[Solved] Installed NRPE on Nagios-port 5666 connect refused

[jbruyet]

Hey all, I just built a Nagios server and I can bring up the web page and see that my server is doing well. I installed NRPE and for some reason I can't get NRPE working. Here's what I'm seeing when I test NRPE (.7 is my Nagios server):

Code: Select all

[root@Nagios nrpe-2.15]# /usr/local/nagios/libexec/check_nrpe -H 192.168.1.7
connect to address 192.168.1.7 port 5666: Connection refused
connect to host 192.168.1.7 port 5666: Connection refused[root@Nagios nrpe-2.15]# 

I thought it might be a firewall issue but:

Code: Select all

[root@Nagios nrpe-2.15]# getenforce
Disabled
[root@Nagios nrpe-2.15]# service iptables status
iptables: Firewall is not running.
[root@Nagios nrpe-2.15]#

There must be something going on because when I hit it with NMAP:

Code: Select all

Nmap scan report for 192.168.1.7
Host is up (0.00022s latency).                                                             
PORT     STATE  SERVICE                                                                    
5666/tcp closed nrpe                                  

Any ideas on what else it might be?

Thanks,

Joe B

[eloyd]

Your nmap result of "closed" means it can't connect. I'd start to make sure that it's actually listening:

Code: Select all

lsof -i:5556

(Assuming you have lsof installed. If not, install it from wherever you install stuff from).

Are you running NRPE out of xinetd or as a standalone daemon? That will make a difference in troubleshooting, but if it's xinetd, make sure your config file looks very similar to this:

Code: Select all

# cat /etc/xinetd.d/nrpe

# default: on
# description: NRPE (Nagios Remote Plugin Executor)
service nrpe
{
        flags           = REUSE
        socket_type     = stream
        port            = 5666
        wait            = no
        user            = nagios
        group           = nagios
        server          = /usr/local/nagios/bin/nrpe
        server_args     = -c /usr/local/nagios/etc/nrpe.cfg --inetd
        log_on_failure  += USERID
        disable         = no
        only_from       = 192.168.1.1 10.1.1.1 other.ip.goes.here
}

It's that "only_from" line that most people miss. It's a space-separated list of IP addresses (or names) that you are allowed to connect from.

[jbruyet]

Wow, strike one and strike two:

Code: Select all

[root@Nagios jobee]# lsof -i:5556
[root@Nagios jobee]# 
[root@Nagios jobee]# cat /etc/xinetd.d/nrpe
cat: /etc/xinetd.d/nrpe: No such file or directory
[root@Nagios jobee]# 

Thanks,

Joe B

[eloyd]

Well there's your problem - you typed what I told you too!!!

It's not 5556, it's 5666.

Code: Select all

lsof -i:5666

Let's see what that does!

[jbruyet]

Ok, back from a vacation spoiling nieces and nephews.

LOL, I should have looked a little closer. Here's my result:

Code: Select all

[jobee@Nagios ~]$ lsof -i:5666
[jobee@Nagios ~]$ 

Thanks,

Joe B

[eloyd]

So it looks like NRPE is not actually running. Which may explain why it's hard to connect to it.

[tmcdonald]

jbruyet, did you get NRPE working?

[jbruyet]

Sorry everyone, I just found this open thread. Yes I did get it working; Nuke and Repopulate is an extreme yet highly effective maneuver. Thanks for all the help!

Thanks,

Joe B