implemented check for available updates for held packages

README.md

@@ -19,6 +19,7 @@ a [checkmk server](https://checkmk.com/) reachable from the machine running ansi
 
 In the role we have included some (partialy debian specific) check plugins (`check_mk_local_plugins`):
   * `check_apt-update-success` : check if the last apt update process was successful and not too long ago
+  * `check_apt_updates_for_packages_on_hold` : check if there are updates available for packages set on hold
   * `check_reboot` : check if a reboot is required after a apt update
   * `check_keepalived` : check the status of keepalive (global an per vrrp instance)
   * `check_samba_repl`: check samba DC replication status

defaults/main.yml

@@ -101,6 +101,7 @@ check_mk_plugins_remove: {}
 # check_mk_local_plugins:
 #   all:
 #     - check_apt-update-success
+#     - check_apt_updates_for_packages_on_hold
 #     - check_reboot
 #     - check_keepalived
 #     - check_samba_repl

files/check_apt_updates_for_packages_on_hold

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+STATUS="OK"
+declare -i RET=0
+
+M=$(apt-mark showhold)
+M=${M//$'\n'/ }
+
+if [ -z "$M" ]; then
+	MSG="no packages on hold found"
+else
+	O=$(apt list -q  --upgradable $M 2>/dev/null | sed '1d')
+	O=${O//$'\n'/; }
+	if [ -n "$O" ]; then
+		STATUS="WARNING"
+		RET=1
+		MSG="$O"
+	else
+		MSG="$M"
+	fi
+fi
+
+echo "$RET UPDATES_FOR_HELD_PACKAGES - $STATUS - $MSG"