restoring oldersystem which use postgresql [TPS#7467] -SW
Fixed bug where searching in manage users to sometimes reverted to edit page of previous user [TPS#7471] -SW
Fixed install on CentOS 7.2+ systems that do not come with firewalld pre-installed -JO
Fixed Host Status Summary links not displaying correctly in dashlets [TPS#7616] -BH
Fixed FreeIPA LDAP server working with user importing [TPS#7552] -SS
Fixed Capacity Planning PDF report hanging system [TPS#7149] -BH
Fixed Custom URL Dashlet ignoring width/height [TPS#7448] -BH
Fixed Scheduled Downtime incorrectly picking some dates [TPS#7476] -BH
Fixed Warning/Critical Display setting not working in Capacity Planning report [TPS#7514] -BH
Fixed LDAP Import of UPPERCASE username causing report functionality to break [TPS#7555] -BH
Fixed non-highcharts perfgraph dashlet links [TPS#7633] -BH
Fixed scheduled report menu-item addition/removal [TPS#7679] -BH
Fixed SLA report ignoring advanced options [TPS#7685] -BH
Fixed bug in Availability report utilizing incorrect assumed service states for warning and unknown [TPS#7690] -LG
Fixed bug in Scheduled Downtime where the chosen date format was not being respected [TPS#7692] -LG
Fixed repair_databases.sh not checking for MySQL DB nagiosxi [TPS#7730] -BH
Fixed Hard coded base_url’s in scheduled reports allowing for different base_url’s -SW
Fixed Graph Explorer component’s multistacked graph from sometimes overwriting a selected item when adding items to graph -SS

Core Config Manager (CCM) 2.5.3

Fixed bug allowing filtering when adding host/service to contact notification commands [TPS#7207] -LG
Fixed bug where removing CCM users was not working properly [TPS#7540] -BH
Fixed import to properly check for duplicates [TPS#7551] -BH
Fixed Hard coded base_url -SW

5.2.3 - December 7, 2015

Security

Fixed possible XSS on login page -SW
Fixed user edit when selecting preferences would remove all checked security setting boxes [TPS#7113] -JO

Fixed

Fixed error being displayed when upgrading components/wizards from the UI when they were actually installed correctly -SW
Fixed Perfdata not maintaining time period selection when filtering hosts [TPS#6970][OTRS#11217] -SW
Fixed translation errors on a few pages (recurring downtime, recent alerts, metrics) [TPS#6991] -JO
Fixed missing icons on recurring downtime page [TPS#6992] -JO
Fixed showing scheduled downtime buttons on scheduled downtime page to read-only users [TPS#6974] -JO
Fixed scheduled downtime not adding trigger id when set [TPS#6977] -JO
Fixed scheduled downtime not adding flexible when selected [TPS#6972] -JO
Fixed send_nrdp.sh handling of XML special chars. [TPS#6846] -SW
Fixed bulk modifications when changing templates on hosts/services with no templates [TPS#7016] -JO
Fixed minemap dashlet not keeping size on home dashboard [TPS#7024] -JO
Fixed permissions on autodiscovery jobs directory to run on new installs [TPS#7038] -JO
Fixed reset password to give an error if trying to set an AD/LDAP user password unless they have ‘allow local auth’ checked [TPS#7022] -JO
Fixed issue where API would say it removed a host or service with dependencies when it really couldn’t and would leave the host/service in the CCM -JO
Fixed possible clickjacking by forcing login page to be the top frame element -SW
Fixed scheduled downtime problems with certain types of date format selected -JO
Fixed garbled Japanese characters in home page title [TPS#7100] -JO
Fixed box sizing cutting off some text in manage dashlets pages [TPS#7071] -JO
Fixed capacity planning when disabled auto-running reports select boxes for time periods and extrapolation methods [TPS#7076] -JO
Fixed capacity planning when disabled auto-running reports is from blanking out during page changes -JO
Fixed autodiscovery wizard, rss dashlet, and escalation wizard from not being available on certain systems [TPS#7096] -JO
Fixed Event Log report not showing up in reports list for users with ‘can see/control monitoring engine’ [TPS#7110] -JO
Fixed issue with graph.php no allowing you to pass in view and start timestamps -SW
Fixed BPI hostgroup/servicegroup names not showing proper Japanese characters [TPS#7116][M#11] -SS

Core Config Manager (CCM) 2.5.2

Fixed return URL (cancel button) links for host/services edited from clicking through the splash page [TPS#7095] -JO

5.2.2 - November 12, 2015

Fixed

Fixed xi-sys.cfg using old config.inc.php values if the config.inc.php has changed since an upgrade/install -JO
Fixed state colors for non-english versions of BPI -SW
Fixed issue where upgrade of components/wizards through UI was not using proxy settings -SW
Fixed creating multiple objects rapidly in API to now not write out files and instead import more directly -JO
Fixed upgrade script to install all dependencies before performing upgraded of other components -SW
Fixed garbled UTF chars in BBMap Tooltip -SW
Fixed requirement of both start and end date when specifying custom dates for Performance Graphs -SW
Fixed fresh installs stating that additional steps are required to run auto-discovery to run -SW

5.2.1 - November 10, 2015

Security

Updated sourceguardian loaders supporting up to php 5.6 -SW
Fixed bug causing htpasswd.users to not be updated immediately when user is forced to change password -SW
Fixed users who were set to local who were originally AD/LDAP users still being forced to skip local auth -SS

Updated

Updated Highcharts to 4.1.9 -JO
Updated htpasswd to use stronger SHA encryption -JO

Fixed

Fixed issue where update available still displays after upgrade by forcing check for updates to run after upgrade -JO
Fixed autoupgrade_backup.x.tar.gz filename when running upgrade from web UI -JO
Fixed numerous php notice/warnings -JO
Fixed issue where Nagios::Monitoring::Plugin is now required by several default plugins -SW
Fixed custom logo display issue in classic and 2014 themes -JO
Fixed issue in AD/LDAP component with import not working correctly with parenthesis -JO
Fixed issue where creating a new user would not update the htpasswd users file -JO
Fixed ndo2db init script to remove “cannot open file errors” on restart -SW
Fixed some unreadable service names in BBMap component -SW
Fixed bug where object wouldn’t acknowledge properly if no comment was entered through Rapid Response URL -SW
Fixed auto-discovery exclude IP’s to only have one -exclude statement in nmap scan -SW
Fixed bug where commands through UI (ack/comments/etc.) would not submit properly if host or service_description had unicode chars -SW
Fixed CCM Relationship button on commands page to show dependent relationships for hosts, services, hosttemplates, servicetemplates -SW
Fixed searching for hosts in alert stream (with auto-complete) -JO
Fixed error message returning on submit for Inbound NSCA settings -JO
Fixed adding contacts/contact_groups to hosts/services created in the new API -JO
Fixed creating host/service templates in API -JO
Fixed scheduled backup limit being set to 0 resetting to 7 -JO
Fixed old (upgraded intalls of XI < 5) nagiosadmins possibly not being able to log in locally if set to AD/LDAP -JO
Fixed issue with AD/LDAP component not working with commas -JO
Fixed various spelling errors -JO
Fixed user management page select all functionality -JO
Fixed invalid XML when using outbound transfers and check output had XML special chars -SW, SS
Fixed webinject install to make sure we have proper permissions -SW
Fixed bug where self signed SSL certificate sites could not schedule downtime -SW, SS
Fixed my tools and common tools to be sorted alphabetically -JO
Fixed bulk modifications tool to re-write host config on service config_name changes -JO
Fixed permissions for nagios libexec directory -JO
Fixed API creating only the last service sent when sending multiple service creations quickly -JO
Fixed bulk modifications tool when setting contacts/contact groups via host/service groups -JO
Fixed blank Alert Timeline when using a UTC offset -SW
Fixed sizing of Alert Timeline to show more alerts -JO
Fixed Top Alert Producers report column showing wrong date in Latest Alert column -SW
Fixed Top Alert Producers CSV export column showing wrong date and label -SW
Fixed BPI component check_bpi high CPU usage with lots of BPI checks -JO
Fixed gauge dashlet creation popup loading slow on large installs -JO
Fixed AD/LDAP import bug where users who already existed were trying to be imported instead of erroring -JO

Core Config Manager (CCM) 2.5.1

Added ability for import issue to update host/service escalations/dependencies by adding in # config_name to written config output -JO
Added ability for import issue to add host/service escalations/dependencies with specific config_name using # config_name in config to import -JO
Updated some styles for easier readability -JO
Fixed import issue where items that needed config_name would use the host_name as the config_name causing only one item to be imported -JO
Fixed imported service escalation/dependency services not always showing up in services selection list -JO
Fixed php errors being thrown -JO
Fixed bug in CCM splash page where the number of dependecies were incorrect and updated to use a database query which will speed up the page for large systems -LG

5.2.0 - October 8, 2015

Security

Added &force=1 to config API endpoints to force configuration without doing a check for all parameters -JO

Added

Added checkbox to admin section user creation/edit pages to enable/disable notifications -JO
Added phone numbers next to emails for users to user management table -JO
Added table name to oracle tablespace wizard services -JO
Added dashlet hover option to show/hide dashlet title -JO
Added additional documentation for user creation via API -JO
Added additional popup documentation for user permissions in user creation/editing -JO

Fixed

Fixed LDAP/AD integration settings saving in user edit/creation pages -JO
Fixed LDAP/AD integration ‘allow local login’ when checked -JO
Fixed issue in BPI component that wouldn’t use :: properly -JO
Fixed issue where user opened/closed menu sections weren’t properly applying -JO
Fixed installing config wizards with configwizard- in zip file name -JO
Fixed PHPMailer using non RFC compliant charset content type setting -JO
Fixed dashboard font sizes -JO
Fixed dashlets showing ‘Pin’ instead of ‘Unpin’ popup text when loading page -JO
Fixed dashlet sizes and title spacing -JO
Fixed opscreen showing all hosts as down when unhandled showing -JO
Fixed issue with defining check_commands via host/service config api calls -JO
Fixed schedule downtime predefined timestamp to show accurate time -JO
Fixed regular users with specific settings able to acknowledge problems via new popup command -JO
Fixed user creation section of API -JO
Fixed NDO upgrade script for offloaded tables with different name -JO
Fixed upgrade web UI sometimes showing red upgrade failed status bar even though upgrade was successful -JO
Fixed BPI syncing from replacing and instead updates -JO,SS
Fixed the old backend api output in json to no longer cause issues in PHP 5.1.x -JO

Core Config Manager (CCM) 2.5.0

Added double click functionality in selection popups -JO
Fixed tooltips showing up in the wrong spots -JO

