Plugin_ouput issue

[Sacotram]

Hello!

I have two servers, I will name it server1 and server2, with an instance of nagios installed in each. Server1 is the central server (passive checks) and collects results from other distributed monitoring servers. Server2 is a distributed monitoring server (active checks). On the latter I have configured a service with a check_command that verifies backups on a Backup server:

Code: Select all

define service{
        use                             (...)-generic-service,srv-pnp
        host_name                       (...)-BACKUP02               
        service_description             DNV-BE_EventLog_JobWarnings
        servicegroups                  (...)-Backups   
        check_command                   check_nrpe!CheckEventLog -a filter=new file=application  MaxWarn=1  'filter=generated gt -1d AND id = 33919' truncate=800 unique descriptions
        }

This service check works perfectly and I'm able to see the result on the server2's Nagios GUI at this specific service's page. But I don't get the same display on the server1's Nagios GUI - please check the images attached.

To understand even better what the issue is I checked another similar distributed monitoring server which executes the same service check and sends the result to server1 and the display is equal on either server1 and this server in question. For that reason I compared its configurations (the definition of check_command, the service itself, the send_nsca.cfg and even the submit_service_check) with server 2 for this specific service and realized that it's identical to both.

Later I checked the status.dat on server1 and server2 and saw that on the first one the long_plugin_output is empty and on the second one is not.
server1

Code: Select all

 
plugin_output=Backup Exec(warning, 33919, success)[Backup Exec Alert: Job Warning
long_plugin_output=

server2

Code: Select all

plugin_output=Backup Exec(warning, 33919, success)[Backup Exec Alert: Job Warning
long_plugin_output=(Server: "BACKUP02") (Job: "Sharepoint 2013-Log") The scheduling options selected for this job do not (...)
 

Any help will be appreciated a lot.
Thank you

[jdalrymple]

Presumably Server 1 is processing with NSCA?
How is Server 2 submitting check results to server 1?

Within the 2nd question no doubt lies the answer to the problem. Also - it's safe to assume this isn't a deal where it worked yesterday but is broken today right?

[Sacotram]

Hello!
Thank you.
Server2 submits results through nsca and server1 processes it.

The only deal is that the server1 never gets the result in whole regarding this service check in server2. And as I said before I have another similar server performing the same service check, sending it through nsca to server1 and the result is displayed in whole.

Finally, it wasn't something that was working yesterday and stopped today. I've been having this problem since the time I first configured this service check in server2.

[jdalrymple]

nsca populates the plugin_output field by default and NOT the long_plugin_output.

What do you see in status.dat for "another similar server performing the same service check"? Is it populating long_plugin_output

Extending your output should be as simple as aggregating all the data into the send_nsca passive check submitter. If you're using macros combine $SERVICEOUTPUT$ and $LONGSERVICEOUTPUT$

[Sacotram]

Sorry for taking so long to respond, but I've been away from office.

Yes, in the status.dat for the "other similar server performing the same service check" only the plugin_output is filled and the long_plugin_output is empty.

[jdalrymple]

So presumably this just means that the plugin is outputting different data between the 2 servers. Can you copy the plugin from the working server to the server not working the way you'd like?

[Sacotram]

Hello!

Which plugin are you mentioning? The nsca binary file, the nrpe check (CheckEventLog) or the submit_check?

I enhance again the fact that in the server2 the long_plugin_output in status.dat is filled while in the working server it is not. Only the plugin_output is filled with results and the other is always empty.

[jdalrymple]

Server 1 is interpreting only what server 2 sends using the following format:

Code: Select all

<hostname>[tab]<svc_description>[tab]<return_code>[tab]<plugin_output>[newline]
    |                  |                   |                  |
    |                  |                   |                  |
    v                  v                   v                  v
host_name     service_description    current_state      plugin_output

In this diagram, the top is what server 2 is sending with send_nsca and the bottom is what server 1 is doing with the data with respect to its own status.dat. That behavior won't change, it's a characteristic of NSCA. In order to get the entire output of the plugin from server 2 into server 1 you will have to concatenate long and short prior to shipping it to server 1. Even then the long_plugin_output will still be empty, but you will have what you want at server 1.

[Sacotram]

Ok, let me check again my configurations and I'll get back to you. Thank you very much

[abrist]

No problem, let us know when you have more information.