check_nrpe - [0-9] argument not working

[lexisnexis]

Support,
I am trying to call a check_log custom script via NRPE, but when I pass in [0-9] through the arguments. I am getting a header underflow error. How do I pass in the [0-9] argument when the command is getting called.

I don't have access to the remote NRPE configuration, so I can't make changes to the current nrpe.cfg commands.

NRPE Plugin for Nagios
Version: 3.2.1

Command:
command[mon_check_log]=/usr/lib64/nagios/plugins/check_log.pl $ARG1$


/usr/local/nagios/libexec/check_nrpe -H <server> -c mon_check_log -a '-l webxml_access_log -z /tmp -t csaa -p Apr.2021 -s "csaa.+Service.[0-9]" -r -m 0:99999999999 -c 1'
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).



/usr/local/nagios/libexec/check_nrpe -H <server> -c mon_check_log -a '-l webxml_access_log -z /tmp -t csaa -p Apr.2021 -s "csaa.+Service." -r -m 0:99999999999 -c 1'
Exceeded Critical Threshold of 1 - csaa - Errors Found: 167
- - [27/Apr/2021:23:56:12 -0400] "POST /csaa HTTP/1.1" 200 46642 "Service 963473 "

- - [27/Apr/2021:23:56:49 -0400] "POST /csaa HTTP/1.1" 200 10158 "Service 628759 "

- - [27/Apr/2021:23:56:51 -0400] "POST /csaa HTTP/1.1" 200 39265 "Service 1162876 "

- - [27/Apr/2021:23:57:07 -0400] "POST /csaa HTTP/1.1" 200 9281 "Service 655711 "

- - [28/Apr/2021:00:03:05 -0400] "POST /csaa HTTP/1.1" 200 51898 "Service 1562962 "

- - [28/Apr/2021:00:04:53 -0400] "POST /csaa HTTP/1.1" 200 11328 "Service 1759416 "

- - [28/Apr/2021:00:05:19 -0400] "POST /csaa HTTP/1.1" 200 32838 "Service 982616 "

- - [28/Apr/2021:00:06:27 -0400] "POST /csaa HTTP/1.1" 200 11270 "Service 1722971 "

- - [28/Apr/2021:00:07:16 -0400] "POST /csaa HTTP/1.1" 200 10873 "Service 1646339 "

- - [28/Apr/2021:00:08:42 -0400] "POST /csaa HTTP/1.1

[vtrac]

Hi,
Hope you are having a good day.

First, can you please verify that you are able to run the command manually on the remote host .... like:

Code: Select all

/usr/lib64/nagios/plugins/check_log.pl -l webxml_access_log -z "/tmp" -t "csaa" -p "Apr.2021" -s "csaa.+Service.[0-9]" -r -m "0:99999999999" -c 1

Please run the above command and post the output here.

As to the check_nrpe command, could you try putting escape "\" before those special chars:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H <server> -c mon_check_log -a '-l webxml_access_log -z "/tmp" -t csaa -p "Apr.2021" -s "csaa.\+Service.\[0-9\]" -r -m "0:99999999999" -c 1'

Best Regards,
Vinh

[lexisnexis]

As I mentioned before, I don't have access to the remote machine. So I can't login and run the command directly. The problem appears to be check_nrpe and how it handles special characters. Which is why I am asking how do I send [0-9] over as an argument?

I did get a snippet of the log and tested it local, which does work.

./check_log.pl -l /ap/webxml/logs/webxml_access_log -z /tmp -t csaa -p Apr.2021 -s "csaa.+Service.[0-9]" -r -m 0:99999999999 -c 1
Exceeded Critical Threshold of 1 - csaa - Errors Found: 4
- - [29/Apr/2021:08:04:39 -0400] "POST /csaa HTTP/1.1" 200 1909 "Service 1435402"

- - [29/Apr/2021:08:14:12 -0400] "POST /csaa HTTP/1.1" 200 25111 "Service 1824395"

- - [29/Apr/2021:08:50:02 -0400] "POST /csaa HTTP/1.1" 200 4986 "Service 1448636 "

- - [29/Apr/2021:09:22:30 -0400] "POST /csaa HTTP/1.1" 200 6649 "Service 267551"
| errors_found=4;


/usr/local/nagios/libexec/check_nrpe -H <server> -c mon_check_log -a '-l /ap/webxml/logs/webxml_access_log -z /tmp -t csaa -p Apr.2021 -s "csaa.\+Service.\[0-9\]" -r -m 0:99999999999 -c 1'
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).

