Business Process monitoring throws Unknowns after backend update

[Nayakum]

Describe the bug

Since updating parts of our test environment's backend last year, the Business Process monitoring is throwing Unknowns. This applies to services created for BP nodes; the BP module itself is working fine. The error is as follows:

Checking Business Process 'test2 failed: Icinga\Exception\ConfigurationError in /usr/share/php/Icinga/Web/Session/PhpSession.php:98 with message: Can't save session, path '/var/lib/php7' is not writable.

Access rights to files and directories were not changed as part of the backend update to our knowledge. Comparing the mentioned directory in production and test does not show any differences.

To Reproduce

Reproduction probably difficult from the outside. I can create a new BP monitoring service, which runs into Unknown immediately after deployment.

Expected behavior

The BP monitoring should not throw Unknowns unless an issue in the BP is present.

Screenshots

Your Environment

Include as many relevant details about the environment you experienced the problem in

• Icinga Web 2 version and modules (System - About):

• Icinga 2 version used (icinga2 --version): r2.13.6-1
• PHP version used (php --version): 7.4.33
• Server operating system and version: SLES15 SP3

Additional context

The productive and test environments differ in these regards:

Icinga Web 2 Version: 2.11 vs 2.13 icinga/icinga-php-library: 0.10.0 vs 0.10.1 monitoring: 2.11 vs 2.13 vspheredb: 1.4.0 vs 1.6.0

[Nayakum]

Update: After further testing, we found out that the issue is not connected to Icingaweb, but rather an Icinga core-issue. We receive the same message when running any check using the icingacli method:

Launching the run script /usr/share/icingaweb2/modules/cube/run.php for module cube failed with the following exception: Can't save session, path '/var/lib/php7' is not writable.

In case of the BPM check, this results in a stop in the check and the behaviour above. The icingacli-director check for example is working fine, even though it's also sending the exception. We recently opened an issue at Netways for this, as well.

[carraroj]

ref/NC/784619

[Nayakum]

We're now having this issue in our productive environment as well after installing the IcingaDB and IcingaDBweb. The problem is solved by giving write permissions to the folder for the owner group. This however was not needed before and does not seem to be the standard configuration.

[carraroj]

I can reproduce the failure in OS openSUSE 15.4 with newest version from icingaweb2-modules, i get the same errors with installed icingadb

icinga2 - The Icinga 2 network monitoring daemon (version: r2.13.7-1)
Icinga Web 2 Version | 2.11.4

# icingacli module list
MODULE         VERSION   STATE     DESCRIPTION
businessprocess 2.4.0     enabled   A Business Process viewer and modeler
cube           1.3.0     enabled   Cube for Icinga Web
director       1.10.2    enabled   Director - Config tool for Icinga 2
icingadb       1.0.2     enabled   Icinga DB Web
incubator      0.20.0    enabled   Incubator provides bleeding-edge libraries
monitoring     2.11.4    enabled   Icinga monitoring module

[carraroj]

I don't know if these apache2 errors are in involved in the failure, but i will add here:

[Mon Jun 26 13:31:47.035111 2023] [php:error] [pid 1551] [client 192.168.202.32:42412] PHP Fatal error:  Uncaught ErrorException: session_start(): open(/var/lib/php8/sess_6la3vamjo0upqou6hsgh4t86j7, O_RDWR) failed: Permission denied (13) in /usr/share/php/Icinga/Web/Session/Php72Session.php:32\nStack trace:\n#0 [internal function]: Icinga\\Application\\ApplicationBootstrap->Icinga\\Application\\{closure}()\n#1 /usr/share/php/Icinga/Web/Session/Php72Session.php(32): session_start()\n#2 /usr/share/php/Icinga/Web/Session/PhpSession.php(146): Icinga\\Web\\Session\\Php72Session->open()\n#3 /usr/share/php/Icinga/Web/Session/PhpSession.php(103): Icinga\\Web\\Session\\PhpSession->read()\n#4 /usr/share/php/Icinga/Web/Session/PhpSession.php(48): Icinga\\Web\\Session\\PhpSession->__construct()\n#5 /usr/share/php/Icinga/Web/Session.php(32): Icinga\\Web\\Session\\PhpSession::create()\n#6 /usr/share/php/Icinga/Application/Web.php(353): Icinga\\Web\\Session::create()\n#7 /usr/share/php/Icinga/Application/Web.php(90): Icinga\\Application\\Web->setupSession()\n#8 /usr/share/php/Icinga/Application/ApplicationBootstrap.php(416): Icinga\\Application\\Web->bootstrap()\n#9 /usr/share/php/Icinga/Application/webrouter.php(105): Icinga\\Application\\ApplicationBootstrap::start()\n#10 /usr/share/icingaweb2/public/index.php(4): require_once('...')\n#11 {main}\n  thrown in /usr/share/php/Icinga/Web/Session/Php72Session.php on line 32

[carraroj]

I have found the issue its the module monitoring if its activated with icingadb-web the command with the user icinga fails, workaround exec the command with user wwwrun this works.