yum updates unknown - CHECK_NRPE: Receive header underflow -

bruce_clegg · Post by **bruce_clegg** » Fri Feb 14, 2020 3:30 pm

The master server's IP address was in /etc/xinetd.d/nrpe. Just to make sure xinet.d had been loaded, I restarted the server. Made no difference, still getting "CHECK_NRPE: Receive header underflow - only -1 bytes received (4 expected)." from the nagiosxi check.

$ cat /etc/xinetd.d/nrpe
# default: off
# description: NRPE (Nagios Remote Plugin Executor)
service nrpe
{
disable = no
per_source = 25
socket_type = stream
port = 5666
wait = no
user = nagios
group = nagios
server = /usr/local/nagios/bin/nrpe
server_args = -c /usr/local/nagios/etc/nrpe.cfg --inetd
only_from = 127.0.0.1 10.X.X.X
log_on_success =
}

# /usr/local/nagios/libexec/check_nrpe -V
NRPE Plugin for Nagios
Version: 3.2.1

[root@ip-10-X-X-X ~]# nmap 10.X.X.X -p 5666

Starting Nmap 6.47 ( http://nmap.org ) at 2020-02-14 13:08 MST
Nmap scan report for 10.X.X.X
Host is up (0.00031s latency).
PORT STATE SERVICE
5666/tcp open nrpe
MAC Address: 02:21:XX:XX:XX:XX (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

The only thing I see above that might be an issue is the 'Unknown' next to the MAC address. Could that be a factor?

I looked through the kb article you provided the link to - I have not attempted to recomple nrpe with ssl explicitly allowed. I installed with the default. Is it worth trying that?

Post by **lmiltchev** » Fri Feb 14, 2020 3:46 pm

The only thing I see above that might be an issue is the 'Unknown' next to the MAC address. Could that be a factor?

No. Most likely your IP address is not correct on the only_from line or you haven't restarted xinetd service after adding the IP address.

only_from = 127.0.0.1 10.X.X.X

Is "10.X.X.X" the IP address of your Nagios XI server? Can you run the following command on your XI box, and see if the IP matches the one in "/etc/xinetd.d/nrpe" ?

Code: Select all

ip addr

Also, just in case, restart xinetd on the client (remote machine):

Code: Select all

service xinetd restart

I looked through the kb article you provided the link to - I have not attempted to recomple nrpe with ssl explicitly allowed. I installed with the default. Is it worth trying that?

No, don't do this for now. Let's first make sure that the IP address in "/etc/xinetd.d/nrpe" file is correct.

bruce_clegg · Post by **bruce_clegg** » Fri Feb 14, 2020 4:10 pm

I have verified that the ip address in /etc/xinetd.d/nrpe is the master nagios xi server.

I restarted xinetd on the nagios client. It made no difference.

Just to emphasize the checks for: Disk Usage, CPU stats, Cron Scheduling Daemon, Load, Memory Usage, Open Files, Ping, SSH server, Swap Usage, Total Processes, and Users - are all working perfectly between this same nagios xi client and the nagios xi master.

Perhaps I should have noted this earlier - but in addition to nrpe, I remember installing ncpa - though I can't find it in xinetd.d or with systemctl

Post by **lmiltchev** » Fri Feb 14, 2020 4:53 pm

Just to emphasize the checks for: Disk Usage, CPU stats, Cron Scheduling Daemon, Load, Memory Usage, Open Files, Ping, SSH server, Swap Usage, Total Processes, and Users - are all working perfectly between this same nagios xi client and the nagios xi master.

This is really strange... If the rest of the checks are working, the 'check_yum' check should be working too... Can you PM me your latest profile (profile.zip) from the Nagios XI (Admin > System Profile > Download Profile)?

Also, PM me the nrpe.cfg and /etc/xinetd.d/nrpe file from the client.

Perhaps I should have noted this earlier - but in addition to nrpe, I remember installing ncpa - though I can't find it in xinetd.d or with systemctl

NCPA shouldn't affect anything. You won't find the NCPA config in the xinetd.d directory. It's in /usr/local/ncpa/etc/ncpa.cfg.

