NSClient install problem

[kilrathi]

We are setting up a new Nagios XI install and i'm having some trouble getting NSClient to report properly to our XI server.

I'm installing NSCP-0.4.4.23-x64.msi on a server (Win Server 2012)
In the Allowed Hosts I've added the entire subnet for my windows server. This is the same subnet my XI server resides on.
I've made sure i'm using the same password that my XI server is expecting.
The modules i've selected are: (common check plugins, nsclinet server (check_nt), and NRPE server (check_nrpe). Effectively the first 3 check boxes. They are selected by default when I run the installed. I've tried selecting Insecure, Safe Mode, and Secure for NRPE server. None of them seem to make a difference.

Once NSClient completes its install i've opened the nsclient.ini to verify the settings. I've been fiddling with them most of the day to get it right. Here's what it looks like after a clean install (I selected Insecure legacy mode for NRPE)

Code: Select all

# If you want to fill this file with all avalible options run the following command:
#   nscp settings --generate --add-defaults --load-all
# If you want to activate a module and bring in all its options use:
#   nscp settings --activate-module <MODULE NAME> --add-defaults
# For details run: nscp settings --help

; Undocumented section
[/settings/default]

; Undocumented key
password = **edit**

; Undocumented key
allowed hosts = 127.0.0.1,::1,192.168.1.0/24

; Undocumented section
[/settings/NRPE/server]

; Undocumented key
verify mode = none

; Undocumented key
insecure = true

; Undocumented section
[/modules]

; Undocumented key
CheckExternalScripts = 1

; Undocumented key
CheckHelpers = 1

; Undocumented key
CheckEventLog = 1

; Undocumented key
CheckNSCP = 1

; Undocumented key
CheckDisk = 1

; Undocumented key
CheckSystem = 1

; Undocumented key
NRPEServer = 1

Once the client starts the nsclinet.log file shows the following

Code: Select all

2017-09-01 13:14:50: error:c:\source\nscp\modules\NRPEServer\NRPEServer.cpp:132: CA not found: C:\Program Files\NSClient++/security/ca.pem (generating a default CA)

Once all this is done I run a wizard (Windows Server Wizard) on our XI server to add this server to my monitored hosts. I make sure to use the same password listed in the config file in the "Agent Password" box. I've left the defaults checked (Ping, CPU, Mem, Uptime, Drive C) selected for monitoring. Once this is complete i wait for an update. Here's what it says in the XI console

Code: Select all

connect to address 192.168.1.16 and port 12489: Connection refused

I've run a netstat -an on the remote system (192.168.1.16) and I don't see port 12489 listed at all. I've increased the logging to debug on the NSClient computer. Here's the log:

Code: Select all

2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:542: Attempting to stop all plugins
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:544: Stopping all plugins
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:641: Unloading plugin: CheckDisk.dll...
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:641: Unloading plugin: CheckEventLog.dll...
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:641: Unloading plugin: CheckExternalScripts.dll...
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:641: Unloading plugin: CheckHelpers.dll...
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:641: Unloading plugin: CheckNSCP.dll...
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:641: Unloading plugin: CheckSystem.dll...
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:641: Unloading plugin: NRPEServer.dll...
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:555: Stopping: COM helper
2017-09-01 13:26:21: debug:c:\source\nscp\service\NSClient++.cpp:574: Stopping: Settings instance
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:332: On crash: restart: nscp
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:344: Archiving crash dumps in: C:\Program Files\NSClient++/crash-dumps
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:410: booting::loading plugins
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:173: Found: CheckDisk
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:173: Found: CheckEventLog
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:173: Found: CheckExternalScripts
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:173: Found: CheckHelpers
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:173: Found: CheckNSCP
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:173: Found: CheckSystem
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:173: Found: NRPEServer
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:776: C:\Program Files\NSClient++/modules\CheckDisk.dll.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:778: adding C:\Program Files\NSClient++/modules\CheckDisk.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:776: C:\Program Files\NSClient++/modules\CheckEventLog.dll.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:778: adding C:\Program Files\NSClient++/modules\CheckEventLog.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:776: C:\Program Files\NSClient++/modules\CheckExternalScripts.dll.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:778: adding C:\Program Files\NSClient++/modules\CheckExternalScripts.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:776: C:\Program Files\NSClient++/modules\CheckHelpers.dll.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:778: adding C:\Program Files\NSClient++/modules\CheckHelpers.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:776: C:\Program Files\NSClient++/modules\CheckNSCP.dll.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:778: adding C:\Program Files\NSClient++/modules\CheckNSCP.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:776: C:\Program Files\NSClient++/modules\CheckSystem.dll.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:778: adding C:\Program Files\NSClient++/modules\CheckSystem.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:776: C:\Program Files\NSClient++/modules\NRPEServer.dll.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:778: adding C:\Program Files\NSClient++/modules\NRPEServer.dll
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:737: Loading plugin: CheckDisk
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:737: Loading plugin: CheckEventLog
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:737: Loading plugin: CheckExternalScripts
2017-09-01 13:26:22: debug:c:\source\nscp\modules\CheckExternalScripts\CheckExternalScripts.cpp:110: No aliases found (adding default)
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:737: Loading plugin: CheckHelpers
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:737: Loading plugin: CheckNSCP
2017-09-01 13:26:22: debug:c:\source\nscp\modules\CheckNSCP\CheckNSCP.cpp:48: Crash folder is: C:\Program Files\NSClient++
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:737: Loading plugin: CheckSystem
2017-09-01 13:26:22: debug:c:\source\nscp\service\NSClient++.cpp:737: Loading plugin: NRPEServer
2017-09-01 13:26:22: debug:c:\source\nscp\modules\NRPEServer\NRPEServer.cpp:137: Allowed hosts definition: 127.0.0.1(255.255.255.255), 192.168.1.0(255.255.255.0), ::1(ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
2017-09-01 13:26:23: debug:c:\source\nscp\include\socket/server.hpp:99: Binding to: [::]:5666(ipv6)
2017-09-01 13:26:23: debug:c:\source\nscp\include\socket/server.hpp:202: Attempting to bind to: [::]:5666(ipv6)
2017-09-01 13:26:23: debug:c:\source\nscp\include\socket/server.hpp:95: Binding to: 0.0.0.0:5666(ipv4), reopen: true, reuse: true
2017-09-01 13:26:23: debug:c:\source\nscp\include\socket/server.hpp:202: Attempting to bind to: 0.0.0.0:5666(ipv4)
2017-09-01 13:26:23: debug:c:\source\nscp\service\NSClient++.cpp:505: NSClient++ - 0.4.4.23 2016-04-05 Started!
2017-09-01 13:26:23: debug:c:\source\nscp\service\NSClient++.cpp:1363: Starting: DONE

