Log message:
monit: Update to 6.0.0

pkgsrc changes:
- Enable for DragonflyBSD, according the changelog it was tested on
  DragonflyBSD 6.4 (NOTE: I have not tested it in pkgsrc though!)

Changes:
- New: The every statement can now reliably be used with minute
  precision. Like crontab, the every statement will run a service check
  only once per minute, regardless of poll-cycle time. This means that
  you can now use checks like this and be sure it runs only one time at
  the intended time:
    check program weekly_report with path /var/monit/weekly_report.sh
      every "15 8 * * 1"
      if status != 0 then alert
  This will run the above weekly_report.sh one time every Monday at 08:15
  (or as soon as possible after that time if the validation loop is
  delayed). Cron matching is asynchronous to the validation loop,
  ensuring checks run once even if validate takes longer than a minute to
  complete. This fixes the issue where checks with an every statement
  could be skipped entirely due to misalignment with poll cycle settings
  or validation loop delays.
- New: SSL/TLS: Add support for quantum-resistant cryptography: hybrid
  ML-KEM key exchange mechanisms with TLS 1.3. Monit must be linked with
  an SSL library that supports ML-KEM, such as OpenSSL 3.5.x or later,
  for this functionality to work.
- New: Added SHA256 checksum support. SHA256 can now be used in addition
  to MD5 and SHA1 for file integrity monitoring, SSL/TLS certificate
  verification, HTTP content validation, and MySQL RSA key verification.
  SHA256 provides stronger cryptographic security than MD5 and SHA1.
  Supported in the following statements:
    File checksum: if failed [sha256] checksum
    SSL certificate: certificate checksum <sha256-hash>
    MySQL RSA key: rsakey checksum [sha256] <sha256-hash>
    HTTP content: checksum <sha256-hash> (auto-detected from 64-character \ 
length)
  Example:
    check file myfile with path /path/to/file
      if failed sha256 checksum then alert
    check host example.com with address example.com
      if failed port 443 protocol https
         certificate checksum = \ 
"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      then alert
- New: The file checksum test now uses SHA256 by default, if no hash
  function is specified (it used to be MD5 by default).
- New: Issue #1132: Added support for swap monitoring: PAGEIN and
  PAGEOUT tests in the check system context. It allows one to monitor the
  system's swap activity and memory pressure. When the system requires
  more memory, it may begin swapping memory pages in and out of the swap
  device. The swap device's I/O is significantly slower than RAM access,
  making it an indicator of the system's memory pressure. A general rule
  of thumb for swapping activity is:
    0     pages/sec:           Healthy
    1-10  pages/sec:           Minor paging, usually acceptable
    >100  pages/sec sustained: Memory pressure, investigate
    >1000 pages/sec:           Severe thrashing, immediate action needed
  Example:
    if pageout > 50 per second for 20 cycles then alert
    if pageout > 100 per second for 10 cycles then alert
  Thanks to Lutz Mader for patch.
- New: Linux: Issue #1136, Issue #42: process memory usage report
  overcounts the shared library RSS. Monit prefers the PSS (Proportional
  Set Size) report instead of RSS (Resident Set Size) now. The PSS
  provides a more accurate measure by fairly dividing shared memory among
  processes. RSS can be misleading because it overcounts shared memory by
  adding the entire amount to each process that uses it. PSS gives a more
  realistic view of both a single process's contribution and the system's
  total memory footprint. Warning: Monit >= 6.0.0 may thus report
  significantly lower usage for both "memory" and "total \ 
memory" for
  processes.
- New: MacOS: Process memory usage report is in line with Activity
  Monitor now and shows the process' physical memory footprint instead of
  RSS. It excludes shared memory that's being used by multiple processes
  (to avoid double-counting).
- New: The security attribute test now supports regular expressions and
  negative match, which is useful, for example, in the SELinux context,
  where a container might consist of random MCS categories. Thanks to
  Christian Goettsche. Syntax:
    IF SECURITY ATTRIBUTE \ 
<"="|"!="|"=~"|"!=~"> \ 
<regex> THEN <action>
- New: The check program output in the monit status CLI was limited to
  200 characters. The limitation is removed and monit will display up to
  set limits { programOutput: <size> } characters now. (Default is 512
  bytes).
- New: Illumos build (tested on OmniOS r151054).