Post by **lmiltchev** » Mon Feb 17, 2020 10:15 am

I reviewed your conifgs and logs from the PM you sent me. They all look good. I didn't see anything that "stands out". One thing I would like to see is if you could run check_yum as "nagios" user. I know it works fine when you run the check as "root":

[root@ip-10-X-X-X ~]# /usr/local/nagios/libexec/check_yum
YUM OK: O/S is up to date.

Run the following commands on the client, and show the output:

Code: Select all

su - nagios
/usr/local/nagios/libexec/check_yum

Are you using tcp wrappers by chance? Do you have anything in the /etc/hosts.allow or /etc/hosts.deny?

bruce_clegg · Post by **bruce_clegg** » Tue Feb 18, 2020 10:56 am

nagios user works fine from client server...

[root@ip-10-X-X-X ~]# su - nagios
Last login: Wed Feb 12 22:21:43 UTC 2020 on pts/1
[nagios@ip-10-X-X-X ~]$ /usr/local/nagios/libexec/check_yum
YUM OK: O/S is up to date.

So everything works fine on the client machine - it is either timing out (it did take several seconds to run) or being misread by the master somehow? We know the ports are open through the firewall because the rest of the nagios checks are working.

Post by **Box293** » Wed Feb 19, 2020 5:08 pm

Lets see how long it takes to run with the following command:

Code: Select all

time /usr/local/nagios/libexec/check_yum

bruce_clegg · Post by **bruce_clegg** » Wed Feb 19, 2020 6:33 pm

[nagios@ip-10-X.X.X ~]$ time /usr/local/nagios/libexec/check_yum
YUM WARNING: O/S requires an update.

real 0m5.968s
user 0m3.595s
sys 0m0.339s

hmm - looks like updates have come out recently? Let me quickly update...

[nagios@ip-10-x-X-x ~]$ time /usr/local/nagios/libexec/check_yum
YUM OK: O/S is up to date.

real 0m2.455s
user 0m2.208s
sys 0m0.169s

Much faster. I ran the command several more times - all came back with times similar to above.

From the client box/nagios user:

$ /usr/local/nagios/libexec/check_yum
YUM OK: O/S is up to date.

From the nagios xi server:

# /usr/local/nagios/libexec/check_nrpe -H 10.X.X.X -t 30 -c 'check_yum' -n
CHECK_NRPE: Receive header underflow - only -1 bytes received (4 expected).

Post by **Box293** » Thu Feb 20, 2020 5:10 pm

I suspect a permissions issue. On the client box as the nagios user execute:

Code: Select all

/usr/local/nagios/libexec/check_yum

bruce_clegg · Post by **bruce_clegg** » Thu Feb 20, 2020 5:29 pm

as nagios from the client:

[nagios@ip-10-x-X-x ~]$ id
uid=1001(nagios) gid=1001(nagios) groups=1001(nagios),1002(nagcmd)
[nagios@ip-10-x-X-x ~]$ /usr/local/nagios/libexec/check_yum
YUM OK: O/S is up to date.

On the client:

ls -ltr /usr/local/nagios/libexec/check_yum
-rwxr-xr-x 1 root nagios 710 Feb 7 19:40 /usr/local/nagios/libexec/check_yum

as root from the nagios xi master server to show the problem still exists:

[root@ip-10-X-X-X ~]# id
uid=0(root) gid=0(root) groups=0(root)
[root@ip-10-X-X-X ~]# /usr/local/nagios/libexec/check_nrpe -H 10.x.X.x -t 30 -c 'check_yum' -n
CHECK_NRPE: Receive header underflow - only -1 bytes received (4 expected).

on the client I did a chmod 775 on /usr/local/nagios/libexec/check_yum and retried the check_nrpe command from the nagios server - and got the same 'Receive header underflow' error message ('I've since changed permissions back to 755)

Nagios Support Forum