I have confirmed the windows firewall is disabled on the windows server. There is no firewall between the two devices.

/var/log/messages on the XI server has the following errors:

Code: Select all

Sep  1 14:25:28 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;Drive C: Disk Usage;CRITICAL;SOFT;1;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:25:48 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;CPU Usage;CRITICAL;SOFT;3;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:25:54 localhost ndo2db: Trimming timedevents.
Sep  1 14:25:54 localhost ndo2db: Trimming systemcommands.
Sep  1 14:25:54 localhost ndo2db: Trimming servicechecks.
Sep  1 14:25:54 localhost ndo2db: Trimming hostchecks.
Sep  1 14:25:54 localhost ndo2db: Trimming eventhandlers.
Sep  1 14:26:18 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;Memory Usage;CRITICAL;SOFT;1;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:26:24 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;Drive C: Disk Usage;CRITICAL;SOFT;2;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:26:26 localhost xinetd[18650]: START: nsca pid=3805 from=::ffff:216.60.221.157
Sep  1 14:26:27 localhost xinetd[18650]: EXIT: nsca status=0 pid=3805 duration=1(sec)
Sep  1 14:26:29 localhost xinetd[18650]: START: nsca pid=3806 from=::ffff:216.60.221.157
Sep  1 14:26:30 localhost xinetd[18650]: EXIT: nsca status=0 pid=3806 duration=1(sec)
Sep  1 14:26:47 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;CPU Usage;CRITICAL;SOFT;4;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:26:55 localhost ndo2db: Trimming timedevents.
Sep  1 14:26:55 localhost ndo2db: Trimming systemcommands.
Sep  1 14:26:55 localhost ndo2db: Trimming servicechecks.
Sep  1 14:26:55 localhost ndo2db: Trimming hostchecks.
Sep  1 14:26:55 localhost ndo2db: Trimming eventhandlers.
Sep  1 14:27:10 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;Memory Usage;CRITICAL;SOFT;2;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:27:18 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;Drive C: Disk Usage;CRITICAL;SOFT;3;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:27:41 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;CPU Usage;CRITICAL;HARD;5;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:27:57 localhost ndo2db: Trimming timedevents.
Sep  1 14:27:57 localhost ndo2db: Trimming systemcommands.
Sep  1 14:27:57 localhost ndo2db: Trimming servicechecks.
Sep  1 14:27:57 localhost ndo2db: Trimming hostchecks.
Sep  1 14:27:57 localhost ndo2db: Trimming eventhandlers.
Sep  1 14:28:06 localhost xinetd[18650]: START: nsca pid=4303 from=::ffff:216.60.221.157
Sep  1 14:28:07 localhost xinetd[18650]: EXIT: nsca status=0 pid=4303 duration=1(sec)
Sep  1 14:28:07 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;Uptime;CRITICAL;SOFT;1;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:28:07 localhost xinetd[18650]: START: nsca pid=4308 from=::ffff:216.60.221.157
Sep  1 14:28:08 localhost xinetd[18650]: EXIT: nsca status=0 pid=4308 duration=1(sec)
Sep  1 14:28:13 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;Memory Usage;CRITICAL;SOFT;3;connect to address 192.168.1.16 and port 12489: Connection refused
Sep  1 14:28:16 localhost xinetd[18650]: START: nsca pid=4321 from=::ffff:216.60.221.157
Sep  1 14:28:16 localhost xinetd[18650]: START: nsca pid=4322 from=::ffff:216.60.221.157
Sep  1 14:28:17 localhost xinetd[18650]: EXIT: nsca status=0 pid=4321 duration=1(sec)
Sep  1 14:28:17 localhost xinetd[18650]: EXIT: nsca status=0 pid=4322 duration=1(sec)
Sep  1 14:28:20 localhost nagios: SERVICE ALERT: windows-srv1.domain.local;Drive C: Disk Usage;CRITICAL;SOFT;4;connect to address 192.168.1.16 and port 12489: Connection refused

