@@ -52,6 +52,7 @@ Monitoring Plugins:
 * procs: add `--top N` to list the top N processes by CPU time and memory usage
 * procs: add `--lengthy` for extended `--top` table output
 * procs: add `--warning-cpu-percent` / `--critical-cpu-percent` for aggregated CPU usage of filtered processes
+* redfish-system: checks overall system health (processors, BIOS, power state, indicator LED, hostname, SKU, serial number) reported by a Redfish-compatible server, previously bundled into `redfish-drives` ([#652](https://github.com/Linuxfabrik/monitoring-plugins/issues/652))
 * scanrootkit: add 41 signatures for modern Linux rootkits, backdoors and implants (BPFDoor, Drovorub, Ebury, FontOnLake, Kaiji, Kobalos, perfctl, PUMAKIT, Reptile, Symbiote, Winnti for Linux, and more)
 * scanrootkit: findings now show the year the rootkit was first publicly disclosed when known
 * sensors-temperatures: add `--ignore` to filter sensors by regex ([#965](https://github.com/Linuxfabrik/monitoring-plugins/issues/965))
@@ -75,6 +76,11 @@ Assets:
 Build, CI/CD:
 
 * Bump pinned `linuxfabrik-lib` dependency from 3.0.0 to 3.2.0
+* GRAFANA: expanded guide. Documents the asset layout (per-plugin YAML, shared folder, default and Icinga dashboards), keeps the pinned Grizzly version at v0.2.0 (dashboards have not been validated against later releases), updates the Service Account navigation path to current Grafana, and adds an outlook section on the planned migration to `grafanactl` (tracked in [#1062](https://github.com/Linuxfabrik/monitoring-plugins/issues/1062))
+* PLUGINS-KEYCLOAK, PLUGINS-MYSQL, PLUGINS-ROCKETCHAT, PLUGINS-WILDFLY: rewritten with a unified structure (Plugins in this group, Authentication, Common parameters, Service Sets in the Icinga Director Basket). Keycloak corrects the role terminology (`query-groups` is a client role of the `master-realm` client, not a realm role of `master`; verified against Keycloak 26.6) and reflects the modern Admin Console navigation. Rocket.Chat now separates the Enterprise Edition and Community Edition paths (custom roles are EE only)
+* ICINGA: rewritten around the full-basket workflow. Adds sections on what the basket ships (Host/Service Templates, Service Sets, Time Periods, Notifications, Data Lists, Datafields), tag-based service assignment, upstream-vs-fork positioning, onboarding a host, upgrade-with-`basket-compare`, and troubleshooting (PHP/MySQL size limits, UUID conflicts, non-default master zone). Contributor-facing `build-basket` details remain in CONTRIBUTING.md
+* README: split the FAQ section into FAQ (concepts, design decisions, capability questions) and Troubleshooting (runtime errors); both lists sorted alphabetically. New Troubleshooting entry for plugins exiting UNKNOWN with sudo errors that points at the sudoers drop-in
+* INSTALL: rewritten as a single source of truth with a per-distro TOC (Debian, RHEL, SLE, Ubuntu), Linux before Windows, recommended paths first. Package-manager, Ansible, source tarball, Git, Windows MSI, Windows ZIP and Windows-from-source paths are now all documented on one page. `repo.linuxfabrik.ch` and `download.linuxfabrik.ch` link to the docs site instead of duplicating the commands
 * Windows MSI no longer depends on an installed Icinga2 agent (install path unchanged: `ProgramFiles64Folder/ICINGA2/sbin/linuxfabrik`)
 
 
@@ -172,6 +178,7 @@ Monitoring Plugins:
 * notify-host-mail, notify-service-mail: Icinga logo renders inline again on hosts with long FQDNs ([#790](https://github.com/Linuxfabrik/monitoring-plugins/issues/790))
 * ntp-\*: prevent `TypeError` when comparing int and str
 * podman-stats: precise numeric values; aggregate perfdata includes block and network I/O totals
+* redfish-drives: a system-level warning unrelated to storage (such as an inlet temperature threshold) no longer flips the check to WARN while all drives are healthy. The system-level health is covered by `redfish-system` instead ([#652](https://github.com/Linuxfabrik/monitoring-plugins/issues/652))
 * rocketchat-stats: crash when reporting the user count
 * scanrootkit: a single malformed signature file no longer crashes the whole check
 * scanrootkit: directory-only rootkit signatures (e.g. KBeast `/usr/_h4x_`, Kaiji `/usr/bin/lib`) are now actually evaluated
 
@@ -3,21 +3,23 @@
 
 ## Overview
 
-Checks the state of all physical drives and storage media in a Redfish-compatible server via the Redfish API. Iterates over the Systems collection, fetches storage controllers and their attached drives, and reports health status, media type, protocol, capacity, and predicted media life left.
+Checks the state of all physical drives and their storage controllers in a Redfish-compatible server via the Redfish API. Iterates over the Systems collection, fetches storage controllers and their attached drives, and reports health status, media type, protocol, capacity, and predicted media life left.
 