5R1.0 - September 28, 2015

Security

Added “Schedule a forced check for host and all services” to host detail advanced tab -SW
Added features to the Audit Log report including scheduled report, pdf version, and filters by log type and source -JO
Added log type and log source filter dropdowns to auditlog -JO
Fixed XSS vulnerability in nagiosbpi component -SW
Fixed bug in Switch wizard where the Warning/Critical percentages were not calculating using decimal places -LG

Updated

Upgraded Bulk Modifications component to 2.0.0 which includes numerous new modifications to be performed (see below) -JO
Upgraded Alert Stream to 2.0.0 which removes all Java apps from XI and instead uses D3.js -JO
Upgraded LDAP and AD components with a single component which allows importing LDAP/AD users and easier LDAP/AD user management in users section -JO
Upgraded to latest version of nmap in Auto-Discovery component -JO
Upgraded check_wmi_plus plugin to 1.60, more functionality -LG,SW
Updated Host/Service Detail pages to just show icon for tabs that have them specified to provide more real estate -SW
Updated detail page so most tab content on detail pages doesn’t load until selected improving performance -SW
Updated perfdataproc.php cron job to utilize a better mechanism to move large amounts of files avoiding “Argument list too long” errors -SW
Updated search functionality on users list in admin section to do mid-text searching on email, username, and full name -JO
Updated deploy notification component to be more user-friendly -JO
Updated the Metrics Component to display a wider range of agent data, optionally utilize the highcharts graphs, allow graph timeperiods to be selected, added advanced options and increased tab and display performance -LG
Updated Bandwidth report to optionally use highcharts graphs -LG
Updated the Windows WMI, Windows SNMP and Linux SNMP wizards to run a smart scan and prepopulate disks, processes and services -LG
Updated all reports to now use asynchronous loading of report information -JO
Updated all reports to have a new layout -JO
Updated loading icons throughout XI -JO
Updated configuration main page and configuration wizards page layout -JO
Updated available dashlets page layout -JO
Updated notification management section to be more intuitive when saving/applying templates to users -JO
Updated full search box in XI 5 to a search icon in the main header nav bar -JO
Updated host/service detail actions/advanced actions to use popups instead of old command pages -JO
Updated homepage splash screen -JO
Updated graph explorer multistacked graphs to actually ‘stack’ instead of overlay -JO
Remove displaying of service detail links for hosts without services -SW
Remove nmap from being fully wildcard sudo’d, preventing hijacking from other system users -SW

Added

Added manage dashboards page -JO
Added manage views page -JO
Added permissions to the actions component for individual actions -JO
Added button ‘Install Updates’ to auto-upgrade components either per component or for all components with updates -JO
Added button ‘Install Updates’ to auto-upgrade config wizards either per config wizard or for all config wizards with updates -JO
Added a new scheduled downtime page with ajax popups for scheduling downtime -JO
Added configuration wizard ‘advanced settings’ (step 3-5) templates (global/user) and a template manager -JO
Added default template for configuration wizards which will set config wizard step3-5 fields with the proper variables -JO
Added “API Key” to users section (instead of using username+ticket for API calls – backwards compatible though) -JO
Added a fusion API Key for later fusion integration -JO
Added integrated Help section for API Documentation -JO
Added new API with objects, config, and system sections which allows adding host/services -JO
Added a new theme for XI 5 release (Modern) -JO
Added tabs to global configuration settings in admin area -JO
Added numbers of saved reports and scheduled reports to left hand menu section -JO
Added icons to a number of commonly used links -JO
Added ability to filter config wizards on main config wizard page -JO
Added ability to import users from AD/LDAP locations -JO
Added ability to manage server certificates for AD/LDAP connections -JO
Added links to deadpool from admin section -JO
Added ability to customize email notification priority of notification per-user and per notification type, editable in Notification Preferences -SW
Added ability to use custom host/service variables in actions component -SW
Added ability to bulk rename config files for services in bulk rename component -SW
Added ability for users to enable/disable Host and Service Acknowledgments in Notification Preferences -SW
Added ability to toggle displaying of aliases in host/service detail pages. This is adjustable per user under Account Information -SW
Added NavBar Search to search for host, hostgroup, and servicegroup and take user directly to results page -SW
Added pagination additionally to top of host/service status tables -SW
Added ability for users with “Can (re)configure hosts and services” perms to add/remove contactgroups they are members of when running wizards and reconfiguring objects -SW
Added ability for users to just save config to database without Applying Configuration when running wizards -SW
Added Auto-discovery option to use system DNS -SW
Added ability to use logarithmic scaling with highchart perfdata charts -SW
Added embeddable highcharts performance graphs that can be placed in an iframe passing host/service/width/height/username/token -SW
Added Auto-discovery option to specify scan delay to throttle activity -SW
Added %hostgroupnames% and %servicegroupnames% macros to actions component -SW
Added ability to filter Capacity Planning report by Host/Hostgroup/Servicegroup with additional search -SW
Added numerous performance enhancements to Auto-discovery to improve scan performance -SW
Added URL target specification to actions component -SW
Added searching capabilities to Acknowledgments page -SW
Added ability to filter WARNING/UNKNOWN/UNREACHABLE states in Availability and SLA reports -SW
Added auto updating of Tools on tool creation -JO
Added auto updating of My Scheduled Reports when adding new scheduled report -JO
Added number of reports to My Reports and My Scheduled Reports menu headers -JO
Added auto updating of My Reports when saving new Report -SW
Added dashlet functionality to SLA and Availability Report -LG
Added language support for CCM help popups -SW
Added JPG export option to all reports -SW
Added option in State History Report to show only hosts or only services -SW
Added in ability to filter by Host, Hostgroup, Servicegroup in Notification Report -SW
Added sorting of Contacts and Contact groups in Wizard and object configuration pages -SW
Added ability to toggle Handled Problems in Birdseye Component -SW
Added a user specified refresh rate to the configuration options in Custom URL Dashlet -SW
Added hostgroups and service groups to host/service detail pages -SW
Added advanced option to Executive Summary Report giving ability to hide scheduled downtime, etc. -SW
Added ability to specify months in recurring downtime. -SW
Added additional details column to auditlog -SW
Added additional services to nagios config for localhost on a new install, checking crond, httpd, mysqld, ndo2db, npcd, ntpd -SW
Added ability to filter Operations Center by host/hostgroup/servicegroup -SW
Added to all reports a service drop down list that will display/update based on host selection -LG
Added ability to filter Operations Center by service state -SW
Added option to nagiosmobile to have page auto-refresh -SW
Added sortable and searchable dropdown filtering by Host/Service/Hostgroup/Servicegroup to latest alerts component -SW
Added remembering sort order (per-user) of items in CCM when returning to table of objects -SW
Added showing the most recent comment in the status list comment tooltips -SW
Added per-user theme settings -JO
Added setting to global config to uncheck Sticky Acknowledgement box by default -SW
Added login failures to Audit Log -SW
Added cfg variable error_level and removed php notice errors from the error_log in production -JO
Added the Warning/Critical lines to all XI graphs (toggle default active/inactive) -LG
Added backing up of Nagvis to XI backup/restore scripts -JO
Added config information to the downloadable system profile -JO
Added the ability in Admin > System Settings > General to write Nagios XI auditlog to a file -LG
Added new wizards: Folder Watch, Mountpoint, SLA -LG

Fixed

Fixed hypermap to be full size of page -JO
Fixed deletion of local backup files in scheduled backup component. -SW
Fixed bug causing nrdp.conf apache config to not work on CentOS/RHEL 7 -SW
Fixed Common Tools from improperly encoding URL’s -SW
Fixed bug in CCM causing Execution failure criteria to not populate correctly for ‘d’ -SW
Fixed bug causing NRDS Windows clients to not have correct permissions to build executable -SW
Fixed bug where clicking on icons in sort columns on host/service status tables would not sort -SW
Fixed bug in Event Log Report to allow searching for ; and : chars -SW
Fixed bug causing Unified Hostgroup views to not refresh -SW
Fixed bug causing search buttons on CCM import page to import files -SW
Fixed URL redirection when following permalink and user isn’t logged-in -SW
Fixed bug in the Scheduled Backups using FTP to use the indicated port (Previously default port 21) -LG
Fixed check_rrdtraf from mislabeling UOM if Bytes was selected -SW
Fixed many generic bugs with the deploy notification component and saving templates -JO
Fixed bug causing + symbol in host, service, hostgroup and servicegroups making links in UI not work correctly -SW
Fixed restore_xi.sh script to account for differences when moving from OS 6 to OS 7 -SW
Fixed bug causing CCM to not work properly if specifying non-default MySQL port -SW
Fixed bug where the Alias was not displaying for the Availability Report -LG
Fixed bug causing passwords with special chars such as $ or & to not write .htpasswd file correctly -SW
Fixed bug in Hostgroup Overview to display the correct service list when selecting a service instead of all hosts in the group -LG
Fixed bug where setting new UI theme would not actually change theme until next page load -JO
Fixed bug in ndoutils which could cause message queue to not empty -SW
Fixed bug where deleting backup would not remove the local backup -JO
Fixed bug in Hostgoup Overview to display the correct service list when selecting a service instead of all hosts in the group -LG

Core Config Manager (CCM) 2.4.0

Added Core Config Manager landing page -LG
Added throbber to all loading pages for ccm actions -LG
Fixed ‘Manage Parents’ to now show child relationships, making them non selectable -JO
Fixed bug where changing a parent host’s host name would cause config not to apply until doing a full delete/rewrite of configs -JO
Changed bulk mod procedure to be a step by step process -JO
Added ability to change ARG variables on hosts/services -JO
Added ability to add/remove multiple contacts/contact groups from hosts/services and host groups/service groups -JO
Added ability to select multiple host groups to add -JO
Added ability to remove host groups, services, and parents (hosts and services) -JO
Added ability to select hosts/services via selecting hostgroups or service groups -JO
Added ability to set templates (and template order) on hosts/services -JO
Added select boxes for config options that are selectable -JO
Added inheritance options for contacts/contact groups -JO
Added ability to update config name for services -JO
Updated change single config option to change more options -JO
Updated change single config option time period autocomplete functionality -JO