[vtrac]

Hi,
Please share / post your "check_log.pl" script so I can test it.


Best Regards,
Vinh

[lexisnexis]

Below is the script

Code: Select all

#!/usr/bin/env perl

# Modules
use strict;
use warnings;
use Cwd qw(abs_path);
#use Data::Dumper;
use Getopt::Long;

# General Variables
my @missing_tools = ();
my $script_path = substr(abs_path($0), 0, rindex(abs_path($0), '/'));
my $exit_code = 0;
my $msg = "OK";

# Log Variables
my @require_tools = ('tail');
my @error_msg = ();
my $found_counter = 0;
my @offset = 0;
my $hide_errors = 0;

# User Variables
my $tag = "";
my $LOGFILE = "";
my @parse_by = ();
my @search_for = ();
my $reset_timer = "999999999999:999999999999";
my $reset_flag = 0;
my $tag_path = $script_path;
my $debug = 0;
my $help = 0;
my $rev_flag = 0;
my $warn = 999999999;
my $crit = 999999999;

# Parse Variables
my $line = "";
my @parsed_data = ();
my $parse_index = 0;
my $cur_counter = 0;
my $use_data = "";

GetOptions (
        "d" => \$debug,
        "h" => \$help,
        "o" => sub { $rev_flag++ },
        "l=s" => \$LOGFILE,
        "p:s" => \@parse_by,
        "s:s" => \@search_for,
        "t=s" => \$tag,
        "z:s" => \$tag_path,
        "m:s" => \$reset_timer,
        "r" => \$reset_flag,
        "n" => \$hide_errors,
        "w:i" => \$warn,
        "c:i" => \$crit
);

if($help > 0) {
  usage();
}

# User Input Verify
if($LOGFILE eq "" || $tag eq "") {
  print "Missing Required Options\n";
  usage();
}

# Surpress Error Messages
if ($debug == 0) {
  open STDERR, '>/dev/null';
}

# Verify require tools are availble
@missing_tools = verifyTools(\@require_tools);
if (scalar(@missing_tools) > 0) {
  print "Missing Required Tool: " . join(',', @missing_tools) . "\n";
  exit(3);
}

my $offset_log = "${tag_path}/${tag}.offset";

# Remove offset file if reset flag and timer are set 
my @time = localtime();
my $secs = ($time[2] * 3600) + ($time[1] * 60) + $time[0];
my @reset_timer_array = split(/:/, $reset_timer);
if(scalar @reset_timer_array < 2) {
  print "Reset time provided is not formatted correctly\n";
  usage();
}
my $min_sec = $reset_timer_array[0];
my $max_sec = $reset_timer_array[1];
if($reset_flag > 0 && $secs > $min_sec && $secs < $max_sec) {
  if($debug > 0) {
    print "Removing the offset log file: $offset_log\n";
  }
  `rm -f $offset_log`;
}

if (-e $offset_log) {
  open(OFFSET_FH, "<", $offset_log);
  @offset = <OFFSET_FH>;
  close OFFSET_FH;
}
else {
  open OFFSET_FH, ">", $offset_log;
  close OFFSET_FH;
  @offset = (0);
}

open(LOG_DATA, "<", $LOGFILE) or die "Could not Open $LOGFILE, 3";
my $search_for_pattern = join('|', @search_for);
my $parse_by_pattern = join('|', @parse_by);

if($debug > 0) {
  print "Search Pattern: $search_for_pattern\n";
  print "Parse Patterns: $parse_by_pattern\n";
}

while ( $line = <LOG_DATA> ) {
  $cur_counter++;
  if($cur_counter < $offset[0]) {
    next;
  }
  push(@parsed_data, $line);
}