- New: DragonflyBSD build (tested on DragonflyBSD 6.4).
- Fixed: If a stale pidfile existed at Monit startup, Monit could fail
  to start. This was especially common in containerized environments like
  Docker after an ungraceful shutdown. The issue was resolved by
  improving the startup check that detects whether another Monit daemon
  is already running. Thanks to Lutz Mader for identifying the problem
  and providing an initial patch.
- Fixed: The result of executing the check program command with the
  every statement is evaluated immediately (in the next cycle).
  Previously, Monit would wait for a specified number of cycles or until
  the next cron pattern match before evaluating the program's result.
- Fixed: Issue #1141: When multiple check program statements were
  linked with depends on, but the parent test frequency was limited using
  the every statement, the child copied the parent's test schedule, even
  if the child did not have its own every statement.
- Fixed: Wakeup Monit from sleep on SIGUSR1 signal.
- Fixed: Issue #1129: When the Monit log was set to a device, such as
  set logfile /dev/stdout (e.g. inside a Docker container), Monit hangs
  when "View Monit logfile" is used in the Monit HTTP interface. Thanks
  to Lutz Mader for report and fix.
- Fixed: Issue #1137: Hostname error in log when fetching status in XML format
  from the Monit HTTP API via UNIX socket.
- Fixed: Issue #1142: File descriptor leak on Linux when /proc/PID/attr/current
  is not accessible due to AppArmor/SELinux restrictions.
- Fixed: Monit now provides more detailed error reporting when the hostname
  resolution fails. Previously, when testing a remote host using ping and the
  host did not resolve in DNS, Monit simply reported "ping failed".
- Fixed: The MongoDB protocol test did support only MongoDB < 5.1. The protocol
  test was updated to support the newer MongoDB ping style.
- Fixed: The service restart counter wasn't reset on reboot, which could cause
  the restart timeout to falsely trigger when monit had a long polling cycle and
  the machine was repeatedly rebooted immediately after the first monit cycle.
- Fixed: When the system had no file descriptors limit, monit displayed
  confusing statistics in status:
    filedescriptors    4896 [0.0% of 9223372036854775807 limit]
- Fixed: Issue #1144: Monit GUI drops the Strict-Transport-Security header when
  sending HTTP error responses.
- Fixed: SSL/TLS: Disable obsoleted CBC ciphers by default.
- Fixed: Issue #1146: SIP check did not handle IPv6 addresses correctly.
- Fixed: Issue #1147: The SMTP EHLO response was limited to 256 bytes. Raised
  the limit to 512 bytes to match RFC 5321 section 4.5.3.1.5.
- Fixed: When the service had an "existence" test that used the \ 
multiple-errors
  condition (for X cycles), and the service encountered an error, Monit
  displayed the status as "OK" even though there was no data (e.g., a
  non-existent process or file).
- Fixed: When the state of the service changed and the test had a
  multiple-errors condition (for X cycles), the cycles counter was not
  reinitialized properly, which could trigger another state change faster than
  the option settings specified.
- Fixed: Some tests share the same event type (e.g., the "resource \ 
event" is
  shared by CPU, memory, swap, and load average tests). When multiple errors
  occurred for the same event type, the last test may have reset the error, and
  the service would be reported as a false-positive OK.
- Fixed: The PostgreSQL protocol test could read past the response buffer when
  parsing an error message from the server if any error field was not properly
  NUL-terminated within the payload. A malicious or malformed PostgreSQL server
  could exploit this to crash Monit or to leak stack data into the logs. Thanks
  to Tristan Madani for finding the bug and sharing the details. Workaround for
  vulnerable Monit versions < 6.0.0: Replace the if failed port 5432 protocol
  pgsql then <action> protocol test with a generic TCP connection test: if
  failed port 5432 then <action>.
- Changed: The check program output change test now sets the level to warning
  (yellow), instead of error (red).
- Changed: MacOS: Monit now utilizes the 64-bit system API to retrieve system
  memory usage information. The support for 32-bit Macs is deprecated, as the
  last pure 32-bit Macs were released in 2006. Thanks to Lutz Mader.

Log message:
monit: Update to 5.35.2

Changes:
Version 5.35.2
Fixed: Monit may skip the sleep altogether and perform checks in a
tight loop when many "check program" tests are used in conjunction with
the short poll cycle.