Nagios Core 4.1.1

ENHANCEMENTS
Promoted JSON CGIs to released status -ES
New graphical CGI displays: statusmap, trends, histogram -ES
Make sticky status for acks and comments configurable enhancement #20 -TM, SW
Add host_down_disable_service_checks directive to nagios.cfg #44 -TM, SW
httpd.conf doesn’t support Apache versions > 2.3 -DB, JF
FIXES
Fix for not all service dependencies created -JF
Fix SIGSEGV with empty custom variable -orbis, JF
Fix contact macros in environment variables -dvoryanchikov
Fixed host’s current attempt goes to 1 after going to hard state -JF
Fixed two bugs/problems: Replace use of %zd in base/utils.c & incorrect va_start() in cgi/jsonutils.c -PE
Fixed: Let remove_specialized actually remove all workers -PM
Fixed log file spam caused when using perfdata command directives in nagios.cfg -shashikanthbussa
Fixed off-by-one error in bounds check leads to segfault -PM
Added links for legacy graphical displays -ES
Update embedded URL’s to https versions of Nagios websites -SW
Fixed doxygen comments to work with latest doxygen 1.8.9.1 #30 -TM
Fixed makefile target “html” to PHONY to fix GitHub issue #28 -TM
Fixed typo as per GitHub issue #27 -TM
Fixed jsonquery.php 404 not found error, and disabled Send Query button until form populates #43 -SW
Fixed linking in Tactical Overview for several of the Host entries in Featured section #48 -SW
Fixed passing limit and sort options to pagination and sort links #42 -SW
Added form field for icon URL and clean-up when it changes in CGI Status Map. -ES
Added options to cgi.cfg to uncheck sticky and send when acknowledging a problem -TM
Low impact changes to automate the generation of RPMs from nagios.spec file. -TY
Update index.php -TM
Fixed escaping of corewindow parameter to account for possible XSS injection -SW
Typo correction -TY
Make getCoreStatus respect cgi_base_url -MS
Adjusted map layout to work within frames -ES
Fixed map displays are now the full size of browser window -ES
Fixed labels and icons on circular markup no longer scale on zoom -ES
Got all maps except circular markup working with icons -ES
Fixes to make legacy CGIs work again. -ES
Fixes to make all/html target tolerant of being run multiple times -ES
For user-supplied maps, converted node group to have transform -ES
Fixed issue transitioning from circular markup map to other maps -ES
Fix displayForm to trigger on the buttom press -SW
Fix fo getBBox crash on Firefox -ES
Fixed map now resets zoom when form apply()’d -ES
Fixed so close box on dialogs actually closes dialog -ES
Corrected directive in trends display -ES
Fixed minor issue with link in trends linkes -ES
Fixed issue with map displaying on Firefox -ES
Added exclusions for ctags generation -ES
Update map-popup.html -SW
Initial commit of new graphical CGIs -ES
Fixed Github bug #18 - archivejson.cgi returns wrong host for state change query -ES
Status JSON: Added next_check to service details -ES
Fixed escaping of keys for scalar values in JSON CGIs -ES
build: Include if it exists. -EM
lib-tests: test-io{cache|broker} need -lsocket to link. -EM
lib-tests: test-runcmd assumes GNU echo. -EM
lib-tests: Signal handlers don’t return int on most platforms, and using a cast was the wrong way to resolve this. -EM
Fix some type/format mismatch warnings for pid_t. -EM
Fix build on Solaris. -EM
runcmd: Fix build when we don’t HAVE_SETENV. -EM
Fixed checkresult output processing -EM
Corrected escaping of long output macros -EM
Fixed null pointer dereferences in archive JSON -ES
Fixed memory overwrite issue in JSON string escaping -ES
JSON CGI: Now escaping object and array keys -ES

2014R2.7 - April 23, 2015

Updated

Changed to not display language setting in Manage Config Access of CCM if using unified XI login -SW
Updated Japanese language file -JO
Updated nagios init script to not exit 0 if process isn’t running -SW

Fixed

Fixed bug that could be caused by /etc/sudoers.d/nagiosxi file left behind from 2011R2.0 -SW
Fixed CCM Bug preventing “Same Host Dependencies” from being able to save if a dependant host/hostgroup was not specified -SW
Fixed bug in Python 2.7 causing TypeError: XXXXXXXXXXX is not JSON serializable errors in Capacity Planning -JO, SW
Fixed popup overlay resizing issue in the CCM -JO
Fixed Contacts not correctly denoting object relationships to contactgroups in CCM -SW
Fixed bug where protected components were unable to be uploaded and installed via the Web UI -JO
Fixed bug where nrdp clients were not marked executable -SW
Fixed bug in CCM on CentOS 7 when editing a service the service would sometimes not apply yet apply config would say config applied -JO, SW

2014R2.6 - February 12, 2015

Updated

Updated collapsing menus to be changed by clicking title instead of just the chevron icon -SW
Update Search in State History and top Alert Producers report to target Host Name, Service Description and output -SW
Update Graph Explorer Time Period menus to more accurately describe what will be display, showing number of days vs.”last” X -SW

Removed

Removed hostname in CCM service dependencies overlay and made all services listed are unique -JO

Fixed

Fixed issue in CCM with filter text field forcing scrolling in overlay popups -JO
Fixed bug where Apply Configuration wasn’t working properly on CentOS/RHEL 7 -SW
Fixed bug where restarting services through the UI wasn’t working properly on CentOS/RHEL 7 -SW
Fixed bug where Top Alert Producers CSV export was blank if limiter was used -SW
Fixed bug where Alert Histogram was not reporting correct values if hostgroup limiter was used -SW
Fixed bug in scheduled backup where day was not populating correctly on page load for local backups -SW
Fixed Executive summary to properly encoding favorite links -SW
Fixed bug where Notifications CSV export always showed “Recovery” in reason column -SW
Fixed audit log being empty when exporting as CSV in language other than english -JO
Fixed old php notice errors on user account page -JO
Fixed PDF generation of alert heatmap to use the new PDF generation -JO
Fixed Capacity Planning PDF creation in scheduled reports -SW
Fixed alert heatmap report to show service alerts that are in hostgroups as well to match all other report behavior -JO
Fixed searching ability in alert heatmap -JO
Fixed the searchable dropdown boxes to show the selection of the proper item when hovering -JO
Fixed alert histogram report to show selected service box after selecting a specific service and running the report -JO

2014R2.5 - January 26, 2015

Updated

Updated styles of searchable select boxes throughout reports -JO

Added

Added ability for spooled outbound NRDP checks with offline XI servers -JO
Added ability to get reports based on spooled log entries of passive NRDP checks that come in from the past -JO
Added Priority header to messages sent with XI notification handlers where the message is for a non-OK state -SW

Fixed

Fixed missing pymssql package which was removed from EPEL Repo -SW
Fixed histogram to actually list all services right away when a host is selected -JO

2014R2.4 - January 21, 2015

Added

Added searchable filter host/service/hostgroup/servicegroup dropdowns to all reports -LG
Added searchable filter in all CCM popup overlays -LG
Fix issue causing commands to return “(No output on stdout) stderr:” if mare than 7 args were present -SW
Fix nagios init script to use nagiosxi path for the NagiosLockDir -SW
Fix for per-user collapsing menus -JO
Fix “no data” graphs from displaying in availability report for host/services with no performance data -JO
Fix sorting users on deploy dashboards to be alphabetical -JO

Fixed

Fixed bug in CCM with free variable definition that would not allow backslashes -JO
Fixed bug in permalink that was not passing request variables if user wasn’t logged in -SW

2014R2.3 - December 29, 2014

Added

Added alias to report if it exists, a host is selected and alias is different than the hostname, alertheatmap, histogram, statehistory, sla, execsummary, availability -SW

Fixed

Fixed php parse error in state history report -SW
Fixed manage services script on centos 5 to get proper service binary -JO
Fixed capacity planning issues with no label in xml -JO

2014R2.2 - December 26, 2014

Fixed

Fixed missing warn/crit values causing issues capacity planning graphs -JO
Fixed bulk modifications tool relying on half ccm/bulk mod css and javascript -JO
Fixed help system bug when displaying per-page help -JO
Fixed custom dates and replacing of newline chars in CSV output in state history and eventlog reports -SW

2014R2.1 - December 22, 2014

Updated

Updated the Manage Components page to be sorted by title (displayed name) and split into user/core sections -JO
Updated perfdata permissions to no longer be word writeable -JO
Updated Japanese language translations (thanks Sasaki) -JO
Updated menu section collapse/show -JO
Updated icons and Linux OS selection list for the sshproxy config wizard -JO
Updated MRTG configuration to use forks by default to process SNMP calls much faster -SW
Fixed issue in bandwidth report so it will not list in ‘see all available reports’ any services that have been deleted -LG
Fixed WatchGuard wizard so it detects ports correctly and allows support for all SNMP versions -LG

Added

Added ability for Alert Histogram report to allow selecting services and shows all host alerts including services or host only -JO
Added SLES, OpenSUSE, and CentOS/RHEL 7 support to the Linux Server config wizard (updated linux agent installer to work on the new systems) -JO
Added the ability to specify an alternate SNMP port and allow optional use of the TCP protocol in the snmptrapsender component -LG
Added a port number in the switch and watchguard wizards to a new column called ‘Port Name’ and the original Port Name field was changed to ‘Service Description’ -LG
Added “Other” to Linux Server config wizard which links to the NRPE config wizard instead -JO

Fixed

Fixed bug in graph explorer new 4 hour time frame not setting to 4 hours -JO
Fixed deploy notification options to show SMS and Email specific notification options -JO
Fixed bug in audit log where the amount of records/pages did not function properly -JO
Fixed sorting of dashboards, moving Home dashboard to top of list sorting remainder lexicographically -SW
Fixed bug in CCM that would give config errors when renaming a host -JO
Fixed bug in the CCM log management page that wouldn’t let you delete logs -JO
Fixed bug where CCM auto-login would not set the users CCM language to their selected Nagios XI language -JO
Fixed corruption of character-based languages in the CCM log management page -JO
Fixed bandwidth report ‘view all available’ table to show the description not just port number -JO
Fixed bandwidth report to sort naturally not by numeric -JO
Fixed CCM import to overwrite hosttemplates on hosts -JO
Fixed CCM import error messages not being displayed when there are errors -JO
Fixed CCM issue where spaces at front and end of host_name and config_name were possible -JO
Fixed Alert Stream to show the servers timezone instead of GMT -JO
Fixed backups to now save NRDP/NRDS configs -JO
Fixed scheduled backups not logging debug/info (and added 7 day log rotation) -JO
Fixed issue where clicking “Create Backup” in local backups page would wait for an extremely long time -JO
Fixed bug when trying to restart/start/stop NPCD from the web UI -JO
Fixed issue where custom url dashlet would not keep it’s resized size -JO
Fixed sorting of services in CCM table to now sort by host name (config name) and service name -JO
Fixed sorting on Scheduled Downtime page’s tables – now all host/services and groups are sorted alphabetically -JO
Fixed sorting on deploy dashboards page to now sort both the dashboards and users listed -JO
Fixed bug in autobackup scripts where some weekly backups weren’t removed on schedule -JO
Fixed Manage MIBs page to use the add_mib() function to ‘process trap’, if add_mib() is not in the filesystem or is not executable then use snmpttconvertmib to process MIB, but will not write EXEC lines -LG
Fixed Route Request (rr.php), when getting an invalid user_ticket due to load spikes -LG
Fixed Capacity Planning graph dashlet’s to export properly when in dashboard -JO
Fixed issue with NDOutils database upgrade rarely not adding columns -JO