 **Important Notes:**
 
 * Tested on DELL iDRAC and DMTF Simulator
 * A check takes up to 10 seconds. Increasing runtime timeout to 30 seconds is recommended.
 * This check runs with both HTTP and HTTPS. It uses GET requests only.
 * No additional Python Redfish modules need to be installed.
+* System-level health (processors, BIOS, power, temperature, indicator LED, etc.) is deliberately not aggregated into the plugin state, so that a system-level warning unrelated to storage (such as an inlet temperature threshold) cannot mask or flip the drive status. Use `redfish-system` for system-level health monitoring.
 
 **Data Collection:**
 
 * Queries `/redfish/v1/Systems` to enumerate system members
 * For each member, queries the Storage collection and iterates over all storage controllers and attached drives
 * Uses HTTP Basic authentication if `--username` and `--password` are provided
 * Only evaluates drives and controllers in "Enabled" or "Quiesced" state
+* Aggregates only drive health and storage-controller health into the plugin state. The member identification line (manufacturer, model, hostname, SKU, serial number) is shown as context without a status label.
 
 
 ## Fact Sheet
@@ -39,9 +41,12 @@ usage: redfish-drives [-h] [-V] [--always-ok] [--insecure] [--no-proxy]
                       [--password PASSWORD] [--timeout TIMEOUT] [--url URL]
                       [--username USERNAME]
 
-Checks the state of all physical drives and storage media in a Redfish-
-compatible server via the Redfish API. Alerts when any drive reports a
-degraded or failed state.
+Checks the state of all physical drives and their storage controllers in a
+Redfish-compatible server via the Redfish API. Alerts when any drive or
+storage controller reports a degraded or failed state. System-level health
+(processors, BIOS, power, temperature, indicator LED, etc.) is deliberately
+ignored by this check so that a system warning unrelated to storage does not
+mask the drive status; use `redfish-system` for that.
 