Version 5.35.1
Fixed: Issue #1127: Monit may crash when "check program" is used.

Version 5.35.0
Fixed: Monit may hang on exit, if a program executed by "check program"
was pending while monit tried to quit (regression from Monit 5.34.1).
Fixed: Issue #484: The pidfile based process check may not work
properly on platforms that assign PID to threads (LWPs), such as Linux.
When the process with the given PID stopped, but the same PID was assigned to
the LWP, Monit reported the process as running (which is wrong) and
logged the following error:
 "failed to get service data" The service status displayed
the process as OK but showed no process statictics.
Fixed: When the pidfile was updated (e.g. process restarted), Monit was
still monitoring the previous PID. If the PID was reassigned to
different process or thread (LWP),
Monit wasn't able to detect that the process is not running.
Fixed: Issue #1115: Service checks may sporadicaly hang if the PID is
recycled by the system quickly, e.g. due to PID randomization
(regression from Monit 5.34.1).
Fixed: Issue #1121: The "set mailserver" timeout option allowed to only
increase the network timeout. Values lower then 30 seconds were
ignored.
Fixed: Issue #1122: Monit hangs with high CPU usage if the
"set daemon <seconds>" is set to >= 2148 seconds.
Fixed: Issue #1126: Monit with LibreSSL: The secure connection shutdown
may hog the CPU for up to connection timeout (5s by default).
Fixed: Monit HTTP interface didn't parse the password file (regression
from monit 5.34.4). Thanks to Francisco Javier Felix Belmonte.
Fixed: MacOS: When "check network" is used, but no network interfaces
are found, monit terminates with "AssertException: nbytes > 0  raised
in Mem_calloc"
Fixed: The loadavg test in the process check context didn't work. Error
like this was logged by monit each time the test was executed:
'myservice' error -- unknown resource ID: [5]
Fixed: MacOS + DragonflyBSD + FreeBSD + NetBSD + OpenBSD: If there are
no mounted filesystems and a "check filesystem" is used, monit would
terminate with
"AssertException: count > 0 raised in Mem_calloc"
Fixed: FreeBSD + OpenBSD + NetBSD: Detect presence of backtrace()
function during compilation (used in monit -vv mode to print backtrace)
Fixed: MacOS: Monit may stop handling signals (SIGCHLD for children,
SIGTERM to exit, SIGHUP for reload, SIGUSR1 for wakeup)
Fixed: If Monit detects syntax errors in the configuration file, log an
error message prior to exiting the program.
Fixed: Allow to stop Monit if it is in the middle of secure connection
with read/write retries.
New: Add the following headers to email alerts, to prevent
out-of-office autoresponders in Exchange, Outlook, Office365, Gmail:
 "X-Auto-Response-Suppress: All"
 "Precedence: Bulk"
New: When monit aborts (e.g. due to assert), print a backtrace.

Version 5.34.4
Fixed: If the Monit configuration file contains a string with
unbalanced escape sequences, Monit may crash upon startup.
Fixed: If the password in the "set mmonit" URL contains only binary
characters, syntax check passed (-t), but Monit aborts after start and
reports following error:
 AssertException: n >= 0
  raised in Str_ndup at src/util/Str.c:315
 Aborted
Fixed: If the "every <cron>" statement contained a syntax error, \ 
syntax
check passed (-t), but Monit aborts after start and reports following
error:
 AssertException: n < 5 && n >= 0
  raised in Time_incron at src/system/Time.c:1566
 Aborted
Fixed: If the timeout option value was set to 0, the syntax check was
successful (-t), but Monit aborts after starting and reports the
following error:
 AssertException: timeout > 0
  raised in Socket_create at src/net/socket.c:319
 Aborted
Fixed: The "set syslog" statement's "facility" option did \ 
not permit
the specification of the "log_user". Thanks to Lutz Mader for report.
Fixed: Double interpretation of format strings during RETHROW

Version 5.34.3
Fixed: If the ping statement did not explicitly specify an outgoing
address but a previous ping statement did, the same address was shared
by both statements.
Fixed: Monit may crash upon stopping if the ping statement is used in
conjunction with the address option.
Fixed: If a directory is set in the 'allow' option of the 'set httpd'
statement, instead of file or string, Monit hangs on start.