2014R2.0 - November 11, 2014

2014R1.5 - October 1, 2014

Updated

Updated Highcharts perfdata graphs to be much bigger and easier to read -JO
Updated Monitor Engine Event Queue to use Highcharts -JO
Updated Japanese language file -SW

Added

Added the ability to remove perfdata legend on perfdata dashlets when creating the dashlet -JO
Added ability to comment on Host/Service from advanced tab of Host/Service detail page -SW
Added ability to specify notification types per notification method -AB,JO,SW

Fixed

Fixed PHP notice errors from session calls -JO
Fixed perfdata graphs to show the proper amount of graphs per page -JO
Fixed returning a “1” at the bottom of the page when enterprise features are enabled on enterprise only pages -JO
Fixed having all contacts removed set contacts to null when using re-configure objects page -JO
Fixed bug that allowed charts with no perfdata to display on availability report -JO
Fixed quick delete in CCM -JO
Fixed service timeperiod selection box in contacts from not showing selected service timeperiod in CCM -JO
Fixed full command line in CCM with Classic theme from not wrapping -JO
Fixed apply configuration highlight in CCM when removing an object -JO
Fixed relationship info button in CCM from displaying services instead of host template relationships for host templates -JO
Fixed case sensitive object searches which could result in user not allowed to see object -SW
Fixed default check_command’s to no longer have comments to they import correctly -SW

2014R1.4 - August 14, 2014

Updated

Updated logging so that automated logins are now logged with the Nagios XI username -JO
Updated logging so it does not log Nagios XI’s apply configuration logins which plagued the log file -JO
Updated the “Config Manager Admin” to be viewable to Nagios XI administrators only when automated login is active (default) -JO
Updated the “Configuration Snapshots” link to open in the same frame -JO
Updated the way navigation was happening when clicking links to not involve so much Javascript -JO
Updates to overall style and look -JO
Updated sorting on tables to show what it is sorting by and added back in “Sync Status” sorting -JO
Updated “Sync Missed” and “Synced to File” to “Not Applied” and “Applied” and made other some small text changes throughout -JO

Removed

Removed code from older versions that is no longer used -JO

Added

Added the ability to specify backup creation timeout with cfg variable “backup_timeout” which defaults to 1200 secs (20 min) if not set -JO
Added automated login when accessed from inside of Nagios XI if the user is an admin -JO
Added ability to use old “separate” login behavior by setting “Separate CCM Login” in Admin > System Config settings page -JO
Added a warning on host/service pages to let someone know if the config needs to be applied in case they have multiple pages of hosts/services -JO
Added red asterisk to “Apply Configuration” button if there are modified object(s) that need the config applied -JO
Added delete all configs from the Write Config Files section -AB,SL

Fixed

Fixed whitespace issues in textareas -JO
Fixed bug in scheduled backups which caused SSH to remain open while backup was being created which could take 1hr+ -JO
Fixed bug with perfdata Highcharts graphs not showing with units of measurement that started with a number -JO
Fixed issue in Graph Explorer where scalable timeline graphs would not filter on the first selected type -JO
Fixed bug in CCM where Contact Options would always revert to standard -SW
Fixed bug causing preg_match error when processing imported mibs -LG
Fixed PHP notices caused by the new Highcharts perfdata template -JO
Fixed loading image being displayed indefinitely on Views page until refresh after deleting a view -JO
Fixed Japanese character corruption on status dashlets -JO
Fixed bug with messages displaying in a hard-to-read fashion when deleting/updating an object -JO
Fixed service description and confg name ordering on services table -JO
Fixed hidden scrollbar issues with popup selection boxes for host/services -JO
Fixed bug in check_command that wouldn’t allow using a ; in the actual checks -JO
Fixed a bug where it would show apply config needed all the time if a config didn’t exist because all objects were inactive for it -JO

2014R1.3 - July 17, 2014

Security

Added the ability to force a check even if the host/service is out of it’s check period -JO
Fixed schedule immediate check to do a forced check (default in Nagios Core) -JO

Updated

Updated style of host/service details pages -JO
Updated verifications in CCM for host/service escalations to match the requirements for apply config to be successful -JO
Updated verification requirements in CCM for host/service dependency definitions for valid configs -JO

Added

Added “Show Config Changes” and “Show Errors” on Apply Configuration page for admins -JO
Added “Last”, “Avg”, and “Max” to Host Graphs section Highcharts graphs -JO
Added “Delete All Configs” button to CCM -AB

Fixed

Fixed Japanese character corruption in dashboard names -JO
Fixed bug where CCM could not apply configuration with host/config names with / in them -JO
Fixed bug in CCM where free variables wouldn’t import when importing Nagios Core config files -JO
Fixed bug where performance graphs were not showing up for services with : in the name -SW
Fixed character corruption in performance graph names -JO
Fixed issue with missing forward slash in response url -JO,TM
Fixed variable definition illegal character check -JO,SW
Fixed bug in CCM that wouldn’t allow & in command definitions -JO
Fixed issue with reconfigure where you could never configure no contacts on a host/service -JO
Fixed bug in Top Alert Producers and State History reports so that the selected state type stayed on page changes -JO
Fixed double % signs in graphs -JO
Fixed bug where searching for a host with no services would return nothing on “Service Status” page -JO

2014R1.2 - June 23, 2014

2014R1.1 - June 3, 2014

Security

Applied patch to Nagios Plugins 2.0.2 for SUID security vulnerability -SW

Updated

Update Nagios Plugins to 2.0.2 -SW
Applied patch to Nagios Plugins 2.0.2 to correct reverse lookups -SR,SW
Applied patch to Nagios Core to remove extraneous
from appearing in perfdata of passive checks as well as other check results reaped from the checkresults queue -SW
Changed the Apply Configuration process to only write out changed configuration files -SW, AB
Upgraded wkhtmltopdf from 0.10.0 to 0.12.1 to fix rendering issues for graphs in PDFs -JO
Updated some icons to fit the new theme and not have white backgrounds -JO
Fix Ndoutils situation where db table nagios_logentries has items where `instance_id`,`logentry_time`,`entry_time`,`entry_time_usec` isn’t unique enough. -SW
Fix bug where backend calls were forcing to connect to http://localhost even if forcing ssl -SW
Fix bug where reports would not be able to go through pages if auto-loading was turned off -JO
Fix bux in Network Outages causing incorrect hosts to be listed. -SW
Fix bug preventing new users from being added to the CCM -SW
Fix bug causing Services in Service dependencies to be disabled -SW

2014R1.0 - May 13, 2014

Updated

Updated Highcharts library to 4.0.1 with additional modules -JO

Added

Added View service status icon to hosts in service detail table -SW
Added JSON output for backend API by using “outputtype=json” in the API query -JO

Fixed

Fixed bug where inactive commands displayed in the Check Command list in the CCM -SW
Fixed new highcharts graphs to default in place of RRDtool unless changed in system config -JO
Fixed bugs with Switch / Router wizard and SNMP v3 -JO
Fixed Japanese language corruption in CCM -JO
Fixed website defacement wizard’s Japanese language corruption in regex / command -LG
Fixed bug where number of items being displayed in CCM tables were off by 1 -SW
Fixed bug where all latest alerts were being shown in an individual host was selected in the Executive Summary Report -SW
Fixed bug with pdf reports not showing proper report data in character-based languages -JO

2014R1.0RC3 - April 29, 2014

Updated

Upgraded Highcharts to version 4.0.0 -JO

Added

Added the ability to send emails to all users not just selected users -JO
Added service graphs advanced option to availability report -JO
Added displaying of address for host links when you hover over the hostname -SW

Fixed

Fixed bug in CCM that would not show all the available pages in the Jump To Page box -JO
Fixed some issues with Japanese character corruption -JO
Fixed alert heatmap to now work when using Japanese as the language -JO
Fixed bug in scheduled reporting where the custom message per email wasn’t being sent with the email -JO
Fixed the tools section for languages that use characters -JO
Fixed undefined offsets repopulating ‘Services’, ‘Processes’, and ‘Event Logs’ fields when moving back from previous steps in many wizards. -EM
Fixed MRTG’s cfgmaker to support all priv-protocols -SW
Fixed bug preventing installation from /root -SW

2014R1.0RC2 - April 18, 2014

Updated

Fixes to the automatic DB repair script to not be automated, but suggest the recommended fix. -SW

Added

Added ability to remove Network Analyzer Tab from Host/Service Detail Page -JO
Added Grid lines on tables -JO
Added ability to stop reports and metrics from auto-loading with new performance settings tab -JO
Added new Report tab in Performance Settings to disable automatic loading on report pages -JO
Added the ability to send emails out to selected users from the user management page -JO

Fixed

Fixed bug in local backup downloads which prevented large backups from being downloaded -SW
Fixed bug that prevented free variables being saved with a value of 0 -SW
Fixed default to highcharts graphs on host/service detail page -SW

2014R1.0RC1 - April 15, 2014

Security

Fixed XSS security issues -JO

Updated

CORE COMPONENTS
Upgraded NDOutils to version 2 -SW
Upgraded Nagios Plugins to version 2.0.1 -SW
Upgraded MRTG to version 2.17.4 -SW
WIZARDS
Updated Bulk Host Cloning Wizard to have ability to specify parents and hostgroups -JO
REPORTS
Updated Availability Report with options to select specific states, add timeperiod filters, assume states during downtime, etc.- JO
Updated Capacity Planning Report including addition of dashlets to report – JO,NS,SW
Updated Bandwidth Usage Report to use Host/Service names and look like the other XI reports -JO,SW
VISUALIZATIONS & FUNCTIONALITY

