{
 "slug": "checkmk",
 "name": "Checkmk Community Edition",
 "tagline": "Infrastructure and application monitoring with agent-based checks and alerting",
 "category": "observability",
 "use_cases": [
  "infrastructure-monitoring",
  "alerting",
  "service-discovery"
 ],
 "aliases": [
  "check_mk"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Checkmk GmbH",
  "url": "https://github.com/Checkmk/checkmk",
  "license": "GPL-2.0",
  "license_url": "https://github.com/Checkmk/checkmk/blob/master/COPYING"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "2.5.0p17",
   "last_build": "2026-10-23",
   "entity_id": "prod-g36bwb2uzsfmm",
   "ami_alias": "/aws/service/marketplace/prod-g36bwb2uzsfmm/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-nac2qsk7swjgy",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "2.5.0p17",
   "last_build": "2026-10-24",
   "offer_id": "checkmk",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:checkmk:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.checkmk?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/checkmk/",
  "json": "https://lynxroute.com/products/checkmk/product.json"
 },
 "release_notes": [
  {
   "version": "2.5.0p17",
   "title": "Checkmk 2.5.0p17",
   "notes": "* Checkmk Community updated 2.5.0p14 -> 2.5.0p17. GPL-2.0 unchanged\n* Security: CVE-2026-14452 (open redirect / XSS), CVE-2026-84112 (mk-job injection), CVE-2026-92882 (SNMP/IPMI secret redaction), CVE-2026-90956, CVE-2026-110511 and CVE-2024-28828 (CSRF), CVE-2026-103682 and CVE-2026-103674 (credentials visible in the process list), CVE-2026-105331\n* Security: ships the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619; unauthenticated remote code execution in PHP) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Earlier images of this product carry the vulnerable PHP and should be replaced\n* Bundled Redis remains under AGPL-3.0 with the source offer described in the product notes\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-24"
   }
  },
  {
   "version": "2.5.0p14",
   "title": "Checkmk 2.5.0p14",
   "notes": "* Checkmk Community Edition updated 2.5.0p13 -> 2.5.0p14. GPL-2.0 unchanged\n* Security: fixes a Livestatus injection through monitoring filter values, and the REST API endpoint that moves a single service between discovery phases now requires the \"Manage services\" permission like the rest of service discovery\n* Service discovery no longer aborts when a host address lookup fails, and the Nagios core no longer records check results for disabled services\n* Site start is more robust: an already-running xinetd no longer aborts it, and failed xinetd or stunnel starts are now reported instead of shown as OK\n* PagerDuty notifications can use the EU region endpoint, plus new APC NetBotz wireless sensor monitoring and current EC2 instance types in the AWS limits check\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "2.5.0p13",
   "title": "Checkmk 2.5.0p13",
   "notes": "* Checkmk Community Edition updated 2.5.0p12 -> 2.5.0p13. GPL-2.0 unchanged\n* REST API permission denials now return 403 instead of 401, so a client can tell \"not allowed\" from \"not signed in\"; requests authenticated by a Bearer header no longer open a GUI session\n* Fixes notification rules set to not match Event Console alerts, which matched only those alerts and skipped host and service notifications\n* Fixes the first sign-in of an LDAP user who does not yet exist in Checkmk, Livestatus read crashes, Event Console host lookup when messages arrive by IP address, and slow business-intelligence aggregations now time out instead of hanging\n* Check plug-in fixes for Open vSwitch bonding, UPS capacity and voltage, MQTT, Redfish rack PDUs and Redis, plus new CPU, memory and module-state monitoring for HPE and H3C Comware switches\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-11",
    "azure": "2026-09-13"
   }
  },
  {
   "version": "2.5.0p12",
   "title": "Checkmk 2.5.0p12",
   "notes": "* Checkmk Community Edition updated to 2.5.0p12 (from 2.5.0p11) - GPL-2.0 unchanged\n* Security: business-intelligence aggregations no longer reveal host and service names to users not permitted to see them, and viewing background jobs now requires the matching permission\n* Fixes a range of interface crashes - the view properties page, single-service views, scheduling and removing downtimes, custom attribute filters, user messages and links between views\n* Fixes disabling notifications for a host or service, and service-discovery REST API permissions\n* Site maintenance fixes: omd restore no longer fails with a KeyError, omd update aborts on a damaged skeleton hierarchy, and omd backup no longer corrupts Event Console history in the archive\n* Check plug-in fixes for Proxmox VE, Infoblox, Qmail, Kubernetes, Solaris memory and container CPU utilisation, plus new plug-ins for F5 rSeries (F5OS) appliances\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-06",