Version 5.34.2
Fixed: Network protocol test may sporadically fail with "Poll failed:
Interrupted system call" error.

Version 5.34.1
Fixed: The "check program" no longer keeps the zombie process between
cycles.

Version 5.34.0

New: Added the "timeout" option to the exec action. It can be set
either globally (in the "set limit" statement using the \ 
"execTimeout"
option) or locally (using the "timeout <number> seconds" in the exec
action). The default timeout is 0 (no limit), to keep the original
behaviour. Thanks to Lutz Mader.
New: Issue #1074: Added a hardlink test to file, directory and fifo
checks. Thanks to Lutz Mader. Example:
 check directory upload with path /data/upload
  if hardlink > 32000 then alert
New: Issue #1070: Added the system boot time and uptime to the XML
interface. Thanks to Lutz Mader.
New: Added support to add Monit to M/Monit hostgroup. Example:
 set mmonit
     https://monit:mypassword@mmonit.foo.bar:8443/collector
     with hostgroups [ Oslo, "Mail servers" ]
New: Add support for checking the output of a program for changes. This can be \ 
used to alert on changes of system
properties, e.g. 'ip route' or 'udisksctl status'. Thanks to Christian \ 
Goettsche. Example:
    check program myscript with path /usr/local/bin/myscript.sh
        if content changed then alert
        if content not changed then alert else ignore
New: Implemented 'ignore' functionality within the test success action, enabling \ 
the suppression of alerts when the
     check returns to a successful state. Thanks to Christian Goettsche.
New: Set the header X-Content-Type-Options to prevent MIME type
sniffing. Thanks to Christian Goettsche.
New: Added support for debugging TLS/SSL connections with Wireshark. It
is now possible to set the SSLKEYLOGFILE=<path> environment variable
when starting Monit, to log the master secret to a file, which can be
used by Wireshark in "Settings -> Protocols -> TLS ->
(Pre)-Master-Secret log filename".  Note: The SSLKEYLOGFILE
functionality is enabled only in the monit debug mode (when monit was
started with the -v option).
Fixed: Issue #1082: Wrong error message for the uptime test. Thanks to Lutz Mader.
Fixed: Disable SSL session renegotiation in the Monit HTTP interface (CVE-2011-1473).
Fixed: Monit reported wrong number of CPUs in the VMWare virtual host in Debian 12.x
Fixed: Issue #1086: The HTTP protocol test may return false error
"HTTP error: invalid chunk size" if the HTTP response contained header with
more then 511 bytes. We have increased the limit to 8192 bytes per
header and will report "response header exceeded maximum size" error if
the HTTP response contains longer header.
Fixed: When the monit ID is generated in first start and the system is
shut down before the file was stored to the filesystem, an empty
monitid file may be created. Thanks to Alexander Dahl for fix.
Fixed: The SSL connection can be sporadically interrupted.
Fixed: Issue #1101: Updated configuration examples for PAM in the Monit
manual. Thanks to Lutz Mader.
Fixed: The network test was failing on WSL (Windows subsystem for Linux).
Fixed: Make network interface speed statistics optional (monit used to
report link failure when statistics were not available) and do not
report/check if statistics are not available.

Log message:
*: remove Interix support

Log message:
*: remove incomplete BSD/OS support

As proposed on tech-pkg.

Log message:
monit: Install documentation under share/doc

Most packages uses share/doc (without any trailing "s"), be
consistent.

PKGREVISION++

Log message:
*: bump for openssl 3

Log message:
monit: Update to 5.33.0

Changes:
5.33.0
------
 - New: Added click-jacking protection headers to Monit HTTP GUI (the
   SAMEORIGIN iframe is allowed).
 - Fixed: Issue #1035: If the start, stop or restart program statement
   contains the equal sign, which is not followed by a space character,
   the configuration is not parsed correctly.
 - Fixed: Issue #1047: If the MariaDB server doesn't allow access to
   the host, from which Monit test is running, Monit reported: Invalid
   handshake packet sequence id -- not MySQL protocol.
 - Fixed: Add the missing responsetime option to the ping test.

