Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Auto update check, checks for updates to base system + packages and sends email alerts

    Problems Installing or Upgrading pfSense Software
    22
    87
    25.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • wgstarksW
      wgstarks @stephenw10
      last edited by

      @stephenw10 said in Auto update check, checks for updates to base system + packages and sends email alerts:

      @wgstarks It stores custom files base64 encoded in the config. So you could use it to store the pkg_check.php file and it would be restore into a system when you restore the config. Though you might need to do it in several steps or manually save since the first boot would install the Filer package.

      So if I use filer rather than my usual SFTP for installing custom files they are added to the config which gets backed up by Auto Config Backup correct? So I should delete the current files and re-add them using filer?

      Box: SG-4200

      GertjanG 1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        You don't have to delete them. Filer simply won't do anything if the files are already there. And identical.

        wgstarksW 1 Reply Last reply Reply Quote 0
        • wgstarksW
          wgstarks @stephenw10
          last edited by

          @stephenw10 said in Auto update check, checks for updates to base system + packages and sends email alerts:

          Filer simply won't do anything if the files are already there. And identical.

          But the object would be for filer to add the file to the config database.

          Box: SG-4200

          1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @wgstarks
            last edited by

            @wgstarks said in Auto update check, checks for updates to base system + packages and sends email alerts:

            So if I use filer rather than my usual SFTP for installing custom files they are added to the config which gets backed up by Auto Config Backup correct? So I should delete the current files and re-add them using filer?

            I never used 'filer' myself, but yes, that's the beauty of the package :
            When you export your config, you export it with packages and package 'settings'.
            The filer package settings are, amongst others, the files and the place where they are stored.

            So, importing the config will import/install the package and will also import the config == settings of the package == big magic : all your private additions (files) are also restored.

            For myself, I'm doing things the old fashioned way. Not that I stick dozens of Post-It's on my pfSense (I did that before) but I use the Notes package :

            8914b55e-76bf-4dfe-ae51-5ec0ec9fe655-image.png

            and I add, for every setting and change that I made a
            Why / when / what to observe / where to get it, etc.
            So, when I have to re-install pfSense, I also re install these Notes, and I have my road-book ready after a phenix event.
            Hummmm. Maybe I should have a closer look at this filer package after all.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            wgstarksW 1 Reply Last reply Reply Quote 1
            • wgstarksW
              wgstarks @Gertjan
              last edited by

              @Gertjan
              Thanks for the Notes suggestion. I lost a few packages recently and been thinking about creating a pfsense logbook since it looks like some packages in Package Manager don’t get included in backups and I’m willing to bet custom packages that aren’t in package manager won’t be either. This looks like it’s perfect for that.

              Box: SG-4200

              1 Reply Last reply Reply Quote 0
              • M
                michmoor LAYER 8 Rebel Alliance @stephenw10
                last edited by

                @stephenw10
                can we make it a package my good sir? 😊

                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                Routing: Juniper, Arista, Cisco
                Switching: Juniper, Arista, Cisco
                Wireless: Unifi, Aruba IAP
                JNCIP,CCNP Enterprise

                GertjanG 1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Mmm, I was just thinking that as I wrote it. 😉

                  No developer time right now though, it would have to be a user PR. For now at least.

                  1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @michmoor
                    last edited by Gertjan

                    @michmoor

                    One tiny PHP file ?
                    ( and a cron entry, which somewhat forces you also to install the Cron package)

                    The overhead of 'official' package maintenance will be way bigger as the 80 or so lines.
                    Let's keep this the 'read the forum and you'll find a nice hidden forum package ^^' suggestion.
                    Or : the official way : go here.
                    It already exists ....

                    edit : Can some one bake this into a System_patch ? I wonder if writing in cron file /etc/cron.d./ for a cron entry would do the trick ....

                    edit : but actually, it should be here :

                    50bea137-7b19-4516-9764-aa998e956747-image.png

                    Just a button or a set of buttons, one for each notification method, that says :

                    Do you want to receive a notification when a pfSense upgrade, a pfSense package or a 'core' FreeBSD update is available ?

                    As soon as one of the notification methods is selected, the cron gets inserted, etc.

                    edit :
                    Ok, just for the fun :

                    4c644420-4a09-4e2c-b81a-9971968b5d49-image.png

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      michmoor LAYER 8 Rebel Alliance @Gertjan
                      last edited by

                      @Gertjan in my mind , an official way of getting notifications of updates is/should be the required way.

                      1. This awesome script is only in the forums and not documented in any official capacity.

                      2. We shouldn’t expect admins to muck around in the filesystem

                      I’m glad there is a redmine. Maybe one day…..

                      Firewall: NetGate,Palo Alto-VM,Juniper SRX
                      Routing: Juniper, Arista, Cisco
                      Switching: Juniper, Arista, Cisco
                      Wireless: Unifi, Aruba IAP
                      JNCIP,CCNP Enterprise

                      GertjanG 1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @michmoor
                        last edited by

                        @michmoor said in Auto update check, checks for updates to base system + packages and sends email alerts:

                        This awesome script is only in the forums and not documented in any official capacity.

