check_nrpe using NSClient++ gives socket timeout

[aanataliya]

I am monitoring windows server using nagios core and nsclient++ agent.

For one of the hosts, service state using below command gives OK.

Code: Select all

define service {
 use			        sgn-generic-service
 hostgroup_name 	ActiveDirectory
 service_description   AD Domain NTDS Service
 contact_groups	 SME,SUPPORT_DL
 check_command       check_nt!SERVICESTATE!-d SHOWALL -l NTDS -s $USER2$
}

But checkDisk command as shown below fails with error "socket timeout after 30 seconds"

Code: Select all

define command {
       command_name     check_free_disk_win
       command_line     $USER1$/check_nrpe -H $HOSTADDRESS$ -n -t 30 -c check_drivesize -a 'warn=free lt 3' 'crit=free lt 2'
}

I also tried increasing timeout to 60 seconds and checked with below command but same error.

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H 10.184.176.6 -n -t 60 -c check_drivesize

I am able to telnet on destination server on port 12489

below is nmap output for destination server.

Code: Select all

nmap -Pn 10.184.176.6 -p 12489

Starting Nmap 6.40 ( http://nmap.org ) at 2018-10-17 18:08 UTC
Nmap scan report for 10.184.176.6
Host is up (0.020s latency).
PORT      STATE SERVICE
12489/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 0.12 seconds

below is netstat output from destination server

Code: Select all

netstat -a -n | findstr 12489
  TCP    0.0.0.0:12489          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:12489          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:12489          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:12489          0.0.0.0:0              LISTENING
  TCP    10.184.176.6:12489     10.184.32.86:40382     TIME_WAIT
  TCP    10.184.176.6:12489     10.184.32.86:40490     TIME_WAIT
  TCP    10.184.176.6:12489     10.184.32.86:40830     TIME_WAIT
  TCP    10.184.176.6:12489     10.184.32.86:40906     TIME_WAIT
  TCP    10.184.176.6:12489     10.184.32.86:40964     TIME_WAIT
  TCP    [::]:12489             [::]:0                 LISTENING
  TCP    [::]:12489             [::]:0                 LISTENING

below is nsclient.log file's last couple of line's output after starting service

Code: Select all

018-10-17 18:59:17: debug:c:\source\master\service\plugin_manager.cpp:227: Loading plugin: CheckDisk
2018-10-17 18:59:17: debug:c:\source\master\service\plugin_manager.cpp:227: Loading plugin: CheckEventLog
2018-10-17 18:59:17: debug:c:\source\master\service\plugin_manager.cpp:227: Loading plugin: CheckExternalScripts
2018-10-17 18:59:17: debug:c:\source\master\modules\CheckExternalScripts\CheckExternalScripts.cpp:127: No aliases found (adding default)
2018-10-17 18:59:17: debug:c:\source\master\service\plugin_manager.cpp:227: Loading plugin: CheckSystem
2018-10-17 18:59:17: debug:c:\source\master\service\plugin_manager.cpp:227: Loading plugin: NRPEServer
2018-10-17 18:59:17: debug:c:\source\master\modules\NSClientServer\NSClientServer.cpp:86: Allowed hosts definition: 127.0.0.1(255.255.255.255), ****my Nagios server ips”
2018-10-17 18:59:17: debug:c:\source\master\include\socket/server.hpp:111: Binding to: [::]:12489(ipv6)
2018-10-17 18:59:17: debug:c:\source\master\include\socket/server.hpp:214: Attempting to bind to: [::]:12489(ipv6)
2018-10-17 18:59:17: debug:c:\source\master\include\socket/server.hpp:107: Binding to: 0.0.0.0:12489(ipv4), reopen: true, reuse: true
2018-10-17 18:59:17: debug:c:\source\master\include\socket/server.hpp:214: Attempting to bind to: 0.0.0.0:12489(ipv4)
2018-10-17 18:59:17: debug:c:\source\master\service\NSClient++.cpp:317: NSClient++ - 0.5.2.35 2018-01-28 Started!
2018-10-17 18:59:17: debug:c:\source\master\service\NSClient++.cpp:441: Starting: DONE

Windows firewall is on on destination server but I can see that inbound rule for NSCP is allowing Any ports.But not sure that rule is just enough or something else needs to do.

can you please help?

[npolovenko]

Hello, @aanataliya. Please rerun the nrpe command with the v.4 packets option.

/usr/local/nagios/libexec/check_nrpe -4 -H 10.184.176.6 -n -t 60 -c check_drivesize

If that doesn't work please upload the nsclient.ini file from the remote server.

I am able to telnet on destination server on port 12489

This is the NSClient port. If you're using check_nrpe the port number is 5666.

[aanataliya]

Thanks for your reply.

check_nrpe with v4 Packet also did not work. but yes telnet on port 5666 is failing. seems like thats the issue. If telnet fails we can say for sure that its port not open? And is port blocked instance level or network firewall level? Is there any command to identify this? how can we say for sure?

[npolovenko]

@aanataliya, We need to check the settings in the NSClient.ini file and make sure that nrpe module is enabled. If the settings in the config file are correct, windows should automatically open the port 5666. Unless you're using another firewall then the built-in one, in that case you'd need to add exception rules manually.

[aanataliya]

Thanks for the reply. It was indeed issue with port 5666. After opening port it worked. This topic can be closed now.

[npolovenko]

@aanataliya, Great, I'll be closing this thread as resolved.