 options:
   -h, --help           show this help message and exit
@@ -67,7 +72,7 @@ Output:
 ```text
 Everything is ok, checked storage on 1 member.
 
-Member: Dell Inc. PowerEdge R750, Processors: 2x Intel(R) Xeon(R) Gold 6354 CPU @ 3.00GHz (72 logical), BIOS: 1.1.3, Power: On, LED: Lit, SKU: ABCDEFG, SerNo: 1234567890ABCDE
+Member: Dell Inc. PowerEdge R750, HostName: web483, SKU: ABCDEFG, SerNo: 1234567890ABCDE
 
 Disk                ! Type ! Proto ! Manufacturer ! Model         ! SerialNumber ! Size     ! LifeLeft % ! State 
 --------------------+------+-------+--------------+---------------+--------------+----------+------------+-------
@@ -88,11 +93,12 @@ CPU.1             ! CPU.1                                                   ! CP
 
 ## States
 
-* OK if all drives and controllers are healthy.
+* OK if all drives and storage controllers are healthy.
 * WARN if an enabled drive's health or health rollup state is "Warning".
 * WARN if an enabled controller's health or health rollup state is "Warning".
 * CRIT if an enabled drive's health or health rollup state is "Critical".
 * CRIT if an enabled controller's health or health rollup state is "Critical".
+* System-level health is NOT considered. Use `redfish-system` for that.
 * `--always-ok` suppresses all alerts and always returns OK.
 
 
 
@@ -104,7 +104,7 @@
                 "tpl-service-generic"
             ],
             "max_check_attempts": 5,
-            "notes": "Checks the state of all physical drives and storage media in a Redfish-compatible server via the Redfish API. Alerts when any drive reports a degraded or failed state.",
+            "notes": "Checks the state of all physical drives and their storage controllers in a Redfish-compatible server via the Redfish API. Alerts when any drive or storage controller reports a degraded or failed state. System-level health (processors, BIOS, power, temperature, indicator LED, etc.) is deliberately ignored by this check so that a system warning unrelated to storage does not mask the drive status; use `redfish-system` for that.",
             "notes_url": "https://linuxfabrik.github.io/monitoring-plugins/check-plugins/redfish-drives/",
             "object_name": "tpl-service-redfish-drives",
             "object_type": "template",
 
@@ -22,10 +22,13 @@ import lib.url
 from lib.globals import STATE_CRIT, STATE_OK, STATE_UNKNOWN, STATE_WARN
 
 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026040801'
+__version__ = '2026042301'
 
-DESCRIPTION = """Checks the state of all physical drives and storage media in a Redfish-compatible
-server via the Redfish API. Alerts when any drive reports a degraded or failed state."""
+DESCRIPTION = """Checks the state of all physical drives and their storage controllers in a
+Redfish-compatible server via the Redfish API. Alerts when any drive or storage controller
+reports a degraded or failed state. System-level health (processors, BIOS, power, temperature,
+indicator LED, etc.) is deliberately ignored by this check so that a system warning unrelated
+to storage does not mask the drive status; use `redfish-system` for that."""
 
 DEFAULT_INSECURE = True
 DEFAULT_NO_PROXY = False
@@ -102,24 +105,21 @@ def parse_args():
 def main():
     """The main function. This is where the magic happens."""
 
-    # parse the command line, exit with UNKNOWN if it fails
+    # parse the command line
     try:
         args = parse_args()
     except SystemExit:
         sys.exit(STATE_UNKNOWN)
 
+    # fetch data
     base_url = args.URL
     if not args.URL.startswith('http'):
         lib.base.cu('--url parameter has to start with "http://" or https://".')
-
-    # Authorization (if needed)
-    header = {}
-    header['Accept'] = 'application/json'
+    header = {'Accept': 'application/json'}
     if args.USERNAME and args.PASSWORD:
         auth = f'{args.USERNAME}:{args.PASSWORD}'
         encoded_auth = lib.txt.to_text(base64.b64encode(lib.txt.to_bytes(auth)))
         header['Authorization'] = f'Basic {encoded_auth}'
-
     # "/redfish/v1/Systems"
     url = f'{base_url}/redfish/v1/Systems'
     result = lib.base.coe(
@@ -143,9 +143,11 @@ def main():
     msg = ''
     state = STATE_OK
     perfdata = ''
-
     member_count = 0
-    # fetch and analyze data by following the "Members" found
+
+    # analyze data: follow each "Member" link, aggregate drive and
+    # storage-controller health into `state`. System-level health is
+    # deliberately not aggregated (see `redfish-system` for that).
     for member in result.get('Members', []):
         # "/redfish/v1/Systems/437XR1138R2"
         url = f'{base_url}{member["@odata.id"]}'
@@ -162,34 +164,19 @@ def main():
         if systems['Status_State'] not in ['Enabled', 'Quiesced']:
             continue
         member_count += 1
-        systems_state = lib.redfish.get_state(systems)
-        state = lib.base.get_worst(state, systems_state)
 
-
-        # build the message
+        # build the message: only identify the member (manufacturer, model,
+        # hostname, SKU, serial number). System-level health is intentionally
+        # not aggregated here and not labelled with a state; use
+        # `redfish-system` for that.
         msg += 'Member:'