Added

Added MongoDB Server Wizard -JO
Added MongoDB Database Wizard -JO
Added Nagios Cross Platform Agent (NCPA) Wizard -Nick
Added Domain Expiration Wizard – LG
Added Website Defacement Wizard – LG
Added Nagios Network Analyzer Wizard -JO
Added new Service Level Agreement (SLA) report – EG
Added Network Report with Integration with Nagios Network Analyzer -JO
Added Network Query Report with Integration with Nagios Network Analyzer -JO
Added PDF export for the following reports: SLA, Bandwidth Usage, Capacity Planning, Network Report, Network Query -SW
Added Scheduled reporting for the following reports: SLA, Bandwidth Usage, Capacity Planning, Network Report, Network Query -SW
Added ability to set the scheduled report email text on a per-user basis -JO
Added New Theme with cleaner look and quick search from any page -JO
Added Mass Downtime Deletion ability -SW
Added ability to archive snapshots -SW,JO
Added Per-User Menu Collapsing Memory -SW
Added gauges dashlets to service/host detail pages -SW
Added Deadpool feature to optionally automatically remove hosts/services from being monitored (Enterprise Feature) -EG,SW
Added Scheduled Backups Component -JO
Added Easy Upgrade from web UI – SW, JO
Added ability to view past upgrade logs (if done from web UI) in web UI -JO
Added ability to set XI server and PHP timezone from web UI -JO
Added ability to drill-down to specific hosts by clicking Highcharts perf graphs -JO
Added RDP and VNC Connection component allowing quick connections to host via RDP, VNC, Telnet and SSH -EG,SW,JO
Added logging of phpmailer failures to /usr/local/nagiosxi/tmp/phpmailer.log -SW
Added capacity planning graphs to tabs in Status detail pages -JO
Added the ability to give hosts a parent in bulk modification tool -JO
Added the ability to give hosts a hostgroup in bulk modification tool -JO
Added the ability to add a service (from an existing service as a template) to multiple hosts using the bulk modification tool -JO
Enhanced Graph Explorer (with Stacked Performance Graphs) -JO
Enhanced Performance Graphs on Status Details Pages -JO,SW
Enhanced view rotation time slider -JO
Updated host/service detail pages to have choices of “5”,”10′′,”15′′,”25′′,”50′′,”100′′,”250′′,”500′′,”1000′′ per page -SW
Updated Apply Configuration process to remove old host/service .cfg files before writing the new .cfg files, this will help eliminate the possibility of ghost hosts/services. -SW
Updated Apply Configuration process to only allow one Apply Configuration process to happen at a time. -SW

Fixed

Fixed bug which was preventing back button from remembering selection for notification_targets in step 5 of the wizard. -SW
Fixed bug that would allow hosts / services Active checkbox to be unchecked even if it had dependencies -SW
Fixed bug in license activation with lowercase license keys -EG
Fixed CCM bug where deletion/deactivation was possible with dependent relationships -SW
Fixed CCM bug so that saving static configurations to no longer add non-readable line breaks into saved files -JO
Fixed search for users in Manage Config Access of CCM… What a mess. -SW
Fixed Network Replay report -EG,JO
Fixed bug in the CCM where you could activate a service that had parent relationships that were disabled -JO
Fixed bug in the CCM where you could add a disabled parent to an object that would cause applying the config to fail -JO

2012R2.9 - February 11, 2014

Security

Fix to the backup_xi.sh to get place the config.dat that it sources in, into a specific directory. Added quotes around password variables as they could have special chars. -SW

Updated

Fix for CSV export on Availability report. Thanks Brian Christiansen for the patch! -SW
Fix for old graphexplorer dashlets to now show up again with new graph explorer -JO
Fix for graphexplorer giving an error in the error log -JO
Fix graphexplorer to show custom selected times properly -JO
Fix bug where autodiscovey jobs never complete -SW

Fixed

Fixed graphexplorer to show hosts with perfdata that don’t have _HOST_ perfdata -JO

2012R2.8c - January 20, 2014

Updated

Fix premature release of switch wizard slated for 2014 release that was missing dependencies -SW

2012R2.8b - January 17, 2014

Updated

Fix bug where Configure -> Re-configure this host/service would not work if notification options had not been set -SW

2012R2.8 - January 15, 2014

Security

Fixed check for update button to force an update check -JO

Updated

MIB upload page now runs the custom SNMPTT addmib command if present and process mib box is checked -SW
Fix hostgroup/servicegroup grid dashlets to sort services listed alphabetically -SW
Fix bug where Configure -> Re-configure this host/service would not work if additive inheritance was set in CCM -SW
Add ability to schedule recurring downtime for wildcard services as well as all services on a host. Thanks Brian Christiansen for the patch! -SW
Change graphexplorer to a be a core component -SW
Add gauges dashlets to service/host detail pages (2014 feature) -SW
Clicking the title in a timeline graph will now redirect to the host/service page for the host/service in the graph -JO
Dashlets now snap to each other borders if they are within 10px of eachother -JO
Dashlets now have a slimmer bounding box (2014 feature) -JO
All dashlets will now outline in a light color when resizing or dragging a dashlet -JO
Forgot password now sends an email to confirm resetting a password before actually resetting it -JO
Updated Availability, Alert Histogram, Executive Summary to use high charts graphs -JO
Updated TAC to use different verbage for active/passive checks, change passive icon to only display if active checks are disabled. Thanks Brian Christiansen for the patch! -SW

Fixed

Fixed bug where status table with downtime filter was not showing the correct results. Thanks Brian Christiansen for pointing us in the right direction! -SW
Fixed bug where in the Manage Variable Definitions popup under Misc Settings in CCM, if you insert new definitions the old values don’t get cleared. Thanks Brian Christiansen for the patch! -SW
Fixed bug where when creating a user, if you choose the “Admin” authorization level the checkboxes below are greyed out (except for read-only access). When you go back into that user the boxes are not greyed out and you can select them. If you change the level to User and then back to Admin the boxes are greyed out again. Thanks Brian Christiansen for the patch! -SW
Fixed bug where read_only users were not being added to the nagios cgi.cfg -SW
Fixed bug where key indexes were not getting added to nagios DB until first upgrade was performed -SW

Added

Added ntpd to install and run by default. -SW
Added the ability to perform the Nagios XI upgrades from the web UI with logging (2014 feature) -SW, JO
Added proper pagination that doesn’t show all available pages and jump to tables to the CCM on pages that have tables -JO
Added theme section and themes to Nagios XI (2014 feature) -JO
Added ability to change the highcharts graph theme from grey (2014 feature) -JO
Added timeframe selection to host/service “Performance Graphs” tab (2014 feature) -JO
Added new advanced options to availability report (2014 feature) -JO

2012R2.7 - November 26, 2013

Fixed

Fixed bug with 2014 features and search bar dissappearing -JO

2012R2.6 - November 25, 2013

Security

Fix XSS vulnerability in Tools Menu. User would have needed account on system to be able to inject items in their own page, but is now resolved. -SW

Updated

Add saved user-based collapsible menus (2014 feature) -SW
Fix calendar selection on Audit Log -SW
Updated Spanish translations. – LC, SW
Updated reporting to work even if there is a external url the xi server can not connect to. -JO
Fix bug where clicking on hosts in hostgroup summary, should display the hosts grid, not the services grid. -SW
Fix encoding of imported RSS Feeds -SW
Fix calls to the CLI use compliant languages, updating for the en_EN to be en_US in nearly all locations.. -SW, NS
Fix encoding with imported RSS Feeds -SW
Additions and fixes to the deadpool (2014 Feature). -SW
Add logic to upgrade from the Web UI (2014 Feature). -SW
Remove requirement of installing from /tmp -SW

Removed

Removed console.log debug outout which was causing some browsers to stop processing javascript -SW

Added

Added view rotation users setting so views will remain stopped/started for users when they return to the views page based on their last setting -SW
Added script to allow contacts to send notification using XI mail settings (e.g. via SMTP) -SW
Added exit codes to backup_xi.sh -SW
Added back in links inside PDFs. -JO
Added base for upgrade through the web UI -SW
Added the ability to create system backups through the UI (2014 Feature) -JO
Added ability to select dates for report with the calendar icons that have been there all along… -SW
Added the ability to DELETE archived config snapshots. Added the ability to RENAME the archived snapshot’s filename. (2014 Feature) -JO

Fixed

Fixed bug which was preventing CCM template options to persist -SW
Fixed Save button (again) in CCM for all IE versions -SW

2012R2.5 - October 11, 2013

Updated

Fix the broken recurring downtime script -SW
Fix further issues with Wizard form buttons in various browsers. -SW
Fix missing do_page_end in CCM that was possible causing old browsers to not be able to submit form -SW
Fix Mass Acknowledge problem if language was set to en_EN -NS
Fix for Scheduled Reports if they are scheduled in the 12AM hour. -AB
Fix obsess over service in CCM. -AB

2012R2.4b - September 30, 2013

Updated

Fix issue with upgrade caused by premature NagiosQL db upgrade run -SW
Fix issue with Chrome submitting the back button instead of Next on Wizards when the Enter Key is pressed. -SW

2012R2.4 - September 24, 2013

Security

Fix for SQL injection vulnerability in NagiosQL -SW (Thanks Denis Andzakovic)
Added additional security for old links if $cfg[‘secure_response_url’]=1; in config.inc.php -SW

Updated

Many CCM Internationalization updates/additions -SW
Fix for multi-byte chars in PDF files -JO,NS
Fix encoding of form search boxes and tooltips to display UTF-8 chars -SW
Add ability to allow HTML in comments if Allow HTML Tags in Host/Service Status is checked. Thanks Nate Broderick & Brian Christiansen. -SW
Addition of HelpSystem including videos and links to documentation in most pages of XI -SW

Fixed

Fixed bug which prevented scheduling recurring downtime if a host did not have any services -SW

2012R2.3 - August 25, 2013

Security

Fix so Host Graphs will display all datasources of performance data for services, not just the first -SW

Updated

Add Japanese language support. Thanks Jupiter Technology for all the hard work! -SW
Fix where unicode chars entered in comments/acknowledgments are now displaying properly -SW
Fixes for internationalization of email messageCharSet to UTF-8 -SW
Fix “Add User” was not giving descriptive errors when failing -SW
Fix scheduled downtime script to work with RAM disk -SW
Fix PDF on availability report of Host has no services -SW
Add ability to secure notification %responseurl% by setting $cfg[‘secure_response_url’]=1; in config.inc.php -SW
Fix permalink copy to clipboard -SW
User Dashboards are now sorted alphabetically -SW
Reworked CCM to be able to include XI functions. -SW
Fix bug where users without permissions on a host could not set (or view) recurring downtimes for services they are a contact for -SW
Change to load spash page images locally to avoid mixed content -SW
Fix sort order on host, hostgroup, servicegroup dropdown list to be ASC -SW
Fix to allow locale get variable to pass through auto-login -SW
Fix in CCM to allow quotes in the value section of free variables -SW

Removed

Removed language conversion from text that goes in images on Availability report as all languages not supported -SW

Fixed

Fixed CCM Bug where Hostgroups and contactgroups are not added to host/service escalations when you add them for the first time -SW
Fixed PNP default template bug that allowed comments to overflow the RRD memory and cause a legend is too long error. – NS
Fixed links to localhost issues in Executive summary and NagiosXI pages when sending out schedule reports – NS/SW

2012R2.2 - June 5, 2013

Updated

Fix bug causing SSL users to experience some ajax items not loading, apply configuration to go on forever and submitted commands to not return -SW
Fix in CCM where templates didn’t maintain order applied -SW
Fix in CCM where Limit Results didn’t stick if you selected 250 -SW

2012R2.1 - May 24, 2013

Security

Fix upgrade order so new sourceguardian extensions get upgrade BEFORE new encrypted files are applied -SW

Fixed

Fixed CCM Bug where ‘Static Configuration Directory’ in Config Manager Settings was always /tmp -SW

