Page 1 of 4

NRPE Checks Give false Positive

Posted: Thu Mar 16, 2017 10:22 pm
by kwhogster
Nagios Core 4.1

I keep getting these type of issues on my VM's
Once in a great while on the Physical devices

Is it Nagios or NRPE my NRPE is version 2.15 should I upgrade?

They always clear and go back to normal after a while

Check Application Event Logs Notifications for this service have been disabled UNKNOWN 03-16-2017 23:14:20 0d 0h 1m 51s 3/3 CHECK_NRPE: Received 0 bytes from daemon. Check the remote server logs for error messages.

Check System Event LogsThis service has 1 comment associated with it Notifications for this service have been disabled This service is flapping between states UNKNOWN 03-16-2017 23:13:27 0d 0h 1m 44s 3/3 CHECK_NRPE: Received 0 bytes from daemon. Check the remote server logs for error messages.

Explorer Notifications for this service have been disabled WARNING 03-16-2017 23:14:06 0d 0h 1m 5s 1/3 No data was received from host!

I do not want a lot of emails sent on this type of event

I have set many of my checks to only check after 60 minutes 360 minutes 1 day and even once a week.

I tried escalations but they still post and send emails

Any ideas

Thanks in advance

Tom

Re: NRPE Checks Give false Positive

Posted: Fri Mar 17, 2017 12:52 pm
by mcapra
Just so we have all the necessary pieces, can you share this machine's nrpe.cfg as well as the service definitions producing those false positives?

Re: NRPE Checks Give false Positive

Posted: Fri Mar 17, 2017 1:57 pm
by kwhogster
Ok here they are
nrpecfg.txt
nrpe cfg
(8.31 KiB) Downloaded 441 times
Maybe escalation settings would be good check mine out maybe I have something incorrect.

Re: NRPE Checks Give false Positive

Posted: Fri Mar 17, 2017 2:59 pm
by ssax
We can turn on NRPE debugging to collect more information.

On one of the remote servers, please edit this file:

Code: Select all

/usr/local/nagios/etc/nrpe.cfg
Change the debug setting to:

Code: Select all

debug=1
Save the file and then run:

Code: Select all

service xinetd restart
Now we need to add an option to the rsyslog server so it processes debug messages, edit this file:

Code: Select all

/etc/rsyslogd.conf

Find the /var/log/messsages line in the config file, it will look like this:

Code: Select all

*.info;mail.none;authpriv.none;cron.none /var/log/messages

Change it to:

Code: Select all

*.info;mail.none;authpriv.none;cron.none;daemon.debug /var/log/messages

Save the file and restart rsyslog:

Code: Select all

service rsyslog restart

Now there should be more information logged in /var/log/messages when there is a failure, keep an eye on it and then when it occurs again, run this command from the remote NRPE server, please run this command and send us the output:

Code: Select all

tail -n 100 /var/log/messages
Thank you

Re: NRPE Checks Give false Positive

Posted: Fri Mar 17, 2017 5:19 pm
by kwhogster
What server ?

This happens on all VM machines most are Windows Servers and Desktop computers

They do not have nrpe.cfg

Should I do it on the Nagios Server ???

Re: NRPE Checks Give false Positive

Posted: Sat Mar 18, 2017 8:24 pm
by dwhitfield
Did you use https://assets.nagios.com/downloads/nag ... -0.3.x.pdf to set up the Windows machines?

If so, can you send us a nsc.ini file (if you installed a newer version of NSClient, the file will be called nsclient.ini)

If you did not use that documentation, what documentation did you use?

As an aside, you seem to be having many problems with NRPE. Have you read through https://assets.nagios.com/downloads/nag ... e/NRPE.pdf ?

Re: NRPE Checks Give false Positive

Posted: Sat Mar 18, 2017 8:48 pm
by kwhogster
Most of my VM desktops and Servers run NSCLIENT 4.1.3
Yes I saw that doc even tho it is for Nagios XI I run Nagios Core 4.1

I saw that NRPE doc before too

I am doing Direct Checks I do not have any remote devices all on same network

See attached sample nsclient.ini

Re: NRPE Checks Give false Positive

Posted: Sun Mar 19, 2017 5:52 pm
by rkennedy
Post your nsclient log file for us to look at.

Re: NRPE Checks Give false Positive

Posted: Sun Mar 19, 2017 6:18 pm
by dwhitfield
Yes, the NSClient log would be very useful.

You must be very careful about NSClient versions. We did not write that. Our Windows tool is called NCPA. It is fine to use NSClient, and obviously we write documentation for it, but the developer changes the configs a lot between versions, which can make it very frustrating to work with. Thanks for the info on the version!

Re: NRPE Checks Give false Positive

Posted: Sun Mar 19, 2017 7:18 pm
by kwhogster
Ok so what can we do to fix this ?