NRPE Checks Give false Positive

Support forum for Nagios Core, Nagios Plugins, NCPA, NRPE, NSCA, NDOUtils and more. Engage with the community of users including those using the open source solutions.
dwhitfield
Former Nagios Staff
Posts: 4583
Joined: Wed Sep 21, 2016 10:29 am
Location: NoLo, Minneapolis, MN
Contact:

Re: NRPE Checks Give false Positive

Post by dwhitfield »

Please post the NSClient log so we can see what is going on. Thanks!
kwhogster
Posts: 644
Joined: Wed Oct 14, 2015 6:51 pm
Location: Wood Ridge NJ USA
Contact:

Re: NRPE Checks Give false Positive

Post by kwhogster »

Here are a few of the machines log files

see attached
Attachments
nagios.rar
nsclient logs
(85.18 KiB) Downloaded 217 times
User avatar
mcapra
Posts: 3739
Joined: Thu May 05, 2016 3:54 pm

Re: NRPE Checks Give false Positive

Post by mcapra »

Can we see some of the Nagios Core check_command definitions you're using that are returning false positives? Also they're corresponding command objects. There's an awful lot of errors in those logs. These stand out:

Code: Select all

2017-03-19 20:02:54: e:..\..\..\..\trunk\modules\CheckExternalScripts\CheckExternalScripts.cpp:246: Arguments not allowed in CheckExternalScripts set /settings/external scripts/allow arguments=true
Which indicates external scripts need to be enabled in your NSClient++ configuration.
Former Nagios employee
https://www.mcapra.com/
kwhogster
Posts: 644
Joined: Wed Oct 14, 2015 6:51 pm
Location: Wood Ridge NJ USA
Contact:

Re: NRPE Checks Give false Positive

Post by kwhogster »

I posted the config files in this posting on page 1 see my second posting you will find a attached file containing all configs.


And it continues to happen every day

This is very strange.

Should I upgrade the nsclient ?

Should I upgrade NRPE ?

Should the Nagios server be a physical box? It is Ubuntu VM

Something Please way to many false alerts when I open the console in vsphere the machines are fine

Something is wrong?
User avatar
tgriep
Madmin
Posts: 9177
Joined: Thu Oct 30, 2014 9:02 am

Re: NRPE Checks Give false Positive

Post by tgriep »

Try running the latest 4.x.x stable version of the NSClient++ across your systems for a starting point.
That will make it easier to debug as all of the clients will be running the same version.

One change you can do is to edit the nsclient.ini file and under this section

Code: Select all

[/settings/external scripts]
Change this line from

Code: Select all

allow nasty characters = false
to

Code: Select all

allow nasty characters = true
Save the file and restart the NSClient++ agent.

That should clear out the Arguments not allowed error.

Some of the other errors I saw are possibly caused by the script taking too long to run so you may have to increase the timeout in the nsclient.ini file and also for the check_nrpe command.
Be sure to check out our Knowledgebase for helpful articles and solutions!
kwhogster
Posts: 644
Joined: Wed Oct 14, 2015 6:51 pm
Location: Wood Ridge NJ USA
Contact:

Re: NRPE Checks Give false Positive

Post by kwhogster »

Made the change and still getting false positive errors
User avatar
tgriep
Madmin
Posts: 9177
Joined: Thu Oct 30, 2014 9:02 am

Re: NRPE Checks Give false Positive

Post by tgriep »

Can you post the full message that you are receiving for only one host so we can concentrate on just one system?
Did you upgrade the NSClient++ agent and to what version?
Did you increase the timeout settings for the check_nrpe command on the Nagios server as well as the timeout settings in the nsclient.ini file?
Can you post the nsclient.log file from one of the servers that generated the message so we can correlate the email with the error in the log file?
Thanks
Be sure to check out our Knowledgebase for helpful articles and solutions!
kwhogster
Posts: 644
Joined: Wed Oct 14, 2015 6:51 pm
Location: Wood Ridge NJ USA
Contact:

Re: NRPE Checks Give false Positive

Post by kwhogster »

I am in the process of upgrading the nsclients on all machines

Using Nsclient version 4.4.23

Will post further results may take a few days to get them all updated.

Update yes even after upgrading to 4.4.23 it still happens

so which settings should I change

This is the nrpe.cfg on the Nagios server
# COMMAND TIMEOUT
# This specifies the maximum number of seconds that the NRPE daemon will
# allow plugins to finish executing before killing them off.
command_timeout=60

# CONNECTION TIMEOUT
# This specifies the maximum number of seconds that the NRPE daemon will
# wait for a connection to be established before exiting. This is sometimes
# seen where a network problem stops the SSL being established even though
# all network sessions are connected. This causes the nrpe daemons to
# accumulate, eating system resources. Do not set this too low.

connection_timeout=300

Should the timeout match what I have on the command or services -t parameter?

