CVS commit: pkgsrc/sysutils/monit

["Leonardo Taccari" <leot%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   leot
Date:           Sat Oct 17 10:47:56 UTC 2026

Modified Files:
        pkgsrc/sysutils/monit: Makefile distinfo

Log Message:
monit: Update to 6.0.0

pkgsrc changes:
- Enable for DragonflyBSD, according the changelog it was tested on
  DragonflyBSD 6.4 (NOTE: I have not tested it in pkgsrc though!)

Changes:
- New: The every statement can now reliably be used with minute
  precision. Like crontab, the every statement will run a service check
  only once per minute, regardless of poll-cycle time. This means that
  you can now use checks like this and be sure it runs only one time at
  the intended time:
    check program weekly_report with path /var/monit/weekly_report.sh
      every "15 8 * * 1"
      if status != 0 then alert
  This will run the above weekly_report.sh one time every Monday at 08:15
  (or as soon as possible after that time if the validation loop is
  delayed). Cron matching is asynchronous to the validation loop,
  ensuring checks run once even if validate takes longer than a minute to
  complete. This fixes the issue where checks with an every statement
  could be skipped entirely due to misalignment with poll cycle settings
  or validation loop delays.
- New: SSL/TLS: Add support for quantum-resistant cryptography: hybrid
  ML-KEM key exchange mechanisms with TLS 1.3. Monit must be linked with
  an SSL library that supports ML-KEM, such as OpenSSL 3.5.x or later,
  for this functionality to work.
- New: Added SHA256 checksum support. SHA256 can now be used in addition
  to MD5 and SHA1 for file integrity monitoring, SSL/TLS certificate
  verification, HTTP content validation, and MySQL RSA key verification.
  SHA256 provides stronger cryptographic security than MD5 and SHA1.
  Supported in the following statements:
    File checksum: if failed [sha256] checksum
    SSL certificate: certificate checksum <sha256-hash>
    MySQL RSA key: rsakey checksum [sha256] <sha256-hash>
    HTTP content: checksum <sha256-hash> (auto-detected from 64-character length)
  Example:
    check file myfile with path /path/to/file
      if failed sha256 checksum then alert
    check host example.com with address example.com
      if failed port 443 protocol https
         certificate checksum = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      then alert
- New: The file checksum test now uses SHA256 by default, if no hash
  function is specified (it used to be MD5 by default).
- New: Issue #1132: Added support for swap monitoring: PAGEIN and
  PAGEOUT tests in the check system context. It allows one to monitor the
  system's swap activity and memory pressure. When the system requires
  more memory, it may begin swapping memory pages in and out of the swap
  device. The swap device's I/O is significantly slower than RAM access,
  making it an indicator of the system's memory pressure. A general rule
  of thumb for swapping activity is:
    0     pages/sec:           Healthy
    1-10  pages/sec:           Minor paging, usually acceptable
    >100  pages/sec sustained: Memory pressure, investigate
    >1000 pages/sec:           Severe thrashing, immediate action needed
  Example:
    if pageout > 50 per second for 20 cycles then alert
    if pageout > 100 per second for 10 cycles then alert
  Thanks to Lutz Mader for patch.
- New: Linux: Issue #1136, Issue #42: process memory usage report
  overcounts the shared library RSS. Monit prefers the PSS (Proportional
  Set Size) report instead of RSS (Resident Set Size) now. The PSS
  provides a more accurate measure by fairly dividing shared memory among
  processes. RSS can be misleading because it overcounts shared memory by
  adding the entire amount to each process that uses it. PSS gives a more
  realistic view of both a single process's contribution and the system's
  total memory footprint. Warning: Monit >= 6.0.0 may thus report
  significantly lower usage for both "memory" and "total memory" for
  processes.
- New: MacOS: Process memory usage report is in line with Activity
  Monitor now and shows the process' physical memory footprint instead of
  RSS. It excludes shared memory that's being used by multiple processes
  (to avoid double-counting).
- New: The security attribute test now supports regular expressions and
  negative match, which is useful, for example, in the SELinux context,
  where a container might consist of random MCS categories. Thanks to
  Christian Goettsche. Syntax:
    IF SECURITY ATTRIBUTE <"="|"!="|"=~"|"!=~"> <regex> THEN <action>
- New: The check program output in the monit status CLI was limited to
