CHECK_NRPE : Error : Connection Reset by Peer

[amitgupta19]

Non Working Server
[svxxxx@dmxxxxxxxbwlprd24 ~]$ cat /etc/hosts.allow

#
# hosts.allow This file contains access rules which are used to
# allow or deny connections to network services that
# either use the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# See 'man 5 hosts_options' and 'man 5 hosts_access'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers
#

Working Server

[svxxx@xxxxxhuat01 ~]$ cat /etc/hosts.allow

#
# hosts.allow This file contains access rules which are used to
# allow or deny connections to network services that
# either use the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# See 'man 5 hosts_options' and 'man 5 hosts_access'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers
#


yyy.yyy.yyy.yyy is the IP another Nagios Server. This is not being used now.

[Box293]

On the non working server what is the output from these commands:

Code: Select all

service xinetd status

service nrpe status

We can turn on NRPE debugging to collect more information.

Edit the file:
/usr/local/nagios/etc/nrpe.cfg

Define
debug=1
(it will currently be debug=0)

Save the file and
service xinetd restart
or
service nrpe restart

Now we need to add an option to the rsyslog server so it processes debug messages
Edit the file:
/etc/rsyslogd.conf
Find /var/log/messages
The line in the config file will look like:
*.info;mail.none;authpriv.none;cron.none /var/log/messages

We need to add the following to the line:
*.info;mail.none;authpriv.none;cron.none;daemon.debug /var/log/messages

Save the file and
service rsyslog restart

Now there should be more information logged in /var/log/messages

[amitgupta19]

Please find here with the logs.
If you need anything else do let me know.

[Box293]

Are the servers on the same subnet? Does the port 5666 traffic have to pass through a firewall?

I know you did a telnet test but I would like you to do an nmap test as per the last part of this KB article. Please post the commands and output:

https://support.nagios.com/kb/article/n ... s-617.html

My only other suggestion is to completely uninstall NRPE and try installing from scratch.

[amitgupta19]

It is giving the output as expected and getting connected.

Now i am going for the reinstall of the NRPE on the server.

[dwhitfield]

In the past, "CHECK_NRPE: Receive header underflow - only -1 bytes received (4 expected)." has meant that there was a misconfiguration of nrpe.cfg. I have also seen the suggestion that multiple NRPE instances could cause this.

What's the output of the following?

Code: Select all

netstat -anp | grep 5666

[Box293]

Thanks for the input @dwhitfield, much appreciated.

[amitgupta19]

@dwhitfield Now i am in process of reinstalling the NRPE Agent on the server.

Once the Agent is reinstalled, i will update you.

Can you please tell me a way a to install the NRPE Agent on the server which are isolated from the Internet?

While installing the agent it is getting failed and looking for some packages from the internet.

[mbellerue]

There's really no magic to this part. If your system does not have access to the internet, you will need to download the required packages and get them installed to the server manually. It will be a similar process to what ever you do to keep the server up to date with OS patches.

[amitgupta19]

Is there any document, which talks about the packages which are required for installing the NRPE ?

I can download them manually and install before installing the NRPE Agent.