NSClient - ERROR: Invalid return from command: check_pdh

[emartine]

I updated an older 0.3.9.x nsclient++ on a machine where the commands below all used to work. Seems like some of this syntax is now legacy? I am running 0.4.2 nsclient
From the commands below the two commands that no longer work are Active_Virtual_Memory_in_MB and Processor_Timing.
Any idea what the proper syntax should be? Should the rest of the syntax for these also change?



command_name Exchange_User_Count
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\MSExchange RpcClientAccess\User Count","User Count %.f" -w 2000 -c 3000

command_name Exchange_Pending_Ping_Count
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\MSExchange ActiveSync\Ping Commands Pending","Pending Commands Count %.f" -w 2000 -c 3000

command_name Exchange_OWA_Unique_User_Count
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\MSExchange OWA\Current Unique Users","Unique User Count %.f" -w 2000 -c 3000

command_name Exchange_RPC_Connection_Count
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\MSExchange rpcclientaccess\connection count","RPC Connection Count %.f" -w 5000 -c 8000

command_name Exchange_RPC_Average_Latency
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\MSExchange rpcclientaccess\RPC Averaged Latency","RPC Averaged Latency %.f" -w 200 -c 300

command_name Exchange_RPC_User_Count
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\MSExchange rpcclientaccess\user count","RPC User Count %.f" -w 2500 -c 4000

command_name RPC_HTTP_Connection_Count
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\rpc/http proxy\current number of incoming rpc over http connections","user rpc http connections Count %.f" -w 4000 -c 6000

command_name HTTP_PROXY_Unique_Users
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\rpc/http proxy\current number of unique users","rpc unique users %.f" -w 2000 -c 3000

command_name Processor_Timing
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\processor(_Total)\% processor time","Processor Timing %.f" -w 70 -c 100

command_name Active_Virtual_Memory_in_MB
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\vm memory\memory active in mb","MB of Active Memory %.f" -w 12000 -c 15500

[tgriep]

Can you post the error message you are receiving when you run those commands?
Can you upload your nsclient.ini file?

[emartine]

It is in the subject line.

NSClient - ERROR: Invalid return from command: check_pdh





Note that it is only the last two counter checks that are having a problem.
Here is the INI


[/modules]
CheckDisk = 1
CheckEventLog = 1
CheckExternalScripts = 1
CheckHelpers = 1
CheckNSCP = 1
CheckSystem = 1
CheckWMI = 1
NRPEServer = 1
NSClientServer = 1


[/settings/default]
allowed hosts = some host ip addresses


[/settings/NRPE/server]
allow arguments = true
allow nasty characters = true

[/settings/external scripts]
allow arguments = true
allow nasty characters = true

[/settings/external scripts/alias]
alias_cpu = checkCPU warn=80 crit=90 time=5m time=1m time=30s
alias_cpu_ex = checkCPU warn=$ARG1$ crit=$ARG2$ time=5m time=1m time=30s
alias_disk = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll FilterType=FIXED
alias_disk_loose = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll FilterType=FIXED ignore-unreadable
alias_event_log = CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1 "filter=generated gt -2h AND severity NOT IN ('success', 'informational') AND source != 'SideBySide'" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"
alias_file_age = checkFile2 filter=out "file=$ARG1$" filter-written=>1d MaxWarn=1 MaxCrit=1 "syntax=%filename% %write%"
alias_file_size = CheckFiles "filter=size > $ARG2$" "path=$ARG1$" MaxWarn=1 MaxCrit=1 "syntax=%filename% %size%" max-dir-depth=10
alias_mem = checkMem MaxWarn=80% MaxCrit=90% ShowAll=long type=physical type=virtual type=paged type=page
alias_process = checkProcState "$ARG1$=started"
alias_process_count = checkProcState MaxWarnCount=$ARG2$ MaxCritCount=$ARG3$ "$ARG1$=started"
alias_process_hung = checkProcState MaxWarnCount=1 MaxCritCount=1 "$ARG1$=hung"
alias_process_stopped = checkProcState "$ARG1$=stopped"
alias_sched_all = CheckTaskSched "filter=exit_code ne 0" "syntax=%title%: %exit_code%" warn=>0
alias_sched_long = CheckTaskSched "filter=status = 'running' AND most_recent_run_time < -$ARG1$" "syntax=%title% (%most_recent_run_time%)" warn=>0
alias_sched_task = CheckTaskSched "filter=title eq '$ARG1$' AND exit_code ne 0" "syntax=%title% (%most_recent_run_time%)" warn=>0
alias_service = checkServiceState CheckAll
alias_service_ex = checkServiceState CheckAll "exclude=Net Driver HPZ12" "exclude=Pml Driver HPZ12" exclude=stisvc
alias_up = checkUpTime MinWarn=1d MinWarn=1h
alias_updates = check_updates -warning 0 -critical 0
alias_volumes = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll=volumes FilterType=FIXED
alias_volumes_loose = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll=volumes FilterType=FIXED ignore-unreadable
default =