  200 characters. The limitation is removed and monit will display up to
  set limits { programOutput: <size> } characters now. (Default is 512
  bytes).
- New: Illumos build (tested on OmniOS r151054).
- New: DragonflyBSD build (tested on DragonflyBSD 6.4).
- Fixed: If a stale pidfile existed at Monit startup, Monit could fail
  to start. This was especially common in containerized environments like
  Docker after an ungraceful shutdown. The issue was resolved by
  improving the startup check that detects whether another Monit daemon
  is already running. Thanks to Lutz Mader for identifying the problem
  and providing an initial patch.
- Fixed: The result of executing the check program command with the
  every statement is evaluated immediately (in the next cycle).
  Previously, Monit would wait for a specified number of cycles or until
  the next cron pattern match before evaluating the program's result.
- Fixed: Issue #1141: When multiple check program statements were
  linked with depends on, but the parent test frequency was limited using
  the every statement, the child copied the parent's test schedule, even
  if the child did not have its own every statement.
- Fixed: Wakeup Monit from sleep on SIGUSR1 signal.
- Fixed: Issue #1129: When the Monit log was set to a device, such as
  set logfile /dev/stdout (e.g. inside a Docker container), Monit hangs
  when "View Monit logfile" is used in the Monit HTTP interface. Thanks
  to Lutz Mader for report and fix.
- Fixed: Issue #1137: Hostname error in log when fetching status in XML format
  from the Monit HTTP API via UNIX socket.
- Fixed: Issue #1142: File descriptor leak on Linux when /proc/PID/attr/current
  is not accessible due to AppArmor/SELinux restrictions.
- Fixed: Monit now provides more detailed error reporting when the hostname
  resolution fails. Previously, when testing a remote host using ping and the
  host did not resolve in DNS, Monit simply reported "ping failed".
- Fixed: The MongoDB protocol test did support only MongoDB < 5.1. The protocol
  test was updated to support the newer MongoDB ping style.
- Fixed: The service restart counter wasn't reset on reboot, which could cause
  the restart timeout to falsely trigger when monit had a long polling cycle and
  the machine was repeatedly rebooted immediately after the first monit cycle.
- Fixed: When the system had no file descriptors limit, monit displayed
  confusing statistics in status:
    filedescriptors    4896 [0.0% of 9223372036854775807 limit]
- Fixed: Issue #1144: Monit GUI drops the Strict-Transport-Security header when
  sending HTTP error responses.
- Fixed: SSL/TLS: Disable obsoleted CBC ciphers by default.
- Fixed: Issue #1146: SIP check did not handle IPv6 addresses correctly.
- Fixed: Issue #1147: The SMTP EHLO response was limited to 256 bytes. Raised
  the limit to 512 bytes to match RFC 5321 section 4.5.3.1.5.
- Fixed: When the service had an "existence" test that used the multiple-errors
  condition (for X cycles), and the service encountered an error, Monit
  displayed the status as "OK" even though there was no data (e.g., a
  non-existent process or file).
- Fixed: When the state of the service changed and the test had a
  multiple-errors condition (for X cycles), the cycles counter was not
  reinitialized properly, which could trigger another state change faster than
  the option settings specified.
- Fixed: Some tests share the same event type (e.g., the "resource event" is
  shared by CPU, memory, swap, and load average tests). When multiple errors
  occurred for the same event type, the last test may have reset the error, and
  the service would be reported as a false-positive OK.
- Fixed: The PostgreSQL protocol test could read past the response buffer when
  parsing an error message from the server if any error field was not properly
  NUL-terminated within the payload. A malicious or malformed PostgreSQL server
  could exploit this to crash Monit or to leak stack data into the logs. Thanks
  to Tristan Madani for finding the bug and sharing the details. Workaround for
  vulnerable Monit versions < 6.0.0: Replace the if failed port 5432 protocol
  pgsql then <action> protocol test with a generic TCP connection test: if
  failed port 5432 then <action>.
- Changed: The check program output change test now sets the level to warning
  (yellow), instead of error (red).
- Changed: MacOS: Monit now utilizes the 64-bit system API to retrieve system
  memory usage information. The support for 32-bit Macs is deprecated, as the
  last pure 32-bit Macs were released in 2006. Thanks to Lutz Mader.