Log message:
monit: Update to 5.32.0

Changes:
5.32.0
------
  * Fixed: Issue #1028: If the Monit statefile was removed, the monit start
    <service> action for services with onreboot nostart option started the
    service, but did not enable monitoring of said service. The same problem
    occurred if a new onreboot nostart service was added, even if the statefile
    did exist.
  * Fixed: Issue #1029: The generic protocol test truncated received data if
    the response contained zeros.
  * Fixed: PAM authentication: Users with a valid password for a disabled
    account could still login to Monit. Thanks to Youssef Rebahi-Gilbert.
  * Fixed: The Monit HTTP interface could be blocked by sending a request with
    an infinite stream of HTTP headers. Thanks to Youssef Rebahi-Gilbert for
    report.

5.31.0
------
  * New: Issue #1021: Add support for Linux OpenZFS 2.x I/O statistics.
  * New: Issue #555: Add support for FreeBSD ZFS I/O statistics for FreeBSD
    12.x or later.
  * Fixed: Issue #1025: If Monit 5.30.0 CLI action was executed for a
    non-existent service name, the error message was not reported properly.
    Thanks to Lutz Mader for fix.
  * Fixed: Issue #1026: If Monit reload was requested during the optional start
    delay interval, Monit still waited for the delay to pass and performed one
    test cycle with the old configuration, before the reload was performed.
    Monit will reload the configuration immediately now.

5.30.0
------
  * New: Add a read-only option to the set httpd statement. The option can be
    used on the TCP socket, the unix socket, or both. Example for setting the
    TCP socket in the read-only mode (for connections from other hosts) and the
    unix socket in the read-write mode (for local Monit CLI actions, like
    service restart, status, etc.):

    set httpd
        port 2812
            read-only
            allow 192.168.1.0/24
        unixsocket /run/monit.socket

    Thanks to Christian Goettsche for contributing this feature.
  * Changed: Issue #1011: The include statement was limited to 512 files,
    increase the limit to 1024 files.
  * Fixed: The disk read and write bytes didn't show up in M/Monit for Monit
    5.27.0 or later.
  * Fixed: Issue #998: Monit 5.29.0 may fail to compile on platforms without
    the monotonic clock support. Thanks to Lutz Mader.
  * Fixed: Issue #1002: 32-bit Linux machines with more then 4GB of RAM
    reported wrong system memory size and swap size values.
  * Fixed: Issue #1005: When the port statement was used with the generic
    protocol test and the target server returned zeros in response, Monit >=
    5.20.0 may crash.
  * Fixed: Issue #1009: When one executes an action via the Monit HTML GUI
    (uses a POST request), the Monit HTTP server will redirect the browser back
    to the base URL, so the browser won't perform the POST request again on an
    automatic page refresh, which is performed to poll for status changes.
  * Fixed: Issue #1015: The set httpd statement supports only one address
    option. Display warning if multiple address options are used.

5.29.0
------
  * New: Issue #715: The PostgreSQL protocol test has been improved and now
    supports authentication with username, password and database when testing
    connection. Example:

    if failed port 5432
        protocol pgsql username "username" password "12345" \ 
database "test"
    then alert

    Previous Monit versions used hardcoded credentials when testing connection
    to postgresql (user=root and database=root). This could trigger thousands
    of messages like this in the postgresql log:

    root@root FATAL:  password authentication failed for user "root"
    root@root DETAIL:  Role "root" does not exist.

    Note: Monit will continue to use the hardcoded credentials (for backward
    compatibility) unless username and password are set.
  * New: Issue #973: You can now test program output using a regular
    expression. Syntax:

    IF CONTENT [!]= <regex> THEN action

    Example:

    check program disk0_smart with path "/usr/sbin/nvme smart-log \ 
/dev/nvme0"
        if content != "critical_warning[ ]+: 0" then alert

  * New: Issue #974: Monit CLI: Added support for the -g (group) option to the
    report command. Example:

    monit -g database report

  * Fixed: Issue #991 (Monit 5.28.1 regression): MacOS: Monit didn't compile on
    MacOS 10.13 or older. Thanks to Lutz Mader.
  * Fixed: Issue #994 (Monit 5.28.1 regression): The check program statement
    with every did not work properly.
  * Fixed: Issue #995: Monit start delay was vulnerable to time jumps when
    Monit is waiting for the delay to pass. Thanks to Daniel Crowe.
  * Fixed: Issue #975: Monit CLI: Monit did not report a warning if -s, -p, -l,
    -g or -c command-line options were specified multiple times and silently
    used the last value only. Monit will generate a warning now.
  * Fixed: Issue #972: Monit GUI: The log view had no size limit when reading
    the Monit log file and could block the browser if the log file was large.
  * Fixed: Issue #955: If more than one every statement is used in a
    check-service context only the last value is (silently) used. We now report
    a warning in this case.