         msg += f' {systems["Manufacturer"]}' if systems['Manufacturer'] else ''
         msg += f' {systems["Model"]}' if systems['Model'] else ''
         msg += ', '
         msg += f'HostName: {systems["HostName"]}, ' if systems['HostName'] else ''
-        msg += f'Processors: {systems["ProcessorSummary_Count"]}x'
-        msg += (
-            f' {systems["ProcessorSummary_Model"]}'
-            if systems['ProcessorSummary_Model']
-            else ''
-        )
-        msg += (
-            f' ({systems["ProcessorSummary_LogicalProcessorCount"]} logical)'
-            if systems['ProcessorSummary_LogicalProcessorCount']
-            else ''
-        )
-        msg += ', '
-        msg += f'BIOS: {systems["BiosVersion"]}, '
-        msg += f'Power: {systems["PowerState"]}, ' if systems['PowerState'] else ''
-        msg += f'LED: {systems["IndicatorLED"]}, ' if systems['IndicatorLED'] else ''
         msg += f'SKU: {systems["SKU"]}, ' if systems['SKU'] else ''
         msg += f'SerNo: {systems["SerialNumber"]}, ' if systems['SerialNumber'] else ''
-        msg = msg[:-2] + lib.base.state2str(systems_state, prefix=' ')
+        msg = msg[:-2]
 
         # get all available storage links for the member
         if not systems['Storage_@odata.id']:
@@ -289,6 +276,7 @@ def main():
 
         msg += '\n\n'
 
+    # build the message
     members = lib.txt.pluralize('member', member_count)
     if state == STATE_CRIT:
         msg = (
 
@@ -0,0 +1,92 @@
+# Check redfish-system
+
+## Overview
+
+Checks the overall system health reported by a Redfish-compatible server via the Redfish API. Iterates over the Systems collection and reports each member's identification (manufacturer, model, hostname, SKU, serial number), its compute summary (processors, BIOS version, power state, indicator LED) and its rolled-up health status.
+
+**Important Notes:**
+
+* Tested on DELL iDRAC and DMTF Simulator
+* A check takes up to 10 seconds. Increasing runtime timeout to 30 seconds is recommended.
+* This check runs with both HTTP and HTTPS. It uses GET requests only.
+* No additional Python Redfish modules need to be installed.
+* This check reports system-level health only. For drive and storage-controller monitoring use `redfish-drives`.
+
+**Data Collection:**
+
+* Queries `/redfish/v1/Systems` to enumerate system members
+* For each member in "Enabled" or "Quiesced" state, reads the `Status` block (including `HealthRollup`) and the compute summary
+* Uses HTTP Basic authentication if `--username` and `--password` are provided
+
+
+## Fact Sheet
+
+| Fact | Value |
+|----|-----|
+| Check Plugin Download                 | <https://github.com/Linuxfabrik/monitoring-plugins/tree/main/check-plugins/redfish-system> |
+| Nagios/Icinga Check Name              | `check_redfish_system` |
+| Check Interval Recommendation         | Every 5 minutes |
+| Can be called without parameters      | Yes |
+| Runs on                               | Cross-platform |
+| Compiled for Windows                  | No |
+
+
+## Help
+
+```text
+usage: redfish-system [-h] [-V] [--always-ok] [--insecure] [--no-proxy]
+                      [--password PASSWORD] [--timeout TIMEOUT] [--url URL]
+                      [--username USERNAME]
+
+Checks the overall system health reported by a Redfish-compatible server via
+the Redfish API. Reports every enabled system member with its identification
+(manufacturer, model, hostname, SKU, serial number), compute summary
+(processors, BIOS version, power state, indicator LED) and rolled-up health
+status, and alerts whenever any system's status leaves `OK`. Use `redfish-
+drives` for drive- and storage-controller-specific monitoring.
+
+options:
+  -h, --help           show this help message and exit
+  -V, --version        show program's version number and exit
+  --always-ok          Always returns OK.
+  --insecure           This option explicitly allows insecure SSL connections.
+  --no-proxy           Do not use a proxy.
+  --password PASSWORD  Redfish API password.
+  --timeout TIMEOUT    Network timeout in seconds. Default: 8 (seconds)
+  --url URL            Redfish API URL. Default: https://localhost:5000
+  --username USERNAME  Redfish API username.
+```
+
+
+## Usage Examples
+
+```bash
+./redfish-system --url https://bmc --username redfish-monitoring --password 'linuxfabrik'
+```
+
+Output:
+
+```text
+Checked system health on 1 member. There are warnings.
+
+Member: Dell Inc. PowerEdge R750, HostName: web483, Processors: 2x Intel(R) Xeon(R) Gold 6354 CPU @ 3.00GHz (72 logical), BIOS: 1.1.3, Power: On, LED: Lit, SKU: ABCDEFG, SerNo: 1234567890ABCDE [WARNING]
+```
+
+
+## States
+
+* OK if every enabled system member reports `Status.Health` (or `Status.HealthRollup`) as "OK".
+* WARN if any enabled system member reports `Status.Health` (or `Status.HealthRollup`) as "Warning".
+* CRIT if any enabled system member reports `Status.Health` (or `Status.HealthRollup`) as "Critical".
+* `--always-ok` suppresses all alerts and always returns OK.
+
+
+## Perfdata / Metrics
+
+There is no perfdata.
+
+
+## Credits, License
+
+* Authors: [Linuxfabrik GmbH, Zurich](https://www.linuxfabrik.ch)
+* License: The Unlicense, see [LICENSE file](https://unlicense.org/).