nsclient cannot display full event log

[michaelli]

Hi,
I am using nsclient CheckEventLog for monitoring windows system log.

But sometime, It cannot display the full error messages in nagiosxi.

Any parameter setting or syntax how to configure in nsclient.ini for display long log description?

[jdalrymple]

It's probably getting truncated by the 1024K limit built into NRPE. You can change this in nsclient.ini as a config option:

Code: Select all

[/settings/NRPE/server]
payload length = 1024

But you have to recompile NRPE for them to talk at that point.

Change the following 2 lines in the include/common.h file in the NRPE source code then recompile.

Code: Select all

#define MAX_INPUT_BUFFER	1024	/* max size of most buffers we use */
#define MAX_PACKETBUFFER_LENGTH	1024		/* max amount of data we'll send in one query/response */

You specifically only need check_nrpe, and I'd rename it to check_nrpe_long and keep your original so you don't have to configure all of your other nrpe services in your environment at once:

[michaelli]

Hi jdalrymple,

Just to clarify is this setting work on nsclient bulid-in real time windows system checking?

[jolson]

Michaelli,

This will not work for real time windows system checking, since that is handled by NSCA and not NRPE.

To adjust the setting you're looking for, check out the following documentation: http://docs.nsclient.org/reference/NSCAClient.html

/settings/NSCA/client/targets/default payload length 512 PAYLOAD LENGTH

So ultimately you'll want the following in your nsclient.ini file:

Code: Select all

/settings/NSCA/client/targets/default
payload length = 2048

[michaelli]

Hi jolson,

If I set the payload length under below path and create a error event but nagios cannot display the error event.

Code: Select all

[/settings/NSCA/n2]
channel = NSCA2

[/settings/NSCA/n2/targets/default]
payload length = 1024
host=172.31.4.40
encryption=none
password=P@ssw0rd

Moreover, There has a log in nagios server when I generate the error event. (IP 172.31.8.63 is nsclient host). This seems that nagios cannot display when payload set to 1024.

Code: Select all

Jun 11 11:10:17 ngonap01 xinetd[3862]: START: nsca pid=11100 from=::ffff:172.31.8.63
Jun 11 11:10:18 ngonap01 xinetd[3862]: EXIT: nsca status=0 pid=11100 duration=1(sec)

[jdalrymple]

Just like with nrpe, you'd have to recompile nsca to handle the additional payload. This is fairly trivial. Download it and change the following line in include/common.h:

Code: Select all

#define MAX_PLUGINOUTPUT_LENGTH 512

The client and server numbers will always have to match up otherwise there is a CRC error. This means that you'll have to adjust any other systems sending data to that particular nsca daemon. It might be desirable to start a 2nd daemon on another port.

[michaelli]

Hi jdalrymple,

Do you mean we need to re-compile the nsca in nagios server side? Or is it possible set the payload in nsca configuration file?

As we install the Nagios XI by fullinstall. So could you please provide a source and procedure for us?

[jolson]

To recompile nsca, follow these instructions.

Code: Select all

cp nsca.cfg /root/nsca.cfg (backup nsca.cfg)
cd /tmp
wget http://downloads.sourceforge.net/project/nagios/nsca-2.x/nsca-2.9.1/nsca-2.9.1.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fnagios%2Ffiles%2Fnsca-2.x%2Fnsca-2.9.1%2F&ts=1434124312&use_mirror=iweb
mv nsca* nagnsca
tar zxf nagnsca
cd nsca-2.9.1/
vi include/common.h (change #define MAX_PLUGINOUTPUT_LENGTH 512 to #define MAX_PLUGINOUTPUT_LENGTH 1024)
./configure
make all
cp src/nsca /usr/local/nagios/bin/nsca

[michaelli]

Hi jolson,

Hi Jolson,

My existing nsca version is 2.9.1 which same as you provided in URL.

Code: Select all

[root@nagiosxi bin]# pwd
/usr/local/nagios/bin
[root@nagiosxi bin]# ./nsca

NSCA - Nagios Service Check Acceptor
Copyright (c) 2009 Nagios Core Development Team and Community Contributors
Copyright (c) 2000-2009 Ethan Galstad
Version: 2.9.1
Last Modified: 01-27-2012
License: GPL v2
Encryption Routines: AVAILABLE

Usage: ./nsca -c <config_file> [mode]

In your source nsca 2.9.1, the original MAX_PLUGINOUTPUT_LENGTH 4096

Code: Select all

[root@nagiosxi include]# pwd
/var/tmp/nsca-2.9.1/include
[root@nagiosxi include]# grep MAX_PLUGINOUTPUT common.h
#define MAX_PLUGINOUTPUT_LENGTH 4096
#define OLD_PACKET_LENGTH (( sizeof( data_packet) - ( MAX_PLUGINOUTPUT_LENGTH - OLD_PLUGINOUTPUT_LENGTH)))
        char      plugin_output[MAX_PLUGINOUTPUT_LENGTH];

Therefore I do not re-compile nsca and I adjust the payload length to 4096 in client side

Code: Select all

[/settings/NSCA/n1/targets/default]
host=172.31.4.166
encryption=none
password=P@ssw0rd
payload length = 4096

And generate a error messages, but result are same. It cannot show long description. Attached nsclient debug log for reference.
What is payload length units? is it in characters or bytes?

Because our operation team do not accept this behavior. if error occurs, they can not read the error message completely and need to login host for detail. This is very inconvienance for our daily operation.

Any alternative way or plugin to solve this issue in nagiosxi?

[Box293]

We also need to adjust the database to allow more data.

Execute these four commands at a command line on your Nagios XI host (each command is one long line):

Code: Select all

echo "use nagios;alter table nagios_servicestatus modify output varchar(65535) not null;alter table nagios_servicestatus modify long_output varchar(65535) not null;alter table nagios_servicestatus modify perfdata varchar(65535) not null;" | mysql -pnagiosxi

echo "use nagios;alter table nagios_hoststatus modify output varchar(65535) not null;alter table nagios_hoststatus modify long_output varchar(65535) not null;alter table nagios_hoststatus modify perfdata varchar(65535) not null;" | mysql -pnagiosxi

echo "use nagios;alter table nagios_servicechecks modify output varchar(65535) not null;alter table nagios_servicechecks modify long_output varchar(65535) not null;alter table nagios_servicechecks modify perfdata varchar(65535) not null;" | mysql -pnagiosxi

echo "use nagios;alter table nagios_hostchecks modify output varchar(65535) not null;alter table nagios_hostchecks modify long_output varchar(65535) not null;alter table nagios_hostchecks modify perfdata varchar(65535) not null;" | mysql -pnagiosxi

The next time a service is updated it should show the full output.