                        True.
                        I'm feeling 'protected' as I'm pretty sure people like jimp would have posted : "don't do this" if these '80 lines' had the slightest effect on security or whatever

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          michmoor LAYER 8 Rebel Alliance @Gertjan
                          last edited by

                          @Gertjan said in Auto update check, checks for updates to base system + packages and sends email alerts:

                          I'm feeling 'protected' as I'm pretty sure people like jimp would have posted : "don't do this" if these '80 lines' had the slightest effect on security or whatever

                          I get the concern but then they should ack the redmine. Been noticing a troubling trend around unassigned/unack tickets....

                          Firewall: NetGate,Palo Alto-VM,Juniper SRX
                          Routing: Juniper, Arista, Cisco
                          Switching: Juniper, Arista, Cisco
                          Wireless: Unifi, Aruba IAP
                          JNCIP,CCNP Enterprise

                          1 Reply Last reply Reply Quote 0
                          • M michmoor referenced this topic on
                          • J jrey referenced this topic on
                          • T
                            tariqali
                            last edited by

                            Fantastic script, and I had no idea about Filer, so easy to setup, just copied the raw code from the gist and used 0755 permissions.

                            This should definitely be part of the base pfsense configuration.

                            Screenshot 2024-09-06 at 10.41.39 PM.png

                            Screenshot 2024-09-06 at 10.41.58 PM.png

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @tariqali
                              last edited by

                              @tariqali

                              This :

                              d1a7646e-29e5-44cf-8213-685b893cab02-image.png

                              will run the script .... when ... ones ?

                              You still have to :
                              Make sure your have the pfSense Cron Package.
                              Add a cron task that execute the script ones every - when ever you want - per day (week ? month ? hours ?).
                              And of course, test it and check up with it ones in a while.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              T 1 Reply Last reply Reply Quote 1
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Yes that will run it once but you shouldn't need that. The field allows Filer to run a command after it has added back a file which may be required. This script doesn't need it though. It's run by cron anyway.

                                1 Reply Last reply Reply Quote 0
                                • T
                                  tariqali @Gertjan
                                  last edited by

                                  @Gertjan Yup I setup CRON to run every night.

                                  1 Reply Last reply Reply Quote 0
                                  • GertjanG Gertjan referenced this topic on
                                  • GertjanG Gertjan referenced this topic on
                                  • wgstarksW
                                    wgstarks
                                    last edited by

                                    I seem to be having problems with this update checker. I first noticed today that it wasn't working at all although there were updates available for pfsense+ as well as system patches. While checking I realized that I wasn't using the latest php from github so I updated it to-

                                    ?php
                                    
                                      require_once("pkg-utils.inc");
                                      require_once("notices.inc");
                                      require_once("util.inc");
                                    
                                      $msg = null;
                                      $pmsg = null;
                                      $p = 0;
                                    
                                      log_error("Starting update check");
                                    
                                      // pfSense base system check
                                      $system_version = get_system_pkg_version(false, false);
                                      if ($system_version === false) {
                                        printf("%s\n", 'Unable to check for updates');
                                        log_error("Unable to check for updates, exiting");
                                        exit;
                                      }
                                    
                                      if (!is_array($system_version) ||
                                        !isset($system_version['version']) ||
                                        !isset($system_version['installed_version'])) {
                                        printf("%s\n", 'Error in version information');
                                        log_error("Error in version information, exiting");
                                        exit;
                                      }
                                    
                                      switch ($system_version['pkg_version_compare']) {
                                        case '<':
                                          //printf("%s%s%s\n", "pfSense version ", $system_version['version'], " is available");
                                          $msg = "An update to pfSense version " . $system_version['version'] . " is available\n\n";
                                          break;
                                        case '=':
                                          //printf("%s%s%s\n", "pfSense version ", $system_version['version'], " (installed) is current");
                                          break;
                                        case '>':
                                          printf("%s%s%s\n", "pfSense version ", $system_version['installed_version'], " is NEWER than the latest available version ", $system_version['version']);
                                          $msg = "pfSense version " . $system_version['version'] . " is available (downgrade)\n\n";
                                          break;
                                        default:
                                          printf("%s\n", 'Error comparing installed with latest version available');
                                          log_error("Error comparing installed with latest version available");
                                          break;
                                      }
                                    
                                      // package check
                                      $package_list = get_pkg_info('all', true, true);
                                      $installed_packages = array_filter($package_list, function($v) {
                                        return (isset($v['installed']) && isset($v['name']));
                                      });
                                    
                                      if (empty($installed_packages)) {
                                        printf("%s\n", 'No packages installed');
                                        log_error("No packages installed, exiting");
                                        exit;
                                      }
                                    
