check_nt Windows alert when service is running

[jemos]

Hello everybody,

some technical information before I tell y question:
Nagios-server: ubuntu with nagios 3
Client to be monitored: Windows Server 2008 R2

Under normal circumstances the "check_nt" is meant to monitor if a service is up and running on a windows machine.
Now we have three servers in use for one of our applications (a development, a testing and a productive machine).
There is one special service which has to be running on the productive machine in order to establish a connection between our mailserver and this application server.
This service is present on every of the mentioned machines above, but it may only run on one server and not on two or even all three machines.
So if something has to be testet we stop this service on the production machine and start it on the testing machine and if testing has finished we do it vice versa.
So far so good.
Now what I would like to achieve is to have a check that is green as long as this service is not running on the testing and the development machine.
The aim is to ensure that this service is running on only one machine and this is the production machine. So whenever this service is being started on another machine the monitoring service for this service has to change from normal to alert.
Is there any way I can achieve this with the normal checks?

[neworderfac33]

Here's how I did it:

In commands.cfg, add the following:

Code: Select all

define command{
        command_name    negatepr
        command_line    $USER1$/negate $USER1$/$ARG1$
}

You can call it anything you like as long as you reference it accordingly in your service definition
Now, in (for example) services.cfg, your service definition can look like this:

Code: Select all

#Create a service for monitoring if the W3SV£ (IIS) service IS running
define service{
       use                     generic-service
       host_name               MYSERVERID
       service_description     Service -  W3SVC/IIS - Alert when running/not running
       first_notification_delay 30
       #1. Alert it it IS running
       check_command           negatepr!check_nt -H $HOSTADDRESS$ -p 12489 -v SERVICESTATE -d SHOWALL -l W3SVC
       #2. Alert if it ISN't running
       #check_command           check_nt!SERVICESTATE!-d SHOWALL -l W3SVC
       }

The negatepr command turns around the output of your service check - in effect it will alert is the service IS running

A variation on this is monitoring when an application, rather than a service IS running:

Code: Select all

# Create a service for monitoring the Explorer.exe process
define service{
       use                     generic-service
       host_name              MYSERVERID
        service_description     Explorer - Alert when running/not running
       #1. Alert if it IS running
       #check_command           negatepr!check_nt -H $HOSTADDRESS$ -p 12489 -v PROCSTATE -d SHOWALL -l explorer.exe
       #2. Alert if it ISN'T running
       #check_command          check_nt!PROCSTATE! -d SHOWALL -l Explorer.exe
       }

Hope this helps

Pete

[kyang]

Thanks! @neworderfac33

@jemos, the example by neworderfac33 is a great one. Don't forget to switch out his example services with the services you want.

Test it out and let us know how it goes!

[neworderfac33]

You're welcome! Prior to seeing this post, I'd only worked out how to "switch" the output for processes, so it was a useful exercise working out how to do it for a service too!
Pete

[neworderfac33]

Just for completeness, I've added the "service NOT running" option command to my original example.

[kyang]

Thanks Pete! that will be helpful!

@jemos, keep us updated!

[jemos]

Hi there,

first of all --> THANKS for the fast reply and the solution.

I do understand what this negatepr does, but unfortunately my Nagios3 says: No data returned from command

My check looks as follows:

# Add the following service definition to monitor the update CRM connector SE service state
define service{
use generic-service
host_name vsbnsrv037
service_description update CRM connector SE
check_command negatepr!check_nt_servicecheck!#IPOFTHEHOST#!SERVICESTATE!SHOWALL!update.CRMconnectorSE
}
The check itself looks like this if I execute it in the linux command shell:
/usr/lib/nagios/plugins/check_nt -H #IPOFTHEHOST# -v SERVICESTATE -d SHOWALL -l update.CRMconnectorSE -p12489

The output of the command in the shell is:
update.CRMconnectorSE: Stopped

I have configured the new command in the "commands.cfg" as provided above.

Where is my fault in thinking?

[kyang]

Is the service running or stopped?

How does the service look like in the UI? Is it the same result?

if it's stopped, you'll need to run the negate plugin like this in the shell, and tell me what it does

Code: Select all

/usr/lib/nagios/plugins/negate -s /usr/lib/nagios/plugins/check_nt -H <IP> -v SERVICESTATE -d SHOWALL -l update.CRMconnectorSE -p 12489

In your libexec directory, you should have a negate plugin, passing the -s allows you to substitute the output text.

Also in your check_command its listed as, is that correct? If you could show me how you exactly defined your service that would be great. (You can take out the IP of course)

Code: Select all

check_nt_servicecheck!

[neworderfac33]

Afternoon, all!
I just took a look at your service definition:

Code: Select all

define service{
use generic-service
host_name vsbnsrv037
service_description update CRM connector SE
check_command negatepr!check_nt_servicecheck!#IPOFTHEHOST#!SERVICESTATE!SHOWALL!update.CRMconnectorSE
}

I'm probably going to regret this, but shouldn't it just be:

Code: Select all

check_command negatepr!check_nt -H 99.99.99.99 -v SERVICESTATE -d SHOWALL -l update.CRMconnectorSE

I'm not sure where "check_nt_servicecheck" comes from?

P.S. The only reason I called it "negatepr" is because "pr" are my initials!
Cheers

Pete

[kyang]

Thanks @neworderfac33!

That is what I was thinking too,
It should just be

Code: Select all

negatepr!check_nt

Thanks for clarifying the pr! I have it setup on mine with just negate, so "pr" being your initials is great!

@jemos, let us know if this helped!