[/settings/eventlog]
buffer size = 512000
debug = false
lookup names = true
syntax =


[/settings/NSClient/server]
port = some port number

[tgriep]

Could you update the NSClient software to the stable 0.4.3 version and see if that fixes the issue?

[emartine]

Can't install that version at this time until it has gone through evaluation. Why do you say it would "fix" the issue?

[Box293]

Can't install that version at this time until it has gone through evaluation. Why do you say it would "fix" the issue?

0.4.2 and 0.4.3 are somewhat buggy, very disappointing releases (these releases are a major re-write). Personally I find 0.4.1.105 quite stable however 0.4.3 does resolve your problem.

Here's the evidence:

Code: Select all

Command:
./check_nt -H win2008r2-01 -p 12489 -v COUNTER -l "\\processor(_Total)\% processor time","Processor Timing %.f" -w 70 -c 100

0.3.9.330

Code: Select all

Processor Timing 0 | 'Processor Timing %.f'=0.000000%;70.000000;100.000000;

0.4.1.105:

Code: Select all

Processor Timing 0 | 'Processor Timing %.f'=0.000000%;70.000000;100.000000;

0.4.2.114:

Code: Select all

NSClient - ERROR: Invalid return from command: check_pdh

0.4.3.143:

Code: Select all

Processor Timing 0 | 'Processor Timing %.f'=0.000000%;70.000000;100.000000;

[emartine]

I upgraded to the newer client (NSCP-0.4.3.143) but I am still getting

NSClient - ERROR: Invalid return from command: check_pdh for this check:

command_name Active_Virtual_Memory_in_MB
command_line $USER1$/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l "\\vm memory\memory active in mb","MB of Active Memory %.f" -w 12000 -c 15500

Processor timing works fine. Any idea what is going on?

Is there another way to check for these counters?

[Box293]

Can you log onto the windows system and open perfmon.

Does the performance counter "\\vm memory\memory active in mb" actually exist?

[emartine]

Can you log onto the windows system and open perfmon.

Does the performance counter "\\vm memory\memory active in mb" actually exist?

This is a good question so I went hunting for the why on it. With so many servers migrating I didn't distinguish a physical from a VM.

My results on this...

My issue was that older < 0.4.2 clients on physical and VM servers gave a response. But this counter doesn't exist on physical servers yet the older 0.4.2 client returns zero as a result making it seem like it is getting a reply.

/usr/local/nagios/libexec/check_nt -H <physical_host> -p 1248 -v COUNTER -l "\\vm memory\memory active in mb","MB of Active Memory %.f" -w 12000 -c 15500
MB of Active Memory 0 | 'MB of Active Memory %.f'=0.000000%;12000.000000;15500.000000;

/usr/local/nagios/libexec/check_nt -H <vitual_host> -p 1248 -v COUNTER -l "\\vm memory\memory active in mb","MB of Active Memory %.f" -w 12000 -c 15500
MB of Active Memory 409 | 'MB of Active Memory %.f'=512.000000%;12000.000000;15500.000000;


So I removed the counter on physical servers since it was useless. Please feel free to close this.