I've tried changing the allowed hosts to blank, *, 0.0.0.0/0
The nsclient is running, but its binding to 5666. From what I can tell this is a different check that's included with the client that the wizard isn't trying to setup when i build the host in XI.

Under advanced for the CPU monitor service for this host the box labeled "Monitor this service with this command" says:
check_xi_service_nsclient!**edit**!CPULOAD!-l 5,80,90


I can't figure out why the client won't listen on 12489. If i add a line in the config "port = 12489" it doesn't make a difference.


I realize this is a lot of info but like I said, i've been at this since this morning. Any insight would be appreciated.

[kilrathi]

If i go into the ccm for XI and edit the CPU service, I can look at the actual check command being sent and run it manually. Here's what it looks like:

Code: Select all

[[email protected] ~]$ /usr/local/nagios/libexec/check_nt -H 192.168.1.16 -s "**edit**" -p 12489 -v CPULOAD -l 5,80,90
connect to address 192.168.1.16 and port 12489: Connection refused
could not fetch information from server

[tgriep]

The check_nt command uses the NSClient server in the NSCLient++ agent and it is not enabled in the nsclient.ini file.

Under the following section

[/modules]

Add this to enable that server.

Code: Select all

; NSClientServer - A server that listens for incoming check_nt connection and processes incoming requests.
NSClientServer = 1

Add this section to the bottom in the INI file

Code: Select all

; Section for NSClient (NSClientServer.dll) (check_nt) protocol options.
[/settings/NSClient/server]

; ENABLE SSL ENCRYPTION - This option controls if SSL should be enabled.
use ssl = 0

; PERFORMANCE DATA - Send performance data back to Nagios (set this to 0 to remove all performance data).
performance data = 1

; PORT NUMBER - Port to use for check_nt.
port = 12489

Save it and restart the NSClient++ agent on the server and see if that fixes the issue.
Make sure the firewall is allowing inbound connections to port 12489 as well.

[kilrathi]

That did it! Thank you for the assistance. I'm going to post my final nsclient.ini in this reply. Maybe it will help someone else in the future.


nsclient.ini

Code: Select all

# If you want to fill this file with all avalible options run the following command:
#   nscp settings --generate --add-defaults --load-all
# If you want to activate a module and bring in all its options use:
#   nscp settings --activate-module <MODULE NAME> --add-defaults
# For details run: nscp settings --help

; Undocumented section
[/settings/default]

password = **edit**
allowed hosts = 192.168.1.0/24,127.0.0.1,::1

[/settings/NRPE/server]

verify mode = none
insecure = true

[/modules]

CheckExternalScripts = 1
CheckHelpers = 1
CheckEventLog = 1
CheckNSCP = 1
CheckDisk = 1
CheckSystem = 1
NRPEServer = 1
NSClientServer = 1


[/settings/log]

; LOG LEVEL - Log level to use. Available levels are error,warning,info,debug,trace
level = info

; DATEMASK - The size of the buffer to use when getting messages this affects the speed and maximum size of messages you can recieve.
date format = %Y-%m-%d %H:%M:%S

; FILENAME - The file to write log data to. Set this to none to disable log to file.
file name = ${exe-path}/nsclient.log

; Configure log file properties.
[/settings/log/file]

; MAXIMUM FILE SIZE - When file size reaches this it will be truncated to 50% if set to 0 (default) truncation will be disabled
max size = 2048000

[/settings/NSClient/server]

; ENABLE SSL ENCRYPTION - This option controls if SSL should be enabled.
use ssl = 0

; PERFORMANCE DATA - Send performance data back to Nagios (set this to 0 to remove all performance data).
performance data = 1

; PORT NUMBER - Port to use for check_nt.
port = 12489

[scottwilkerson]

Great! Glad it is up and running for you.