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 pkgsrc/sysutils/monit/Makefile
cvs rdiff -u -r1.13 -r1.14 pkgsrc/sysutils/monit/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/sysutils/monit/Makefile
diff -u pkgsrc/sysutils/monit/Makefile:1.28 pkgsrc/sysutils/monit/Makefile:1.29
--- pkgsrc/sysutils/monit/Makefile:1.28 Tue Aug 12 15:02:09 2025
+++ pkgsrc/sysutils/monit/Makefile      Sat Oct 17 10:47:55 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.28 2025/08/12 15:02:09 leot Exp $
+# $NetBSD: Makefile,v 1.29 2026/10/17 10:47:55 leot Exp $
 
-DISTNAME=              monit-5.35.2
+DISTNAME=              monit-6.0.0
 CATEGORIES=            sysutils
 MASTER_SITES=          https://mmonit.com/monit/dist/
 
@@ -10,7 +10,7 @@ COMMENT=              Monitors processes, files, dir
 LICENSE=               gnu-agpl-v3
 
 # no platform specific code yet
-BROKEN_ON_PLATFORM+=   DragonFly-*-* IRIX-*-* OSF1-*-*
+BROKEN_ON_PLATFORM+=   IRIX-*-* OSF1-*-*
 
 USE_TOOLS+=            gmake gzcat flex yacc
 USE_PKGLOCALEDIR=      yes

Index: pkgsrc/sysutils/monit/distinfo
diff -u pkgsrc/sysutils/monit/distinfo:1.13 pkgsrc/sysutils/monit/distinfo:1.14
--- pkgsrc/sysutils/monit/distinfo:1.13 Tue Aug 12 15:02:09 2025
+++ pkgsrc/sysutils/monit/distinfo      Sat Oct 17 10:47:55 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.13 2025/08/12 15:02:09 leot Exp $
+$NetBSD: distinfo,v 1.14 2026/10/17 10:47:55 leot Exp $
 
-BLAKE2s (monit-5.35.2.tar.gz) = 69420443cf9e72c1f3dc7ded98c5ca8c58031ebeb54dc889e95068565f50e2fa
-SHA512 (monit-5.35.2.tar.gz) = 5368a2096ae0ace59b4836a87d2758d11b550e6231a706f8e62ce0bcb2439895c9d1c41c0b0677a5112e30f4d809c95ddd039efdb60d9d4db826ab80d49179e5
-Size (monit-5.35.2.tar.gz) = 1526704 bytes
+BLAKE2s (monit-6.0.0.tar.gz) = 0497f2a8ff3be90f03f69cb75f6c6a1d3d846e250bfad57ccf68eb6be8e81f8f
+SHA512 (monit-6.0.0.tar.gz) = 4dcaaad3b88d83af7a1634e84238cb7f3437e0c64bcfc65c1b1bf17e10279d60309e7feaeb6cf887cc9c0911f486f58ac1602770e73457244511448ec0ed880a
+Size (monit-6.0.0.tar.gz) = 1545908 bytes
 SHA1 (patch-configure) = 5aa619ff3980418585cdc5f9c156712ac87b26c6
 SHA1 (patch-configure.ac) = 1bc974b407b3ba85f50e70d0fe8c20cff3e80eac
 SHA1 (patch-libmonit_configure) = 727ebc4daff59616f84fc064b7ab4059b3394d8d