                                      foreach ($installed_packages as $pkg) {
                                        if (isset($pkg['installed_version']) && isset($pkg['version'])) {
                                          //printf("%s%s%s\n", $pkg['shortname'], ': ', $pkg['installed_version']);
                                          $version_compare = pkg_version_compare($pkg['installed_version'], $pkg['version']);
                                          if ($version_compare != '=') {
                                            $p++;
                                            $pmsg .= "\n".$pkg['shortname'].': '.$pkg['installed_version'].' ==> '.$pkg['version'];
                                            if ($version_compare == '>') {
                                              $pmsg .= ' (downgrade)';
                                            }
                                            printf("%s%s%s%s%s\n", $pkg['shortname'], ': ', $pkg['installed_version'], ' ==> ', $pkg['version']);
                                          }
                                        }
                                      }
                                    
                                      if ($p > 0) {
                                        $msg = $msg . "The following updates are available and can be installed using System > Package Manager:\n" . $pmsg;
                                      }
                                    
                                      // check for updates to builtin packages
                                      exec("/usr/sbin/pkg upgrade -n | /usr/bin/sed -ne '/UPGRADED/,/^$/p'", $output, $retval);
                                      if (($retval == 0) && (count($output))) {
                                        $msg .= "\n\n" . "Some packages are part of the base system and will not show up in Package Manager. If any such updates are listed below, run `pkg upgrade` from the shell to install them:\n\n";
                                        array_shift($output);
                                        $msg .= implode("\n", array_map('ltrim', $output));
                                      }
                                    
                                      if (!empty($msg)) {
                                        log_error("Updates were found - sending email");
                                        notify_via_smtp($msg);
                                        // to send alerts to ALL configured targets (email, Pushover, Slack etc) use the line below instead:
                                        // notify_all_remote($msg);
                                      }
                                    
                                      log_error("Update check complete");
                                    
                                    ?>
                                    

                                    This yielded a notification for updates available-

                                    Notifications in this message: 1
                                    ================================
                                    
                                    12:00:13 The following updates are available and can be installed using System > Package Manager:
                                    
                                    System_Patches: 2.2.11_15 ==> 2.2.11_16
                                    
                                    Some packages are part of the base system and will not show up in Package Manager. If any such updates are listed below, run `pkg upgrade` from the shell to install them:
                                    
                                    pfSense-pkg-System_Patches: 2.2.11_15 -> 2.2.11_16 [pfSense]
                                    

                                    This contains a notification for updated system patches but still nothing for the pfsense+ update.

                                    Using this command in cron-

                                    /usr/local/bin/php -q /root/pkg_check.php
                                    

                                    Not sure why pfsense+ update notifications are missing???

                                    Box: SG-4200

                                    dennypageD C 2 Replies Last reply Reply Quote 1
                                    • dennypageD
                                      dennypage @wgstarks
                                      last edited by

                                      @wgstarks said in Auto update check, checks for updates to base system + packages and sends email alerts:

                                      ?php

                                      This is missing the angle bracket. It should be:

                                      <?php
                                      
                                      wgstarksW 1 Reply Last reply Reply Quote 0
                                      • C
                                        chrcoluk @wgstarks
                                        last edited by chrcoluk

                                        @wgstarks If I use your code and run the php command it just echoes the contents of the script to the shell.

                                        The original script gets executed instead but has an escape_filter error.

                                        Ok < was missing at the start but still get the same error.

                                        <pre style="white-space: pre-wrap;">PHP ERROR: Type: 64, File: /home/syslog.inc, Line: 875, Message: Cannot redeclare escape_filter_regex() (previously declared in /home/util.inc:4327)</pre>
                                        

                                        Interesting looks like it is sensitive to its run path, moving from /home to /root fixes it.

                                        pfSense CE 2.7.2

                                        dennypageD 1 Reply Last reply Reply Quote 0
                                        • dennypageD
                                          dennypage @chrcoluk
                                          last edited by

                                          @chrcoluk said in Auto update check, checks for updates to base system + packages and sends email alerts:

                                          @wgstarks
                                          Ok < was missing at the start but still get the same error.

                                          <pre style="white-space: pre-wrap;">PHP ERROR: Type: 64, File: /home/syslog.inc, Line: 875, Message: Cannot redeclare escape_filter_regex() (previously declared in /home/util.inc:4327)</pre>
                                          

                                          Interesting looks like it is sensitive to its run path, moving from /home to /root fixes it.

                                          I suspect what it is sensitive to is that you have other files in /home (that should not be there). The include is searching the local directory before /etc/inc.

                                          C 1 Reply Last reply Reply Quote 1
                                          • wgstarksW
                                            wgstarks @dennypage
                                            last edited by

                                            @dennypage
                                            The actual file has the proper <?php. I likely missed it when I copy/pasted for the forum post.

                                            Box: SG-4200

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.