22143 FIX omd backup: Fix corrupted Event Console history in the archive

Jira: CMK-37640
Caused-by: If049b3d4f934eaedf1ee32b8a39a5905ef472850
Change-Id: Ia7a04da81616c02fb358026dd4fe710db0b1076d

Author: SoloJacobs

.werks/22143.md

@@ -0,0 +1,27 @@
+[//]: # (werk v3)
+# omd backup: Fix corrupted Event Console history in the archive
+
+key        | value
+---------- | ---
+date       | 2026-08-12T09:22:25.650928+00:00
+version    | 2.5.0p12
+class      | fix
+edition    | community
+component  | omd
+level      | 2
+compatible | yes
+
+`omd backup` of a running site could produce an archive whose Event Console
+history database is corrupted. After restoring such an archive, entries of the
+event history could be missing or show up twice, or the Event Console could fail
+to read its history at all.
+
+The history database `var/mkeventd/history/history.sqlite` is archived through
+the sqlite backup API, which yields a complete database on its own. The
+write-ahead log and the shared memory file next to it were archived afterwards
+as ordinary files, so the archive held a snapshot plus a log belonging to a
+different instant, which was then replayed onto the snapshot on restore.
+
+These sidecar files are now excluded from the archive. This does not repair
+archives that were already taken. If you depend on the event history of such an
+archive, check it after restoring.

omd/packages/omd/omdlib/backup.py

@@ -197,6 +197,14 @@ def get_exclude_patterns(options: BackupExclusions) -> list[str]:
     excludes.append("*.mk.new*")
     excludes.append("var/log/.liveproxyd.state.new*")
 
+    # The Event Console history database is archived via the sqlite backup API
+    # (see _tar_add), which yields a complete database on its own. Its sidecar
+    # files are copied unsynchronised and would be replayed onto a snapshot taken
+    # at a different instant, silently losing or duplicating rows. The glob also
+    # covers the rollback journal.
+    excludes.append("var/mkeventd/history/history.sqlite-*")
+    excludes.append("var/mkeventd/history/history.sqlite.*")
+
     # exclude the "cache" / working directory for the Agent Bakery
     excludes.append("var/check_mk/agents/.files_cache/*")
 

tests/system/singlesite/omd/test_omd.py

@@ -178,6 +178,36 @@ def test_run_omd_backup_and_omd_restore(site: Site) -> None:
             restored_site.rm()
 
 
+def test_omd_backup_excludes_ec_history_sidecars(site: Site) -> None:
+    """Test that 'omd backup' does not archive the Event Console history sidecars."""
+    history_dir = "var/mkeventd/history"
+
+    def _wal_on_disk() -> bool:
+        site.live.query("GET eventconsolehistory\nLimit: 1\n")
+        return site.file_exists(f"{history_dir}/history.sqlite-wal")
+
+    # The Event Console opens its history before daemonizing, so the sidecars of that
+    # first connection are unlinked when the pre-fork process exits. Only a reload
+    # reopens the database from the daemon itself, and sqlite needs an access to
+    # materialize the files. Without a sidecar the assertions below prove nothing.
+    site.omd("reload", "mkeventd", check=True)
+    wait_until(_wal_on_disk, timeout=30, interval=1, condition_name="EC history WAL exists")
+
+    # Inside the site, because the site user writes the archive. 'tmp/*' is excluded
+    # from the backup, so the archive cannot end up inside itself.
+    backup_path = "tmp/backup_ec_history.tar.gz"
+    archive = site.path(backup_path).as_posix()
+    try:
+        site.omd("backup", archive, check=True)
+        members = site.run(["tar", "-tf", archive]).stdout.splitlines()
+    finally:
+        site.delete_file(backup_path)
+
+    assert f"{site.id}/{history_dir}/history.sqlite" in members
+    assert f"{site.id}/{history_dir}/history.sqlite-wal" not in members
+    assert f"{site.id}/{history_dir}/history.sqlite-shm" not in members
+
+
 def test_run_omd_backup_and_omd_restore_empty() -> None:
     """Test that restore works on empty site directory."""
     package = CMKPackageInfo(version_from_env(), edition_from_env())