NCPA and windows Passive checks over NRDP

[lmiltchev]

Hmm, my permissions are exactly the same. I don't understand why NCPA would not be able to run the script if it is running as a "Local System Account"... unless you changed the user NCPA is running under.

I will check with our NCPA developer on that.

[gmills]

thank you!

I have not changed it, should have all default settings.

[lmiltchev]

Just curious, does it work if you change user that NCPA runs under from "Local System account" to "Administrator"?

[gmills]

lmiltchev,
let me ask another silly question.

inside the script comments say the following....

'===============================================================================
' Script Name : check_files.vbs
' Usage Syntax : cscript.exe //NoLogo //T:10 check_filecount.vbs -p <path> [-r] [-f <filter>] -w <warn> -c <crit> | -h
' Author : Alex Simenduev, PlanetIT (http://www.planetit.ws)
' Version : 2009.11.1
' LastModified : 29/10/2009
' Description : Counts the number of files in given directory and its
' subdirectories, with optional filters applied. The output is
' compatible with Nagios. Default Exit code is 3 (STATE_UNKNOWN)

how can I configure the nrpe command to include the portion cscript.exe //NoLogo //T:30 ? am I reading this right?

inside the ncpa.cfg - isn't this supposed to do the above?
# Windows
.ps1 = powershell -ExecutionPolicy Bypass -File $plugin_name $plugin_args
.vbs = cscript $plugin_name $plugin_args //NoLogo
.wsf = cscript $plugin_name $plugin_args //NoLogo
.bat = cmd /c $plugin_name $plugin_args

[mbellerue]

That's correct. The .vbs line states how NCPA should execute .vbs scripts. Looking at it, it looks like you could add //H:CScript or //H:Wscript to that line, and it should make damned certain that it's using the scripting engine you want.

Do you have any additional security products installed on this system?

Or do you happen to have Python 3 installed on your Nagios server? If so, can you run /usr/bin/env python on your Nagios server?

[gmills]

thanks once again Sir!

no python
McAfee I believe is it.

I am going to try adding //H:CScript to the config.

I wont be able to let you know til later today, I appreciate your help.

I did open a MicroSoft ticket too. haven't heard from they yet.

[mbellerue]

Regarding McAfee, make sure it doesn't have any features for blocking scripts enabled. Even if you think you have all of the right exceptions in place, just disable any script blocking at least temporarily while testing so that we can rule it out.

That will be one more thing to try when you can make modifications to the system again. We'll keep this thread open and wait to hear back on that and the //H:CScript change.

[gmills]

I'm so sorry I was pulled off on other things...

I'm back - thank you

hey, it is working now. I had the Windows team in company look at it, it seems they did the same thing we did, maybe perms or something prevented it from working. Anyhoot, it works now.

however, One minor issue,

I'm having issue with directory names with spaces in them. would you have a suggestion?

SHOWS working with directory with no spaces
[root@alpcts000001083 libexec]# ./check_ncpa.py -v -H 3.239.245.147 -t gold3726 -M plugins/check_files.vbs -a '-p 'D:\\DeltaFiles\\717-200' -w 100 -c 200'
Connecting to: https://3.239.245.147:5693/api/plugins/ ... 26&check=1
File returned contained:
{
"returncode": 2,
"stdout": "CRITICAL: 27376 files were matched.|count=27376"
}
CRITICAL: 27376 files were matched.|count=27376


--------
shows not able to decipher spaces in directory.
[root@alpcts000001083 libexec]# ./check_ncpa.py -v -H 3.239.245.147 -t gold3726 -M plugins/check_files.vbs -a '-p "D:\\Delta Incoming" -w 100 -c 200'
Connecting to: https://3.239.245.147:5693/api/plugins/ ... 26&check=1
File returned contained:
{
"returncode": 3,
"stdout": "Path '\\D:\\\\Delta' does not exists.\nUnknown argument 'Incoming\\', ignoring.\nMissing or invalid arguments, check usage."
}
Path '\D:\\Delta' does not exists.
Unknown argument 'Incoming\', ignoring.
Missing or invalid arguments, check usage.


DO I need to play with the ARGS on Command?

[mbellerue]

This is something we've seen before. What ends up happening is we put one type of escaped space into the path to make the API happy, and then the scripting engine isn't happy. We put an escaped space in for the scripting engine, and then the API isn't happy.

Your best bet here is just to create a sym link to the directory you want to monitor. Specifically a sym link, not a shortcut. In cmd (as administrator), run

Code: Select all

D:
mklink /D LinkNameNoSpaces D:\Delta Incoming\

Pro-tip: If you have a bunch of directories you need to monitor using sym links, keep in mind that you don't need to keep the sym link "near" its target. That is to say, it doesn't need to be in the same directory or anything. You can create a directory like C:\Monitoring\ and then put all of your sym links in that directory. The only restriction you may run into is linking between file systems, that might not work, in which case you would create D:\Monitoring, or E:\Monitoring, etc.

[gmills]

WOW! thank you for that.
I've acheived my goal of learning something new everyday!

this is great! thank you very much, I'll be able to try this this afternoon, and we should be in business.

I will let you know of our/your success. you made my day. this is a good monday.