2012R2.0 - May 20, 2013

Security

Updated sourceguardian extensions to version 9 to allow support for PHP 5.4 -SW

Updated

Updated some link references from the Legacy CCM to the New CCM -SW
Add ability for notification templates in Admin -> Notification Management to be deleted – SW
Fix for php-mcrypt bug writing module.so instead of mcrypt.so in the mcrypt.ini -SW
Fix to support multi-digit sub-versions in components and wizards -SW
Updated the profile component to now fetch system and apache log information – SL / AB
Updated CURLOPT_SSL_VERIFYHOST to 2 in load_url() since support for 1 is about to be removed in PHP 5.4 and Curl – MG
Fix for object case sensitivity lookup where case sensitivity was not alway ignored – EG

Added

Added inode filesystem check to the profile.zip -SW
Added ability to turn off HTTPPROXYTUNNEL from proxy component -SW
Added changes so custom logos display on reports if they are added to the custom logo component -SW
Added v3_priv_proto for SNMP v3 in SNMP Wizard -SW
Added ability for Quick find auto-complete to include host alias field -SW

Fixed

Fixed CCM bug where groups couldn’t select objects as members if they had the same name – MG
Fixed bug with Nagios Mobile where host escalations was not authorizing contacts properly – MG
Fixed MIB upload bug where if it didn’t contain any TRAP or NOTIFICATION definitions it would fail -NS
Fixed BPI javascript bug with “Clear All” and re-enabling disabled select options – MG
Fixed BPI bug where syncing host/servicegroups added a duplicated definition and prevented the group from being edited – MG
Fixed html entities showing up in the second column of the CCM table -NS
Fixed bug that would perfdataproc cron to stack up processes if host set for outbound transfer was down or entered incorrectly -SW

2012R1.8 - April 17, 2013

Updated

Fix bug introduced with mixed case usernames/contacts -EG/SW/MG

2012R1.7 - March 27, 2013

Security

Allow a locale to be passed to the login page to force a certain language upon login. login.php?locale=en_ES – MG
BPI: Updated to HTML 5 and forced IE to display in Edge mode so it will work correctly without having to manually set compatibility mode – MG
Forced username to lowercase upon login to prevent problems with Nagios Core permissions – EG

Updated

Mods to speed up availability report and executive summary for users with “can see all hosts and services” privileges -SW
Fix Bug in Tactical Overview where it wasn’t displaying the correct totals -SW
Updated system profile component to fetch a downloadable zip with useful log information – SL / MG
Fixed bug where child hosts weren’t able to be deleted with the nagiosql_delete_host.php script – MG
BPI: Fixed bug with BPI groups not re-populating the form for selected child groups – MG

Fixed

Fixed bug in scheduled reporting where pdf’s wouldn’t generate on certain SSL connections -SW
Fixed pass by reference bug that was causing deprecation warnings. – NS
Fixed bug #368 with Notification Deployment templates – MG
Fixed iframe display issues with Ipads/Iphones – MG
Fixed CCM bug with action_url and notes_url not being escaped properly – MG
Fixed CCM bug where wildcards weren’t working correctly – MG
Fixed BPI PHP warning about division by 0 – MG
Fixed BPI bug with long plugin output not being truncated for display correctly – MG
Fixed CCM bug with (+,null,standard) inheritance options not saving correctly – MG
Fixed bug in CCM where illegal macro characters (`~$&|'”) were allowed to be saved – MG
Fixed bug in CCM where @ was being read as an illegal object name character – MG
Fixed bug where apache crontab wasn’t being initialized on some systems – used for scheduled reporting – MG
Fixed CCM bug where host and contact description fields were required – MG

Added

Added /var/lib/mrtg and /etc/mrtg/mrtg.cfg to the XI backup/restore scripts -SW
Added language selection icons on the login page. These will override default settings for the duration of the session – MG
Added CCM feature to denote Service->Servicegroup relationships from Servicegroups page – MG

2012R1.6 - February 5, 2013

Security

Fixed Reflected XSS vulnerability related to dashlet AJAX loads (Reported by James Clawson) – MG
Fixed vulnerability where read-only users could access auto-discovery directly (Reported by James Clawson) – MG
Fixed shell vulnerability for autodiscovery tool (Reported by James Clawson) – MG

Updated

Fix for case-sensitive object ID lookups from NDOUtils – EG
Fix for CCM case-sensitive Config Names not being written to file – MG
Fix for host fields VRML image and statusmap image not repopulating correctly – MG

Removed

Removed use of the ‘at’ command for CCM audit log entries. Only selective entries are forwarded along to XI’s audit log now. – MG
Removed setting of putenv(LC_ALL) in CCM, apache was complaining on Cent/RHEL6+ systems – MG

Fixed

Fixed JS function calls in CCM that used attr() and updated them to use prop() where appropriate. (Chrome Fix) – MG
Fixed bug in notifications report where pdf exports came back empty if the search field was used – MG

2012R1.5 - January 30, 2013

Security

Forced IE browser mode for maximum compatibility with IE – MG

Updated

Fix upgrade script so users customized commands aren’t overwritten -SW
Fixed CCM bug with Chrome where selected table rows weren’t being deleted properly – MG
Mods to quickstart text and links – EG

Fixed

Fixed bug #348 in Bulk Mods related to object names with spaces not working correctly. – MG
Fixed CCM bug where contactgroups could be assigned to themselves – MG
Fixed bug where login alerts popup would display twice – MG
Fixed a bug where the CCM (apache) was emailing the root user with STDERR output when audit logging – MG
Fixed JQuery conflicts causing AJAX load problems in IE9 – MG
Fixed CCM bug with IE where notification period wasn’t repopulating the form correctly – MG
Fixed issue where password changes weren’t updating properly in htpasswd.users file – MG

Added

Added fix to prevent CCM configuration file from having improper permissions – MG

2012R1.4 - January 16, 2013

Updated

Fix permissions for unconfigured objects file to allow removing or deleting objects. -SW
Fix bug where Scheduled Downtime backend API threw error -SW
Refactored data fetches for status information, resulting in a major decrease in page load times, and less CPU overhead for mysqld/httpd – MG

Removed

Removed empty PNP template for check_smtp checks causing missing performance graphs – MG

Fixed

Fixed issue in CCM where free variables weren’t escaping backslashes properly – MG
Fixed bug where CCM audit logging wasn’t working correctly – MG
Fixed bug #325 where cloning a host, service, template, or contact moved custom variables instead of copying them – MG
Fixed tracker item #323 to support custom file locations with Unconfigured objects – MG
Fixed several issues with the screen dashboard – MG
Fixed issue where menu items were not being translated – MG
Fixed “Scheduled Events Over Time” chart to work over https -SW
Updated SQL query for timedeventqueue chart data to pull from host and service status tables instead.
Check statistics are now fetched from Nagios Core status, eliminating the need to use ndoutils hostchecks/servicechecks tables
The following setting can be implemented in ndomod.cfg to reduce SQL overhead on larger installs: data_processing_options=67108669
Refactored Tactical overview dashlets for a substantial improvement in load times – MG
Updated default notification messages to use %hostalias% macro – EG
%hostalias% macro now defaults to use value of %host% if not specifically set – EG
Fixed bugs with CCM variable sanitization – MG / NS

Added

Added link for admins to be able to edit the BPI config file at any time. – MG
Added new host commands to the host object details page – MG
Added a default POT file for easy updates of other translation files – MG
Added fuzzy translations for German, Spanish, French, Italian, Portuguese, Russian, and Chinese – NS
Added fix to installation script to check for new RHEL subscription method – SR
Added host alias to search criteria. Tracker item #337 – MG

2012R1.3 - December 5, 2012

Security

Updated sourcegaurdian loaders to eliminate issues with segmentation faults on enterprise components – MG
Fixed potential SQL injection vulnerability in legacy CCM for authenticated users – MG

Updated

Fix permissions for restore script. -SW
Fix so state history works for individual services -SW
Fix bug in CCM where selected None in Limit Results would reverts back to 15 -SW
Fix bug where users couldn’t change Max Notifications Age on database cleanup -SW
Fix bug where users couldn’t change address for mobile carriers, always used defaults. -SW
Nagios BPI: Fixed bug with empty auth_users printing lots of commas in bpi.conf – MG
Nagios BPI: Added additional commands to be used with the api_tool.php script. Use -h to see usage for available commands. – MG
Nagios BPI: Fixed issue where BPI group states were being calculated unnecessarily on page loads. – MG
Nagios BPI: Fixed bug with empty hostgroups creating ghost entries- MG
Nagios BPI: Fixed bug where config changes could cause both success and error messages to show up in the UI – MG
Add ability for wizards to add unlimited services,processes, mountpoints etc. Many wizards updated in this release -SW
Add ability to automatically process uploaded trap MIBS into snmptt.ini -SW,NB
Update default notification message to just use %host% as %hostalias% isn’t always set -SW

Added

Added support for internationalization. PO files can be added to /usr/local/nagiosxi/html/includes/lang/locale – MG
Added feature request #300, services can now be searched by host address. – MG
Added callback functions to allow custom status icons and custom table columns to be added to status tables by components – MG
Added support for a custom login splash page using the Custom Login component – MG
Added proxy support for component/wizard update check – SW

Fixed

Fixed bug in CCM where notifications_enabled defaulted to “off” if left blank in the form – MG
Fixed bug with duplicate key entries on bulk modifications. – MG
Fixed bug #317 in CCM where using the search bar could cause CCM insert, edit, and delete commands to be rerun – MG
Fixed bug in CCM where renaming config_name for a service could leave behind ghost service configs – MG
Fixed bug in CCM with form validation for required fields – MG
Fixed bug with component/wizard update check not allowing additional uploads – MG/SW
Fixed bug where global settings weren’t able to save properly (Gregory Shapiro)

2012R1.1 - October 25, 2012

Updated

Wkhtml installs now – AG
Updated all Jquery libraries to latest versions to allow all jquery functions to work in IE9 – MG
Revised fix for bug #201 where unconfigured objects failed to stay deleted – MG
Fixed CCM page navigation bug after users are deleted – MG
“Open Service Problems” page now hides any host that is acnowledged or in scheduled downtime – MG

Added

Added ability to upload MIB’s up to 5MB – SW
Added preliminary gettext support for internationalization – MG
Added fix to CCM import tool to prevent static and pnp configs from being imported – MG

Fixed

Fixed UI bug in CCM with duplicate contactgroups in selection box -MG
Fixed bug with IE9 where dashlets were not draggable – MG
Fixed issue in CCM where check commands with single quotes could break javascript functions (bug #305) – MG
Fixed bug #157 in new CCM where free variables weren’t being copied with an object copy. – MG
Fixed issue where Nagios Mobile was not installing on upgrades – MG
Fixed bug where host template notification_option ‘d’ wasn’t saving correctly – MG