Give example please
Attachments
nsclient.log
Log file
(99.09 KiB) Downloaded 276 times
User avatar
tgriep
Madmin
Posts: 9177
Joined: Thu Oct 30, 2014 9:02 am

Re: NRPE Checks Give false Positive

Post by tgriep »

The nrpe.cfg file on the Nagios server is not used in the check_nrpe command so you can ignore that file.

On the Nagios server, edit the nagios.cfg file and increase the following to the example below.

Code: Select all

service_check_timeout=120
Then edit the commands.cfg and change the check_nrpe command from

Code: Select all

define command{
        command_name    check_nrpe
        command_line    /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -t 60 -c $ARG1$ $ARG2$ $ARG3$ $ARG4$
}
to

Code: Select all

define command{
        command_name    check_nrpe
        command_line    /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARG1$ $ARG2$ $ARG3$ $ARG4$
}
Then restart the nagios process

Then edit the nsclient.ini file on the Windows system and change all of the settings to the following (There may be more than one in the file)

Code: Select all

timeout = 120
Restart the NSClient agent.

This should help to rule out any timeout issues running the check.

In your latest nsclient.log file, it looks like the commands are not configured correctly or it does not have sufficient permissions to run. You will need to look in to fixing this as well.

Code: Select all

2017-03-21 22:43:20: error:c:\source\nscp\service\NSClient++.cpp:894: Unknown command(s): pschecksystemeventlog available commands: commands {, alias_cpu, alias_cpu_ex, alias_disk, alias_disk_loose, alias_event_log, alias_file_age, alias_file_size, alias_mem, alias_process, alias_process_count, alias_process_hung, alias_process_stopped, alias_sched_all, alias_sched_long, alias_sched_task, alias_service, alias_service_ex, alias_up, alias_volumes, alias_volumes_loose, check_always_critical, check_always_ok, check_always_warning, check_counter, check_cpu, check_critical, check_drivesize, check_eventlog, check_files, check_memory, check_multi, check_negate, check_nscp, check_ok, check_os_version, check_pagefile, check_pdh, check_process, check_service, check_timeout, check_uptime, check_version, check_warning, checkalwayscritical, checkalwaysok, checkalwayswarning, checkcounter, checkcpu, checkcritical, checkdrivesize, checkeventlog, checkfiles, checkmem, checkmultiple, checkok, checkprocstate, checkservicestate, checkuptime, checkversion, checkwarning, filter_perf, negate, nsca_submit, render_perf, timeout, xform_perf}, plugins {, 0, 1, 2, 3, 4, 5, 7}
2017-03-21 22:43:20: error:c:\source\nscp\include\nscapi\nscapi_core_wrapper.cpp:159: Failed to execute command
2017-03-21 22:43:20: error:c:\source\nscp\include\nscapi\nscapi_core_helper.cpp:95: Failed to execute command: PSCheckSystemEventLog
2017-03-21 22:43:23: error:c:\source\nscp\service\NSClient++.cpp:894: Unknown command(s): pscheckapplicationeventlog available commands: commands {, alias_cpu, alias_cpu_ex, alias_disk, alias_disk_loose, alias_event_log, alias_file_age, alias_file_size, alias_mem, alias_process, alias_process_count, alias_process_hung, alias_process_stopped, alias_sched_all, alias_sched_long, alias_sched_task, alias_service, alias_service_ex, alias_up, alias_volumes, alias_volumes_loose, check_always_critical, check_always_ok, check_always_warning, check_counter, check_cpu, check_critical, check_drivesize, check_eventlog, check_files, check_memory, check_multi, check_negate, check_nscp, check_ok, check_os_version, check_pagefile, check_pdh, check_process, check_service, check_timeout, check_uptime, check_version, check_warning, checkalwayscritical, checkalwaysok, checkalwayswarning, checkcounter, checkcpu, checkcritical, checkdrivesize, checkeventlog, checkfiles, checkmem, checkmultiple, checkok, checkprocstate, checkservicestate, checkuptime, checkversion, checkwarning, filter_perf, negate, nsca_submit, render_perf, timeout, xform_perf}, plugins {, 0, 1, 2, 3, 4, 5, 7}
2017-03-21 22:43:23: error:c:\source\nscp\include\nscapi\nscapi_core_wrapper.cpp:159: Failed to execute command
2017-03-21 22:43:23: error:c:\source\nscp\include\nscapi\nscapi_core_helper.cpp:95: Failed to execute command: PSCheckApplicationEventLog
