Number of processes and users logged in with NSClient++

[DanielB]

Hi all!

I'm trying to monitor the number of processes and the users logged in with NSClient++ on a host with Windows XP. I know this can be done with SNMP using HOST-RESOURCES-MIB::hrSystemProcesses.0 and HOST-RESOURCES-MIB::hrSystemNumUsers.0. In fact, I tried it and seems to give the correct results. But I was asked to do as many of checks via NRPE. I Don't know if this will be an unnecessary complication, since (at least in the latest stable version of NSClient++: 0.4.1.105) I see no commands to check these two metrics.

For example, for the case of the processes, I have read the documentation of check_process [1]. I added something like the following in the nsclient.ini for testing:

Code: Select all

check_total_procs = check_process process=* "warn=total > 150" "crit=total > 200"

But when I do a test with check_nrpe, I get the following:

Code: Select all

# /usr/lib/nagios/plugins/check_nrpe -H <windows-ip> -c check_total_procs
OK: All processes are running.|'process'=0 'warn'=0 'crit'=0

It seems it are not taking the parameters I'm passing ...

Someone had experience in taking these results with NSClient++?

Thanks in advance.

Best regards,
Daniel

[1] http://docs.nsclient.org/reference/Chec ... ck_process

[slansing]

What happens when you specify an actual process there? Like:

Code: Select all

check_process process=explorer.exe "warn=working_set > 70m"

I'm thinking the wildcard is not being read properly, unfortunately, we might have to find a plugin to check this for you.

[DanielB]

Hello, slansing.

What happens when you specify an actual process there? Like:

Code: Select all

check_process process=explorer.exe "warn=working_set > 70m"

I'm thinking the wildcard is not being read properly, unfortunately, we might have to find a plugin to check this for you.

This was one of the examples I saw in the documentation. But when I tried to test it using check_nrpe, I got the following:

Code: Select all

# /usr/lib/nagios/plugins/check_nrpe -H <windows-ip> -c check_process -a process=explorer.exe "warn=working_set > 70m"
OK: All processes are running.|'process'=0 'warn'=0

Did you mean to test it that way?

That is, I still don't understand how to work the remote invocation since I do not see where check_process is defined (similarly to how we define the commands in nrpe.cfg). For example, I tried to test something like the following:

Code: Select all

# /usr/lib/nagios/plugins/check_nrpe -H <windows-ip> -c check_process -a explorer.exe
OK: All processes are running.|'explorer.exe'=2;0;1

It would seem that the first parameter is the process, but I still don't see the logic of the operation in the invocation.

Thanks for responding.

Best regards,
Daniel

[lmiltchev]

I am not sure if you can define the "check_process" in "nsclient.ini" file (similarly to how we define the commands in nrpe.cfg).
You will have to contact the NSClient++ developer.

To check one, two, or all of the processes, you can run from the CLI something like this:

Code: Select all

[root@testbox libexec]# ./check_nrpe -H <client ip> -c check_process -a explorer.exe
OK: All processes are running.|'explorer.exe'=1;0;1

Code: Select all

[root@testbox libexec]# ./check_nrpe -H <client ip> -c check_process -a explorer.exe chrome.exe
CRITICAL: chrome.exe: stopped < critical|'explorer.exe'=1;0;1 'chrome.exe'=0;0;1

Code: Select all

[root@testbox libexec]# ./check_nrpe -H <client ip> -c check_process -a *
CRITICAL: 0: stopped < critical, 100d: stopped < critical, 2d: stopped < critical, 365d: stopped < critical, check_apacherequests.pl: stopped < critical, check_apache_status: stopped < critical, check_apachestatus.pl: stopped < critical, check_apt: stopped < critical, check_asterisk.pl: stopped < critical, check_asterisk_sip_peers.sh: stopped < critical, check_bl: stopped < critical, check_bpi.php: stopped < critical, check_breeze: stopped < critical, check_by_ssh: stopped < critical, check_cas.pl: stopped < critical, check_cciss-1.12: stopped < critical, check_cisco_ipsla.pl: stopped < critical, check_cisco_tp.pl: stopped < critical, check_clamd: stopped < critical, check_cluster: stopped < critical, check_cpu: stopped < critical, check_cpu_stats.sh: stopped < critical, check_dell_openmanage.pl: stopped < critical, check_dhcp: stopped < critical, check_dig: stopped < critical, check_dir: stopped < critical, check_disk: stopped < critical, check_disk_new: stopped < critical, check_disk_smb: stopped < critica

[DanielB]

Hello, lmiltchev.

Thanks for your reply.

For this I have developed the following PowerShell script:

Code: Select all

$process = (Get-Process *).Count

$warning = $args[0]
$critical = $args[1]

$return_ok = 0
$return_warning = 1
$return_critical = 2

If ( $process -ge $critical)
{
	$message = "CRITICAL"
        $return_value = $return_critical

        }
	Elseif ( $process -ge $warning )
	{
		$message = "WARNING"
		$return_value = $return_warning
	}
		Else {
				$message = "OK"
				$return_value = $return_ok
		}

echo "${message}: System Processes: $process"

exit $return_value

Then in nsclient.ini I configured the following:

Code: Select all

[/settings/external scripts/wrappings]
ps1 = cmd /c echo scripts\\%SCRIPT% %ARGS%; exit($lastexitcode) | C:\WINDOWS\system32\windowspowershell\v1.0\powershell.exe -command -

Code: Select all

[/settings/external scripts/wrapped scripts]
check_total_procs = check_procs.ps1 100 200

Regarding to users connected, I used a plugin I found on Nagios Exchange (the version 0.7 of ejo1974):

http://exchange.nagios.org/directory/Pl ... ns/details


Best regards,
Daniel

[sreinhardt]

Awesome job! Looks like everything should be working from what you posted, all set and ready to be locked up?

[DanielB]

Hello, sreinhardt.

Awesome job! Looks like everything should be working from what you posted, all set and ready to be locked up?

Yes, I think that with the plugin that I developed and the one I found in Nagios Exchange, I can give these checks as operationals. I hope someone else will find it useful.

Best regards,
Daniel

[abrist]

Great!. Locking thread.