Page 1 of 4

CHECK_NRPE: Receive header underflow - only 0 bytes received

Posted: Mon Nov 05, 2018 2:27 pm
by raydx
I have Nagios Core v4.3.4 installed on a VM running Ubuntu v16.04.

I have the NSClient++ Monitoring Agent installed on several Windows Server 2012 R2 Standard machines.

The issue I'm having is that one of the Servers is returning
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected) for one of the services being monitored.

No issues with the other services being monitored. nsclient.ini is identical to one on another server monitoring that same service.

I'm not sure where to begin trouble-shooting. nsclient.ini is attached. Please let me know if other files are needed.
nsclient.ini
(1.56 KiB) Downloaded 330 times
Thanks!

Re: CHECK_NRPE: Receive header underflow - only 0 bytes rece

Posted: Mon Nov 05, 2018 5:47 pm
by scottwilkerson
Can you share what service is being monitored that is causing this?

Can you share the command you are using?

Do all of the Windows servers have the same services running?

Re: CHECK_NRPE: Receive header underflow - only 0 bytes rece

Posted: Tue Nov 06, 2018 12:47 pm
by raydx
Thanks Scott.

Monitor Loader errors is the service being monitored.

define service{
use generic service
host_name per310-02,per310-03
service_description Monitor Loader errors
check_command check_nrpe!check_eventlog -a "filter=provider = 'SLMD UV Monitor Loader' and id = 0 and message like 'Config
socket blocked' OR message like 'Inconsistent state'
}

I have two other servers monitoring the same services. The server in question is part of a host group with 11 other servers.
Those servers do have a "core" of services that they are monitoring plus one that is for a particular server only

Re: CHECK_NRPE: Receive header underflow - only 0 bytes rece

Posted: Tue Nov 06, 2018 2:16 pm
by scottwilkerson
I think you are missing a " at the end of your check_command, try:

Code: Select all

define service{
use generic service
host_name per310-02,per310-03
service_description Monitor Loader errors
check_command check_nrpe!check_eventlog -a "filter=provider = 'SLMD UV Monitor Loader' and id = 0 and message like 'Config socket blocked' OR message like 'Inconsistent state'"
}

Re: CHECK_NRPE: Receive header underflow - only 0 bytes rece

Posted: Tue Nov 06, 2018 2:34 pm
by raydx
I verified that there is a " at the end of my check_command.

Re: CHECK_NRPE: Receive header underflow - only 0 bytes rece

Posted: Tue Nov 06, 2018 3:05 pm
by lmiltchev
How did you install NRPE on the Ubuntu machine? It's possible that the --enable-command-args flag hasn't been used, so you are not able to pass arguments. You may try to remove your current version of NRPE and install from source. For more information on the topic, see this:

https://github.com/NagiosEnterprises/nrpe/issues/92

Re: CHECK_NRPE: Receive header underflow - only 0 bytes rece

Posted: Tue Nov 06, 2018 4:42 pm
by raydx
I'll read more on the topic.

What is puzzling me is that the issue is with only one service on one server. No other nrpe issues...

Re: CHECK_NRPE: Receive header underflow - only 0 bytes rece

Posted: Tue Nov 06, 2018 4:45 pm
by lmiltchev
Do you have other checks (that work), in which you pass arguments?

Re: CHECK_NRPE: Receive header underflow - only 0 bytes rece

Posted: Tue Nov 06, 2018 6:30 pm
by raydx
I have other check_nrpe commands with arguments that function as expected.

The one in question, functions on one server, but not another.

Re: CHECK_NRPE: Receive header underflow - only 0 bytes rece

Posted: Wed Nov 07, 2018 2:30 pm
by lmiltchev
I have other check_nrpe commands with arguments that function as expected.
Hmm, in this case your NRPE must be compiled with --enable-command-args, and the issue must be caused by something else.

Can you run the following commands on the Ubuntu box, and show the output?

Code: Select all

ip addr
/usr/local/nagios/bin/nrpe
/usr/local/nagios/libexec/check_nrpe -H <windows server ip>
/usr/local/nagios/libexec/check_nrpe -H <windows server ip> -p 5666 -c CheckMem -a MaxWarn=80% MaxCrit=90% ShowAll type=physical
Note: Change the paths to the nrpe and check_nrpe if needed (if they are different on your system).