2017-03-22 18:06:49: error:c:\source\nscp\service\NSClient++.cpp:894: Unknown command(s): check_tasksched available commands: commands {, alias_cpu, alias_cpu_ex, alias_disk, alias_disk_loose, alias_event_log, alias_file_age, alias_file_size, alias_mem, alias_process, alias_process_count, alias_process_hung, alias_process_stopped, alias_sched_all, alias_sched_long, alias_sched_task, alias_service, alias_service_ex, alias_up, alias_volumes, alias_volumes_loose, check_always_critical, check_always_ok, check_always_warning, check_counter, check_cpu, check_critical, check_drivesize, check_eventlog, check_explorer, check_files, check_memory, check_ms_win_updates, check_multi, check_negate, check_nscp, check_ok, check_os_version, check_pagefile, check_pdh, check_process, check_service, check_timeout, check_uptime, check_users, check_version, check_warning, checkalwayscritical, checkalwaysok, checkalwayswarning, checkcounter, checkcpu, checkcritical, checkdc, checkdrivesize, checkeventlog, checkfiles, checkmem, checkmultiple, checkok, checkprocstate, checkservicestate, checkuptime, checkversion, checkwarning, filter_perf, negate, nsca_submit, pscheckapplicationeventlog, pschecksystemeventlog, render_perf, timeout, xform_perf}, plugins {, 0, 1, 2, 3, 4, 5, 7}
2017-03-22 18:06:49: error:c:\source\nscp\include\nscapi\nscapi_core_wrapper.cpp:159: Failed to execute command
2017-03-22 18:06:49: error:c:\source\nscp\include\nscapi\nscapi_core_helper.cpp:95: Failed to execute command: check_tasksched
2017-03-22 18:08:49: error:c:\source\nscp\service\NSClient++.cpp:894: Unknown command(s): check_tasksched available commands: commands {, alias_cpu, alias_cpu_ex, alias_disk, alias_disk_loose, alias_event_log, alias_file_age, alias_file_size, alias_mem, alias_process, alias_process_count, alias_process_hung, alias_process_stopped, alias_sched_all, alias_sched_long, alias_sched_task, alias_service, alias_service_ex, alias_up, alias_volumes, alias_volumes_loose, check_always_critical, check_always_ok, check_always_warning, check_counter, check_cpu, check_critical, check_drivesize, check_eventlog, check_explorer, check_files, check_memory, check_ms_win_updates, check_multi, check_negate, check_nscp, check_ok, check_os_version, check_pagefile, check_pdh, check_process, check_service, check_timeout, check_uptime, check_users, check_version, check_warning, checkalwayscritical, checkalwaysok, checkalwayswarning, checkcounter, checkcpu, checkcritical, checkdc, checkdrivesize, checkeventlog, checkfiles, checkmem, checkmultiple, checkok, checkprocstate, checkservicestate, checkuptime, checkversion, checkwarning, filter_perf, negate, nsca_submit, pscheckapplicationeventlog, pschecksystemeventlog, render_perf, timeout, xform_perf}, plugins {, 0, 1, 2, 3, 4, 5, 7}
2017-03-22 18:08:49: error:c:\source\nscp\include\nscapi\nscapi_core_wrapper.cpp:159: Failed to execute command
2017-03-22 18:08:49: error:c:\source\nscp\include\nscapi\nscapi_core_helper.cpp:95: Failed to execute command: check_tasksched
2017-03-22 18:10:49: error:c:\source\nscp\service\NSClient++.cpp:894: Unknown command(s): check_tasksched available commands: commands {, alias_cpu, alias_cpu_ex, alias_disk, alias_disk_loose, alias_event_log, alias_file_age, alias_file_size, alias_mem, alias_process, alias_process_count, alias_process_hung, alias_process_stopped, alias_sched_all, alias_sched_long, alias_sched_task, alias_service, alias_service_ex, alias_up, alias_volumes, alias_volumes_loose, check_always_critical, check_always_ok, check_always_warning, check_counter, check_cpu, check_critical, check_drivesize, check_eventlog, check_explorer, check_files, check_memory, check_ms_win_updates, check_multi, check_negate, check_nscp, check_ok, check_os_version, check_pagefile, check_pdh, check_process, check_service, check_timeout, check_uptime, check_users, check_version, check_warning, checkalwayscritical, checkalwaysok, checkalwayswarning, checkcounter, checkcpu, checkcritical, checkdc, checkdrivesize, checkeventlog, checkfiles, checkmem, checkmultiple, checkok, checkprocstate, checkservicestate, checkuptime, checkversion, checkwarning, filter_perf, negate, nsca_submit, pscheckapplicationeventlog, pschecksystemeventlog, render_perf, timeout, xform_perf}, plugins {, 0, 1, 2, 3, 4, 5, 7}
2017-03-22 18:10:49: error:c:\source\nscp\include\nscapi\nscapi_core_wrapper.cpp:159: Failed to execute command
2017-03-22 18:10:49: error:c:\source\nscp\include\nscapi\nscapi_core_helper.cpp:95: Failed to execute command: check_tasksched
Be sure to check out our Knowledgebase for helpful articles and solutions!
kwhogster
Posts: 644
Joined: Wed Oct 14, 2015 6:51 pm
Location: Wood Ridge NJ USA
Contact:

Re: NRPE Checks Give false Positive

Post by kwhogster »

Made the changes.


What commands and what permissions?

please explain

What would you like me to post
Locked