z

Commercial Support Clients: Clients with support contracts can get escalated support assistance by visiting Nagios Answer Hub. These forums are for community support services. Although we at Nagios try our best to help out on the forums here, we always give priority support to our support clients.

Website Wizard Content Check Failure

This support forum board is for support questions relating to Nagios XI, our flagship commercial network monitoring solution.

Website Wizard Content Check Failure

Postby awoodewh » Mon Jan 10, 2011 5:10 pm

When running the Website Wizard it creates $ARG1$ as follows:

-s "STRING" -f -I IPADDR -u "http://www.website.com/index.cfm" -p 80.

-u is the string entered in step one, which requires the website and full path. However, -u should only be the path. Using the full URI causes the check to fail.

-u, --url=PATH
URL to GET or POST (default: /)

./check_http -H http://www.website.com -s "STRING" -f -I IPADDR -u "http://www.website.com/index.cfm" -p80
HTTP CRITICAL - string not found|time=0.162494s;;;0.000000 size=2817B;;;0

./check_http -H http://www.website.com -s "STRING" -f -I IPADDR -u "/index.cfm" -p 80
HTTP OK HTTP/1.1 200 OK - 0.199 second response time |time=0.198806s;;;0.000000 size=1406B;;;0

Thanks,
Andy
awoodewh
 
Posts: 32
Joined: Fri Nov 05, 2010 3:28 pm

Re: Website Wizard Content Check Failure

Postby rdedon » Tue Jan 11, 2011 10:34 am

We will take a look at this, thank you for bringing this to our attention.
Rene deDon
Technical Team
___
Nagios Enterprises, LLC
Web: http://www.nagios.com
rdedon
 
Posts: 578
Joined: Sat Nov 20, 2010 4:51 pm

Re: Website Wizard Content Check Failure

Postby awoodewh » Thu Jan 13, 2011 1:05 pm

I have more information on this. It is not that the content check doesn't work, it is that a Web Application Firewall (dotDefender) is blocking the request. The reason why is that the request is malformed. It is a correct statement that the "-u" should not include the full URI, just the path, as the request ends up looking as such (Note the dotDefender line under the User-Agent):

GET http://www.server.com/index.cfm HTTP/1.0
Connection: close
Host: http://www.server.com
User-Agent: check_http/v2053 (nagios-plugins 1.4.13)
X-dotDefender-first-line: GET http://www.server.com/ HTTP/1.0

The request should be:

GET /index.cfm HTTP/1.0
Connection: close
Host: http://www.server.com
User-Agent: check_http/v2053 (nagios-plugins 1.4.13)

If a server does not have dotDefender installed, the content check technically does work, but dotDefender sees the full URI in the GET request as an attempt to use the web server as a Proxy, and denies the request .

Date 01/13/11
Time 12:46:46
Rule Category Anti-Proxy Protection
More Info ^GET (http|https|ftp)\:/
Applied Policy Deny
IP Address 192.168.64.55
Port Number
Destination URL http://www.server.comhttp://www.server.com/index.php
Request Method GET
Site Profile Default Security Profile
Reference ID 3B08-2F71-8DCF-ED11
Severity 0

Standard (non-content checking) HTTP checks do not fail with dotDefender 3.x, because when it intercepts and denies the request, it does so with a 200 error and a page that says Denied, with a dotDefender Reference ID.
awoodewh
 
Posts: 32
Joined: Fri Nov 05, 2010 3:28 pm

Re: Website Wizard Content Check Failure

Postby mguthrie » Fri Jan 14, 2011 11:11 am

Thanks for posting the info on this, I think we'll add this to our FAQ for future reference.
mguthrie
 
Posts: 4380
Joined: Mon Jun 14, 2010 10:21 am

Re: Website Wizard Content Check Failure

Postby awoodewh » Mon Jan 17, 2011 1:47 pm

Will a correction be made to the code?

Thanks,
Andy
awoodewh
 
Posts: 32
Joined: Fri Nov 05, 2010 3:28 pm

Re: Website Wizard Content Check Failure

Postby rdedon » Mon Jan 17, 2011 3:27 pm

Hello Andy,
for now we will be adding this to the documentation and will be added to the Wiki as well. If you wish you can request it in the bug tracker to be added as a feature in future updates.

Thanks!
Rene deDon
Technical Team
___
Nagios Enterprises, LLC
Web: http://www.nagios.com
rdedon
 
Posts: 578
Joined: Sat Nov 20, 2010 4:51 pm

Re: Website Wizard Content Check Failure

Postby admin » Mon Jan 17, 2011 3:29 pm

I believe the latest revision of the wizard fixes the problem with the URL/path argument. You can get it at:

http://assets.nagios.com/downloads/nagiosxi/wizards/website.zip

Once you download it to your workstation/pc, upload it through the Nagios XI interface on the "Config Wizards" admin page.
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy.

Ethan Galstad
President
User avatar
admin
Site Admin
 
Posts: 256
Joined: Mon Oct 12, 2009 8:21 am

Re: Website Wizard Content Check Failure

Postby awoodewh » Wed Jan 19, 2011 10:39 am

Works perfectly. Thanks!!
awoodewh
 
Posts: 32
Joined: Fri Nov 05, 2010 3:28 pm

Re: Website Wizard Content Check Failure

Postby mguthrie » Wed Jan 19, 2011 10:58 am

Glad to hear it! Thanks for letting us know.
mguthrie
 
Posts: 4380
Joined: Mon Jun 14, 2010 10:21 am


Return to Nagios XI

Who is online

Users browsing this forum: Google [Bot] and 8 guests