    "azure": "2026-09-09"
   }
  },
  {
   "version": "2.5.0p11",
   "title": "Checkmk 2.5.0p11",
   "notes": "* Checkmk Community Edition updated to 2.5.0p11 (from 2.5.0p10) - GPL-2.0 unchanged\n* LDAP group-to-attribute and group-to-role mapping is now agnostic between DN and CN\n* Fixes the \"enviroment\" typo in the Eaton UPS environment sensor plugin and service name\n* Improves network-topology performance when fetching data from the core, and fixes ConfigAnonymizer crashes on unknown customer fields\n* Bundled Redis updated to 8.4.5\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23"
   }
  },
  {
   "version": "2.5.0p10",
   "title": "Checkmk Community Edition 2.5.0p10",
   "notes": "* Checkmk Community Edition 2.5.0p10 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* The monitoring site is created on the instance at first boot, so its certificate authority, session secret, automation secret and admin password are unique per instance\n* Site web server, system web server and message broker all pinned to loopback\n* nginx TLS perimeter on 443 with a self-signed certificate plus Certbot for one-command CA-signed TLS\n* The Checkmk agent is installed on the server itself, so the first host you add is discovered immediately\n* UFW firewall pre-configured (SSH 22, HTTPS 443, and port 80 for the HTTPS redirect and certificate issuance)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-api",
   "live": {
    "aws": "2026-08-17",
    "azure": "2026-08-17"
   }
  }
 ],
 "release_history": [
  {
   "version": "2.5.0p17",
   "aws": "2026-10-23",
   "azure": "2026-10-24"
  },
  {
   "version": "2.5.0p14",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "2.5.0p13",
   "aws": "2026-09-11",
   "azure": "2026-09-13"
  },
  {
   "version": "2.5.0p12",
   "aws": "2026-09-06",
   "azure": "2026-09-09"
  },
  {
   "version": "2.5.0p11",
   "aws": "2026-08-23"
  },
  {
   "version": "2.5.0p10",
   "aws": "2026-08-17",
   "azure": "2026-08-17"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-g36bwb2uzsfmm/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer checkmk --plan payg-gen2\naz vm create -g my-rg -n checkmk --size Standard_D2s_v3 \\\n  --image lynxroute:checkmk:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Checkmk Community Edition is the free, GPL-2.0 edition of Checkmk, a monitoring system for servers, applications, networks, cloud services and containers. It is distributed as a self-contained stack: a single package brings its own Apache, Python runtime, Redis cache, RabbitMQ message broker, RRD time-series storage and monitoring core, so nothing has to be assembled from separate services. Monitoring is agent-based or agentless, and the service discovery is the point of the product: install the agent on a host, run a discovery, and Checkmk proposes the services it found rather than making you declare them. Several hundred official check plug-ins cover Linux, Windows, VMware, Kubernetes, databases, network hardware via SNMP, and the major cloud APIs. Configuration is done in the web UI with an explicit Activate-changes step, and a REST API covers the same operations for automation. GPL-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* The monitoring site is created on YOUR instance at first boot, not baked into the image - so its certificate authority, session-signing secret, automation secret and admin password are unique to your instance and exist nowhere else\n* Admin password generated at first boot and written to a root-only credentials file\n* Every site listener pinned to loopback - the site web server, the system web server and the message broker are reachable only from the instance itself, with nginx terminating TLS on 443 in front of them\n* The message broker's shipped default listens on all interfaces; this build overrides it to 127.0.0.1\n* Self-signed certificate out of the box and Certbot pre-installed, so a CA-signed certificate is one command away\n* Unused listening services that arrive as package dependencies are masked\n* UFW firewall pre-configured - SSH 22 and HTTPS 443; port 80 only redirects to HTTPS and carries the certificate-issuance challenge\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nReady to use on first login:\n* The Checkmk agent is installed on this server, so adding it as your first host takes three clicks and service discovery finds its services immediately\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}