5.28.1
------
  * New: Issue #979: If filesystem mount flags changed, show both old and new
    value. Originally only the new value was reported.
  * Fixed: Issue #960: The memory usage may report wrong value if system memory
    size changed after Monit start. The problem was frequent on KVM/LXC
    containers where MemTotal is dynamicaly updated.
  * Fixed: Issue #965: Monit CLI: if a custom configuration file was used with
    the -c option, and the file cannot be read by Monit, an AssertException was
    thrown. Monit will report normal error instead of the exception now.
  * Fixed: Issue #966: Monit CLI: The service name pattern was changed to
    case-sensitive in Monit 5.28.0. Revert the behaviour back to
    case-insensitive.
  * Fixed: Issue #971: The LINK UP and LINK DOWN tests now support short form
    of the optional ELSE condition, in addition to the verbose ELSE IF
    <SUCCEEDED|FAILED> form.
  * Fixed: Issue #976: The space free test recovery always reported value in
    percent, regardless of the test setting. If the test uses absolute limit,
    Monit will report absolute space usage now.
  * Fixed: Issue #986: Services checks with custom schedule (the EVERY
    statement) did set the data collection timestamp even if the monitoring was
    skipped in the given cycle. The timestamp is now updated only when the
    check was performed.
  * Fixed: Issue #990: Monit built with libressl may crash during verification
    of the expired SSL certificate.
  * Fixed: Issue #968: Systemd and upstart templates: templates used to set the
    path to the configuration file in the sysconfdir, which is optionally set
    via the configure script during the compilation. The path wasn't fully
    expanded in the template though, so it was invalid. The template doesn't
    specify the explicit path now and lets Monit search for the configuration
    file in all supported locations (including the sysconfdir).
  * Changed: Issue #984: The permission check of the SSL PEM key file allows
    group read permissions now (originally Monit enforced that the file is
    readable only by the file owner).

5.28.0
------
  * Deprecated: Monit IF FAILED LINK test was renamed to IF LINK DOWN. The old
    syntax is deprecated, but still works for backward compatibility.
  * New: Added IF LINK UP network interface test, which allows to monitor
    network interface that is by default down, and trigger action, when the
    interface is enabled. Example:

    if link up then "/usr/bin/monit start backup"

    Notes: When link up test is used, the link errors tests are ignored, as
    these tests share the same event type and would reset the status. Also,
    mixing link up and link down in the same check network is not supported.
  * New: Monit can now watch offline TCP/UDP ports and perform action on
    successful connection. It can be used as a security check, e.g. if a
    service like mysql should not be publicly available, or to perform custom
    actions to initialize the service that depends on the one that was just
    started. Thanks to Christian Goettsche for patch. Example:

    if succeeded port 443 protocol https then exec "/bin/monit start \ 
myclient"
    if succeeded host example.org port 3306 protocol mysql then alert

  * New: Monit can watch unix sockets that doesn't exist or are offline and
    perform action on successful connection. Example:

    if succeeded unixsocket /var/run/mysql.sock protocol mysql then exec \ 
"/bin/myscript.sh initdb"

  * New: Monit can ping hosts that are supposed to be offline and perform
    action when they become available. Example:

    if succeeded ping then alert

  * New: Issue #915: Add support for sevice name regular expressions in monit
    CLI status, summary, start, stop, restart, unmonitor, monitor commands.
    Examples:

    monit status myservice  # exact match
    monit status "data.*"   # pattern which will match all services \ 
whos name contain "data" substring

  * New: Issue #718: Add support for response time monitoring to TCP/UDP ports,
    unix sockets and ping. Example for ping and port test:

    if failed ping responsetime < 50 ms then alert
    if failed port 443 protocol https and responsetime < 50 ms then alert
    if failed port 443 protocol https and responsetime < 50 ms then alert

  * Fixed: Issue #961: If a service depends on some other service, which is
    member of the same service group, the service group restart would restart
    the child service twice.
  * Fixed: Minor memory leak when uptime test is used an monit is reloaded.