2012R1.2 - October 5, 2012

Updated

Enterprise license trial expiration now lasts at least as long as normal trial – EG
Enterprise-only components are now automatically updated with every release. – MG
Updated highcharts library to 2.3.3. Fixes bug with timestack graph – MG

Removed

Removed perl-DBD-mssql package from 2012 prereqs – MG

Fixed

Fixed CCM bug where notification options weren’t saving properly for services/service templates – MG
Fixed CCM bug where hostgroup->hostgroup relationships could cause circular relationships – MG

Added

Added fix so fresh CSS / JS files get automatically refreshed in the browser with each version update – MG
Added missing “is_volatile” setting in CCM – MG

2012R1.0 - October 3, 2012

Updated

Components and Wizards can check to see if updates are available… -SW

Fixed

Fixed bug #201 where unconfigured objects failed to stay deleted. List can now also be manually cleared – MG
Fixed bug where multiple scheduled reports weren’t all sending – MG
Fixed page bounce on scheduled reporting – MG
Fixed bug with CCM search not repopulating correctly – MG
Fixed CSS issue rounded corners on footer – MG
Fixed issue where some users were seeing Configure tab when they weren’t supposed to – MG
Fixed BPI bug where the drill down wouldn’t happen if there were orphan groups – MG

Added

Added failsafe to Ajaxterm installer to rollback ssl.conf if an apache config issue is created – MG

2012RC3 - September 11, 2012

Fixed

Fixed bug where ajaxterm installer failed when installer was run from outside of the /tmp directory -SW
Fixed typo in deadpool.php – MG
Fixed bug where executable permissions were not properly being applied to newly installed components and wizards – MG
Fixed bug with exec summary exporting as the event log – MG
Fixed bug with duplicate report export options – MG
Fixed bug where PDF export was on some reports that can’t actually export to PDF – MG
Fixed bugs with “Email this report” – NS / MG
Fixed issues with search and back buttons on Escalation Wizard and Bulk Renaming tool – MG
Fixed bug #291 where services with a / in the name didn’t display their performance graph (Fix by forum user nagiosadmin42)- MG
Fixed bug #292 with multiple concurrent searches for host graphs. Expanded flexibility of search as well – MG

2012RC2 - September 4, 2012

Updated

2012 Standard Edition
New Core Config Manager
Configuration Rollback
Tools menu for external URL tools
Bandwidth Report
Executive Summary Report
Custom Action URL’s
Nagios BPI 2
Emailed Reports
SSH Terminal access built into the UI
Nagios Mobile now included
Automatic installation of all current components, dashlets, and wizards
Deadpool for obsolete hosts and services
Escalation Wizard
Scheduled Reporting
Scheduled Page Report
Notification Settings Management
Nagios BPI Hostgroup and Servicegroup Syncing
Audit Logging

Improved

Custom Home page
NRDS Config Manager
2012 Enterprise Edition
*All features mentioned above*
Capacity Planning Report
Bulk Renaming Tool

2011R3.3 - August 20, 2012

2011R3.2 - June 27, 2012

Security

Added fix to force correct permissions for all newly installed components, dashlets, and wizards – MG

Updated

Ndoutils upgrade script now checks existing DB username for any future upgrades -MG
Patched Nagios Core bug #338 where schedule downtime would not persist properly upon a restart of Nagios (Carlos Velasco) – MG

Fixed

Fixed error in upgrade script with missing dependencies package – EG
Fixed bug in upgrade script where NSCA may not upgrade properly – MG
Fixed issue where backing up crontabs could halt an upgrade if a tempfile already existed – AG
Fixed bug with host status search not searching against host_name field – MG
Fixed bug with 2012 availability report where hostgroups showed all host states as 0% -SW
Fixed issue with upgrade script stopping because of package conflicts – MG
Fixed bug #259 where state history report would now show services when using specific hostgroup for report – EG
Fixed issue where duplicate table indexes may have been created upon upgrade (KevinD and gwakem) – MG

Added

Added external api script to send data to audit log – MG
Added escalation status to notifications report page – EG
Added ability to delete hosts or services from the command line. To be documented in “Automated Host Management” doc – MG
Added escalated status to alertsummary notification macro – EG
Added wkhtml installation to upgrade script (not yet implemented)- EG
Added ajaxterm installation to upgrade script(not yet implemented) – EG
Added external URL to global config settings page to allow for custom URL in notification messages, scheduled reporting (future) – EG

2011R3.1 - June 8, 2012

Fixed

Fixed issue with upgrade script that could remove user-defined cron jobs from root crontab – SW
Fixed bug created in 3.0 where ‘/’ was not allowed in service descriptions – MG

2011R3.0 - June 4, 2012

Security

Fixed XSS vulnerabilities reported by user: 0a29406d9794e4f9b30b3c5d6702c708 -MG

Updated

Improved sanity checks for XI notification settings for XI users -MG

Added

Added fix for incorrect permissions with MIB and graph template directories – EG
Added support for 2012 notification management functions: Default Messages, and locking notification settings -MG
Added ‘getalerthistogram’ to backend API commands. -MG

Fixed

Fixed overlapping values in piechart for both current and 2012 versions -SW
Fixed bug #260 with notifications search(broke in 2.4). Expanded search options for more robust searches -MG
Fixed bug #156 where illegal characters can be passed for object names in the config wizards, now replaced with ‘_’ -MG
Fixed issue where illegal characters could be used with service descriptions in the Core Config Manager -MG
Fixed minor bug with availability CSV export – SW

2011R2.4 - April 24, 2012

Updated

Changed EPEL and RPMForge repos to use local rpms for manual installation – MG

Added

Added top alert producers to backend API via: cmd=gettopalertproducers -MG
Added permissions fix in reset_config_perms for future Renaming tool component – MG

Fixed

Fixed bug where hosts without services may not show available commands or tabs correctly – SW
Fixed an issue where duplicate notifications can populate the notifications report – MG
Fixed performance data not being sent on outbound transfers with NSCA #254 – SW

2011R2.3 - April 16, 2012

Updated

0 is now an acceptable value for first_notification_delay on monitoring wizards – MG
Modified some of the subsystem processes to only run when needed – MG
$cfg[‘xidpe_dir’] = ‘/usr/local/nagios/var/spool/xidpe’; $cfg[‘perfdata_spool’]= ‘/usr/local/nagios/var/spool/perfdata’;
Fixes for rapid response authentication – EG
Reverted sudoers install script to support CentOS 5 – EG
Fixed bug where deleted users weren’t being properly removed from the cgi.cfg file – SW
Bugfix for a small error in table alignment in PDFs – SW
CPU Load meter on syssstat dashlet now accounts for multiple CPUs -SW

Fixed

Fixed a bug where some monitoring wizards couldn’t complete because of missing values – SW/MG
Fixed issue where the upgrade script could fail if the /usr/local/nagiosxi/tmp directory was empty -SW
Fixed comment/author notification variables to now be %comment% and %author%, respectively – EG
Fixed issue with Date/Time picker for custom graph timeperiods – SW
Fixed issue on 64-bit el5 where removal on librsvg2.i386 failed and held up the installer – AG
Fixed issue where downtime is scheduled several days into the future, and a couple other problems – SW
Fixed issue with rapid response url with read-only users – MG
Fixed bug #250 related to European date formats in reports -SW

Added

Added new performance options to the Admin->Performance settings page, subsystem procs/logging can be disabled to improve performance – MG
Added config options for the performance data spool directories to allow for use of RAM disks with XI’s subsystem processes. -MG
Added some python libraries as dependencies in preparation for capacity planning project – AG
Added nmap support to sudoers (used by autodiscovery) – EG
Added helper functions to detect if a specific wizard or component is installed – EG
Added session performance improvement suggested by CB – EG

2011R2.2 - March 5, 2012

Updated

Streamlined generation of dependency meta-package – AG
Increased the default timeout value for process_perfdata.pl to 15 seconds for new installs – MG

Removed

Removed hard-coded package path in 1-prereqs – AG
Removed hard-coded db passwords in install scripts – EG

Fixed

Fixed problem where blank service performance graphs were being displayed – SW
Fixed potential bugs relating to the $CDPATH shell variable – AG
Fixed offlineinstall for Red Hat systems – AG
Fixed bug that broke performance graphs for some check_mk graph templates -MG
Fixed bug where availability report not display if one of the values was less than 0.14% but not 0 – SW
Fixed bug #239 where someone can save a service escalation without a contact or contact group. – MG
Fixed bug #238 that prevented service escalations from saving a service list under certain circumstances – MG
Fixed an issue where the unique service descriptions that populated the service escalations page were case insensitive – MG
Fixed bug #202 where custom date selections for performance graphs always led to “All Hosts” page – MG
Fixed a bug where custom date selections can cause all blank graphs upon a new login. – MG

Added

Added a “Finish” button to the wizard logic to allow for quick configuration – EG
Added new rapid response feature for notifications – EG
Added uninstall script (consider this beta) – EG
Added new notification variables (%responseurl%, %objecttype%, %objectid%, %notificationauthor%, %notificationcomment%, %alertsummary%) – EG
Added login screen splash information for contacting us – EG
Added ability to reset notification messages to system defaults in account settings – EG
Added option to run same wizard again at completion of monitoring wizard – EG

2011R2.1 - February 9, 2012

Security

Fixed sourcegaurdian error upon upgrade -AG

Fixed

Fixed JS minifiy issues in release prep – AG
Fixed bugs in fullinstall process – AG

2011R2.0 - February 6, 2012

Updated

Postgres sequence fix script is now run during upgrades, full installs – EG
Changed Nagios Core hostgroup/servicegroup logic to match Nagios XI – EG
New installations will have cleaner handling of sudoers, cron jobs, and php limits
Lots of bug fixes in the installer

Removed

Removed freetds and dbd dependencies

Fixed

Fixed bug that displayed debugging output on email test page #207 -MG
Fixed bug where email addresses without FQDN’s can vail validation and fail to send (example: root@localhost) -MG
Fixed bug #207 that broke the URL for Unhandled problems in the login alerts window and Nagios Fusion. – MG
Fixed bug #185 with adding new service escalations and dependencies. Removed safety nets in the UI to allow services with service->hostgroup relationships to work correctly.
Fixed bug #152 related to service escalations creating ghost services upon import. – MG
Fixed broken link on Unconfigured Objects page – SW
Fixed availability report bug where host name was not displayed properly – SW
Fixed bug #122 which displayed inconsistent data in state history reports – EG
Fixed bug #218 where servicegroup availability reports contained incorrect host data – EG
Fixed bug #215 where performance graphs in object detail screens could not be added to dashboards – EG
Fixed bug where host and service notifications could not be completely disabled on a per-user basis – EG
Fixed bug where escalation macro was not getting populated for use in notification messages – EG
Fixed bugs with improperly encoded URLs causing broken links -SW

Added

Added option to specify http port in config.inc.php. Apply Config would fail without a mod_rewrite. -MG
Added fix/feature for bug #190 to allow html output for host/service status text. Option is switchable in the Admin->Manage System Config page. – MG
Added a System Profile page to the Admin menu to assist in troubleshooting – MG
Added new backend commands to support future NagiosQL snapshot rollbacks – EG

2011R1.9 - December 7, 2011

Security

Fixed security escalation race conditions in crontab install scripts – EG / AG
Fixed XSS vulnerabilty in backend_url javascript link – EG
Fixed XSS vulnerability in xiwindow variables (affected permalinks) – EG
Fixed XSS vulnerability in recurring downtime script – EG
Fixed XSS vulnerability in alertheatmap report, “My reports” listing – EG
Fixed XSS vulnerabilities in status/report page link functions – EG
Fixed security vulnerability during package installation – AG
Special thanks to 0a29406d9794e4f9b30b3c5d6702c708 for reporting security vulnerabilities.