foreach my $cur_line (@parsed_data) {
  if($cur_line =~ /($parse_by_pattern)/i) {
    if($use_data =~ /($search_for_pattern)/i ) {
      $found_counter++;
      push(@error_msg, $use_data);
      if($debug > 0) {
        print "\n----------Start---------------\n";
        print "$use_data\n";
        print "\n----------End-----------------\n";
      }
    }
    $use_data = "";
  }
  $use_data .= $cur_line;
}

close LOG_DATA;

open OFFSET_FH, ">", $offset_log;
print OFFSET_FH $cur_counter;
close OFFSET_FH;

# Display and Exit Out of the script
if($rev_flag > 0) {
  if($found_counter <= $warn) {
    $msg = "Found Less Than Warning Threshold of $warn";
    $exit_code = 1;
  }
  if($found_counter <= $crit) {
    $msg = "Found Less Than Critical Threshold of $crit";
    $exit_code = 2;
  }
}
else {
  if($found_counter >= $warn) {
    $msg = "Exceeded Warning Threshold of $warn";
    $exit_code = 1;
  } 
  if($found_counter >= $crit) {
    $msg = "Exceeded Critical Threshold of $crit";
    $exit_code = 2;
  }
}

# Print Message
print "$msg - $tag - Errors Found: $found_counter";

# Print Errors
if($hide_errors == 0) {
  print "\n";
  print join("\n", @error_msg);
}

# print Perf Data
print " | errors_found=$found_counter;";
exit $exit_code;

#############
#           #
# Functions #
#           #
#############

sub usage {
  print "$0 OPTIONS\n";
  print "\n";
  print "REQUIRED:\n";
  print "-l, -t\n";
  print "\n";
  print "OPTIONS:\n";
  print "-h\t\t\tUsage of Script\n";
  print "-r\t\t\tReset the offset to 0\n";
  print "-o\t\t\tSets less then flag for the threshold\n";
  print "-l <File>\t\tFull Path to Log File\n";
  print "-t <Tag>\t\tTag for displaying and storing the offset data\n";
  print "-z <Path>\t\tPath to store the offset file\n";
  print "-m <#:#>\t\tMin:Max seconds from midnight to reset the offset to 0\n";
  print "-p <Keyword>\t\tKeyword used to parse each record in the Log File\n";
  print "-s <Keyword>\t\tKeyword to Look For in the Log File\n";
  print "-w <#>\t\t\tWarning Threshold Level\n";
  print "-c <#>\t\t\tCritical Threshold Level\n";
  print "\n";
  print "NOTES:\n";
  print "-r = if option is used the min and max seconds is required\n";
  print "EXAMPLE:\n";
  print $0 . " -l /var/log/message -t message_systemd -p `date \"+%b %d\"` -s systemd -w 1 -c 2\n";
  print $0 . " -l /ap/p/log/daily_log -t daily_log -p `date \"+%Y\"` -s \"ERR\ .3\" -c 1 -r -f 0:300\n";
  exit(3);
} # END usage

sub verifyTools {
  my @missing = ();
  foreach my $each_tool(@{$_[0]}) {
    my $cur_tool = `which $each_tool`;
    if (length($cur_tool) == 0) {
      push(@missing, $each_tool);
    }
  }
  return @missing;
} # END verifyTools

[vtrac]

Hi,
I tested your script and looks like "check_nrpe" will not acept either "[]" or "{}", so you might want to use other values for the option "s".

I can not use "\" to escape its either.


Best Regards,
Vinh

[lexisnexis]

You can't use \ either. It doesn't translate correctly, even if you do \\ or \\\\. check_nrpe doesn't like this either.

[vtrac]

Hi,
How are you doing?
Yes, I tried using the "\", "\\" or "\\\" as escape character(s) but that did not work.

You might have to use different values for your "regrex" search for your option "-s", sorry!! ...


Best Regards,
Vinh

[lexisnexis]

Will there be able working to allow check_nrpe to accept these types of characters?

[vtrac]

Hi,
I can put in a feature request for check_nrpe if you like ...


Best Regards,
Vinh