5.27.2
------
  * Fixed: Issue #931. The "if does exist" test with unmonitor or stop \ 
action
    did not work properly
  * Fixed: Issue #937: If the filesystem check uses mountpoint instead of
    device and multiple devices are defined for the same filesystem with
    mismatch between /etc/mtab and device name in path, Monit reported error
    and disk activity was not reported.
  * Fixed: Issue #948. Cookie validation problem, Invalid CSRF Token, if the
    request was more then 1024 bytes. Increased request size to 8kB.
  * Fixed: Disk activity statistics if procfs fallback was used instead of
    sysfs
  * Fixed: LXC container: Monit could ignore the "start delay" option \ 
of the
    set daemon statement when the container was rebooted, but not the host (the
    LXC container's boot time is not virtualized and inherited from the host).
  * Changed: Monit in debug mode no longer logs open errors about procfs /proc/
    /io and /proc//fd if monit is not running as root. These errors are common
    as linux doesn't allow to read such files if the process belongs to a
    different user. These errors are now only logged in extra verbose mode (-vv
    option).

5.27.1
------
  * Fixed: Issue #932. Require that the program in a 'check program' statement
    exist on Monit startup.
  * Fixed: Issue #916: Linux: Monit procmatch failed to show all matching
    processes if a non-root user ran Monit. Thanks to Lutz Mader for fix.
  * Fixed: Linux: The CAP_SYS_RESOURCE capability was needed to be able to
    monitor filedescriptors usage of other processes if Monit was not started
    as root. Thanks to Christian Goettsche for report.
  * Fixed: Issue #920: On AIX, NetBSD, Solaris, Monit 5.27.0 logged "Cannot
    test filesdescriptors usage as the statistics is not available on this
    system" every cycle even if no filedescriptors test was used in Monit's
    configuration.
  * Fixed: Issue #926: Linux: Remove trailing white space from collected
    process name
  * Fixed: Issue #928: Fixed a race condition in Monit's HTTP interface on
    reload when SIGHUP were sent many times to the Monit process . Thanks to
    Andy Spitzer for patch.
  * Fixed: Improved cross-compile support. Thanks to Christian Goettsche and
    Helmut Grohne for patch.
  * Fixed: Monit could crash when sending heartbeat status to M/Monit.
  * Fixed: If SSL certificate verification failed and certificate valid days
    test was enabled, Monit could report the following false positive:
    certificate expiry in 0 days matches check limit
  * Changed: Use ISO 8601 format timestamp in log files

5.27.0
------
  * New: The SSL version: auto now defaults to TLSv1.2 and TLSv1.3 only. If you
    need to enable TLSv1.0 or TLSv1.1, you have to explicitly enable it via the
    SSL option, example:

    set ssl {
        version: tlsv11
    }

  * New: Support for MySQL TLS encryption. Example:

    if failed port 3306 protocol mysqls then alert

  * New: Issue #839: Support for MySQL 8.x default authentication method,
    caching_sha2_password. If unsecure (non-TLS) connection is used, it is also
    possible to verify the server's RSA key checksum to protect against
    man-in-the-middle attacks. Example:

    check host mymachine with address 127.0.0.1
        if failed
            port 3306
            protocol mysql
            username monit
            password mypassword123
            rsakey checksum 29e512c06275a1b3f4617f8cb9ca583d642386fe
        then alert

  * New: The username in the mysql protocol test was limited to 16 bytes, this
    limit was removed.
  * New: Linux: Support for monitoring a process's filedescriptor usage. Thanks
    to Marcel Baur and Lutz Mader. Example:

    check process myproc with pidfile /var/run/myproc.pid
        if filedescriptors >= 90% then alert
        if filedescriptors >= 99% then restart
        if total filedescriptors > 5000 then alert