Updated

Prevented some time-critical SQL queries from being cached – EG
Prevented service graph from being generated in availability reports when a host has no services (issue #198) – EG
Patched recurring downtime script to fix problem with Nagios scheduling it’s own downtimes (issue 136) – submitted by Alexandru Lacraru
Changed home page notifications link to use newer report – EG
Fix for availability report including incorrect data – EG
Further revision on repairmysql.sh script for more successful repair runs – MG

Added

Added ability to copy permalink URL to clipboard (suggested by Troy Lea) – EG
Added fix for potential bug that prevented performance graphs from displaying on some systems -MG
Added fix to the rrdtool graph API for improved compatibility with existing PNP graph templates – MG
Added event log report to legacy reports – EG
Added ability to attach multiple files to an email message – EG
Added ability to have multiple recipients in email messages – EG

Fixed

Fixed potential endless loop in non-interactive fullinstall script – AG
Fixed bug with multiple calls to session_start() that produced error messages – EG
Fixed bug where custom tabs (eg. object notes) would not appear in service details screens – EG
Fixed minor bug in coreuiproxy.inc.php script that was generating a PHP Warning on CentOS/RHEL 6 installs – MG

2011R1.8 - October 28, 2011

Updated

Updated jQuery to 1.6.2 – EG
Performance graph panels in object detail pages now only display if panel is selected (suggested by Troy Lea) – EG
Modified cmdsubsys cron job to run daily update checks – EG
Revised OS checker for installer scripts to ensure compatibility and supported installations – AG
Updated the repair_mysql.sh script for more successful repair runs – MG
Modified load_url logging to overwrite load_url.log instead of appending to prevent log flooding with duplicate info. – MG
Multiple install attempts will not append to the install.log file instead of overwriting it. – AG
Updated NPCD daemon to 0.4-latest snapshot. Fixes memory leak that can crash NPCD process. – MG
http://assets.nagios.com/downloads/nagiosxi/components/proxy.zip – Adds a Proxy Configuration page to the Admin menu.

Added

Added ability to include attachments in emails – NS
Added group membership query functions – EG
Added MIB management to admin page (suggested by Troy Lea) – EG
Added PNP graph template management (suggested by Troy Lea) – EG
Added custom date/time selection to performance graphs (suggested by Troy Lea) – EG
Added Automatic login feature – EG
Added zip to the prereqs list for CentOS 6 – NS
Added missing dependency for check_by_ssh – AG
Added CentOS CR repo for CentOS 6 installations. Fixes package conflict for php-mssql package – AG
Added a fix that allows update checks to work on a proxy install -MG

Fixed

Fixed date in webroot index page (suggested by Troy Lea) – EG
Fixed problem with apostrophes being cut off in comments/acknowledgments – EG
Fixed bug #191 that created an extra footer div on child pages and prevented buttons and links from working – MG
Fixed bug 194 that created an SQL error in the browser when updating notification preferences – MG
Fixed memcached support by adding caching TTL (defaults to 10 seconds) – EG

2012RC4 - September 20, 2011

Updated

Fixed bug introduced in RC3 that broke result limit logic in new CCM – MG
Updated audit logging to summarize the log entry for a large config deletion – MG

Removed

Removed deadpool feature until later in 2012 – MG

Fixed

Fixed bug in new CCM where command defs would fail to save with single quotes – MG
Fixed bug in new CCM with timeperiod definitions not loading with certain versions of mysql – MG
Fixed bug with CCM nagios.cfg and cgi.cfg editor – MG
Fixed bug where hosts/services with more than one : in the name showed as unauthorized – SW

2011R1.7 - August 29, 2011

Updated

More robust installation scripts, support for RHEL 6 -AG
Changed permissions on files under /usr/local/nagiosxi to restrict access to Nagios and Apache users only -EG
Applied fix to check_xi_service_mrtgtraf.php PNP template to fix units problem on perf graphs -NS
Changed activation logic to require re-activate on IP address change -EG
Updated backend URL logic to fix problem with command-line scripts – EG
NOTE for proxy installs: Nagios XI needs to make internal calls to localhost, set your proxy accordingly.

Removed

Removed event log report link for non-admins – EG

Added

Added checks to detect wrong file types when uploading components, wizards, and dashlets -EG
Added logging when internal and external http calls fail: /usr/local/nagiosxi/var/load_url.log -MG
Added an import prep script that preps all .cfg files in a single directory (scripts/xi_prep_dir.php) -MG
Added ability to search for host status by IP address in the “Quick Find” search box – EG
Added sanity checks to all stages of reconfigure_nagios.sh to identify any problems during Apply Configuration -MG
Added error catches for “Apply Configuration” in the browser, problems will now exit the loop with an appropriate error message -MG
Added host alias to the host details page: Tracker Request: #165 -MG
Added ability to filter new reports by a single host. Tracker Request #134 – MG
Added callbacks to allow for overriding default home page, injecting links in reports – EG

Fixed

Fixed permissions in alert heatmap, notifications, histogram, and status history reports (issue #186) – EG
Fixed errors when determining backend URL (old logic broke with command line scripts) – EG
Fixed bug in footer with z-index and tray alert transparency – EG
Fixed tracker issue #127 related to status table sort arrows not being clickable -MG
Fixed bug created in 1.6 that causes slow performance with installs behind NAT -MG
Fixed bug in E-importnagiosql script with Apache not restarting and removed duplicate dependencies in 1-prereqs scripts – AG

2011R1.6 - July 25, 2011

Security

Fixed XSS vulnerabilities discovered in status pages (ajax calls)

Updated

Updated Windows desktop wizard with bug fixes related to saving preferences when using the back button
Modified monitoring wizard API to allow wizards to hide hostgroup, servicegroup, and parent host options
Fixes in E-importnagiosql for Apache not being detected as having started

Removed

Removed hard-coded http calls in new reports

Fixed

Fixed bug 163: related to long plugin output breaking the host/service details pages. Max status text is now 6k.
Fixed bug that was causing the “delete service” command to fail on the XI service details page.
Fixed bug in CCM that prevented lines longer than 4k from being imported and written to file correctly.
Fixed SSL bugs caused by an SSL host-certificate issue with curl.
Fixed bug #168 re: permalinks breaking on URLs that contained a space (this affected services and hosts)
Fixed bug #179 with CCM password limit at 15 characters

Added

Added support for RHEL 6 (0-yum)
Added bug fix to 12-mrtg that was preventing rrd’s from being created correctly from the switch wizard
Added patches to fullinstall and 0-yum that allow for non-interactive installs for 64bit systems.

2011R1.5 - June 23, 2011

Updated

Updated Nagios Core init script to suppress error messages about processes that couldn’t be killed (e.g. that no longer exist)

Removed

Removed custom port options for Windows server wizard (we will reimplement this in a later release)

Added

Added “check all” and “uncheck all” feature to switch wizard

Fixed

Fixed problem with Windows server wizard modifying port numbers in existing command definitions
Fixed problems with incorrect permissions on /usr/local/nagios/var directory files (caused orphan check errors)

2011R1.3 - May 24, 2011

Updated

Created a new performance graph API that fixes several known issues related to performance graphs displaying correctly -MG

Added

Added HTTPS support for underlying NagiosQL scripts (“$cfg[‘use_https’]=true” must be set in config.inc.php file)

Fixed

Fixed bugs that prevented strict SSL compatibility with backend calls. Pure https support now enabled with mod_rewrite. -MG
Fixed a javascript bug with the blue “fullscreen” triangle.

2011R1.4 - May 16, 2011

Updated

Modified Nagios Core notification scripts to include the host display name macro and allow it be used used in user notifications (using the %hostdisplayname% variable)
New init script to fix problems with multiple Nagios instances running

Fixed

Fixed bug in object functions related to instance_id and active state that affected object status pages
Fixed bug in E-importnagiosql script where Apache was not starting properly
Fixed bug where applying configuration changes would hang
Fixed bug where re-notification interval of zero (0) corrupted wizard object definitions
Fixed bug where fullinstall script needed to be run twice

Added

Added preliminary support for memcached
Added initial support for automatic logins
Added a non-interactive option to the fullinstall script for unattended installations

2011R1.2 - April 11, 2011

Removed

Removed event data from component status dashlet (was incorrect for some users)
Removed javascript scrollpane effect in left navigation bar

Fixed

Fixed error in nagios init script that affected clean restarts
Fixed bug in NDOUtils addon where host and service check statistics were no longer being reported
Fixed bug where top alert producers report didn’t have proper authorization checks
Fixed bug in dbmaint cron job that could cause table corruption for some users

Added

Added lockfile to dbmaint cron job to prevent overlapping jobs running/hanging

2011R1.1 - March 7, 2011

Updated

Disabled logging of external commands, passive checks for new installs and upgrades
Stylesheet fixes for Opera and Chrome

Fixed

Fixed bug in unconfigured objects parsing code

Added

Added styled scrollbar to left navigation menu
Added max notifications age setting in database performance page

2011R1 - February 28, 2011

Updated

Incorporated Exfoliation theme for Nagios Core

Added

Added a new “screen” dashboard for attaching dashlets to each screen (top frame)
Added tray alert to footer
Renamed “All Graphs” menu link to “Host Graphs”
Added support for saving preferences in performance graphs
Host Performance graphs now do not show hosts for which graphs are not available
New reports with CSV and PDF output capability
Added “My Reports” feature for favorite reports
Added check for missing posix_getpwuid() when applying config changes
Included highcharts for dynamic report generation (licensed code)
Improvements in MySQL database efficiency with new NDOUtils mods
Added support for new components, including: Auto-discovery
Hypermap
Alert timeline
Alert cloud
Network replay report
SNMP scan wizard

Fixed

Fixed bug where permalinks to dashboards didn’t work