  * New: Linux, OpenBSD, FreeBSD, DragonflyBSD, MacOS: Added support for
    monitoring of system-wide filedescriptors usage. Example:

    check system $HOST
        if filedescriptors >= 90% then alert

  * New: You can now set a list of allowed TLS protocols (originally only one
    was allowed). Also added an option to exclude protocols (put - in front of
    the protocol name to disable it). Exclude list example:

     set ssl {
        version: auto -sslv2 -sslv3 -tlsv1 -tlsv11
     }

  * New: Optionally split certificate chain and key for the Monit HTTPS
    interface. Thanks to Lutz Mader for patch. (The original pemfile with all
    certificates in one pem file is still supported). Example:

    set httpd
        port 2812
        with ssl {
            pemchain: /etc/ssl/certs/monit.chain.pem
            pemkey: /etc/ssl/certs/monit.key.pem
        }
        allow myuser:mypassword

  * New: Linux: Enable monitoring of per-process disk read and write I/O
    operations. Example:

    check process foobar matching "myprocess"
        if disk read activity > 500 operations/s then alert
        if disk write activity > 500 operations/s then alert

  * New: Linux: Added generic per-process I/O activity monitoring. Example:

    if read activity > 1 mb/s then alert
    if write activity > 1 mb/s then alert

  * New: Issue #889: Linux: monitor detailed CPU statistics for nice, hardirq,
    softirq, steal, guest, guestnice. The statistics for nice was originally
    included in the cpu (user) statistics, but it now has its own counter.
  * New: FreeBSD, OpenBSD, NetBSD, DragonflyBSD MacOS: Added CPU nice and
    interrupt usage statistics.
  * New: Issue #877: Linux: Added support for VxFS filesystem statistics.
    Thanks to Lutz Mader for patch.
  * New: Issue #894: Added year to the timestamp when monit logs to its own log
    file.
  * New: Issue #908: Add STARTTLS support to the IMAPS protocol test on port
    143. Example:

    if failed port 143 protocol imaps then alert

  * Fixed: Issue #519: Monit could crash if a file check with restart on
    content match was used and this file had dependant services.
  * Fixed: Issue #867: If Monit was linked with musl libc, it could crash when
    executing programs. Thanks to Rich Felker for report.
  * Fixed: Monit incorrectly added CPU wait% to system CPU usage (the CPU is
    idle when it's in the wait state, waiting for the I/O to complete).
  * Fixed: The per-process I/O statistics on Linux, AIX, DragonflyBSD, NetBSD
    and Solaris always displayed 0 activity.
  * Fixed: Issue #843: Linux: Monit reported wrong memory usage in LXC
    container if the ZFS filesystem was used. Monit now use MemAvailable on
    Linux when calculating memory usage for more accurate statistics. Thanks to
    Joe LeVeque for patch.
  * Fixed: Issue #831: The HTTP protocol test returned unknown transfer
    encoding HTTP error if either the content or checksum test was used and the
    HTTP server didn't set the Content-Length header nor used chunked transfer
    encoding.
  * Fixed: Issue #880: If Monit was linked with AddresSanitizer, it could crash
    when it generates an MD5 hash. Thanks to Lutz Mader for patch.
  * Fixed: Issue #879: The HTML interface didn't escape strings that are part
    of Monit's configuration file. Thanks to Hanno Boeck for report.
  * Fixed: Issue #872: Monit's procmatch table can now display pids with up to
    8 digits. Previously, pids where truncated after 5 digist.
  * Fixed: Issue #891: The repeat option to an action was limited to 256
    cycles.
  * Fixed: Issue #851: Linux and AIX: The length of the string that describes
    the process name and its arguments was limited to 4kB, so monit procmatch
    might not find the process if the string was longer and unique after 4Kb.
    This limit has been removed on Linux and raised on AIX to 8kB.
  * Fixed: Issue #840: Network check: superfluous alerts if link is down.
    Thanks to Lonnie Abelbeck.
  * Fixed: MacOS: Only the first 16 characters of the process name was
    displayed for privileged processes, so the pattern based process check and
    Monit's procmatch could miss some processes.
  * Fixed: Issue #886: Monit's command-line options are now position
    independent.
  * Fixed: If Monit is linked with AddresSanitizer and a custom configuration
    file was passed via the -c option, monit could crash.
  * Fixed: MQTT protocol test.
  * Fixed: Issue #907: The onreboot nostart had no effect when a service was
    newly added to Monit's configuration or the statefile was removed.
  * Fixed: The PostgreSQL test was flapping with the following error if
    connection via unix socket was used: PGSQL: connection terminator write
    error -- Broken pipe
  * Plus many more internal fixes and improvements