NSClient++ - 0.4.3.131 debug log

[michaelli]

Hi,

I install nsclient agent into some of windows 2003 and windows 2008 server and use the same nsclient.ini file. All are running functionally with real time passive system event log except one windows 2008 server. The install nsclient agent success without any error. When I get the system alert, it is unable to send NSCA to nagios server.

I run nsclient in debug mode (nscp test) and below is the debug log file for refer.

Use windows command to generate alert message

Code: Select all

eventcreate /ID 9 /L system /T error /SO Myeventsource4 /D "testing system error "

nscp console debug log, what is the error listed as below. I cannot search any information in the internet.

Code: Select all

D   eventlog Reading eventlog messages...
D   eventlog Processing: 000000000226B650
E       nsca Failed to read data: End of file
                    D:\source\nscp\include\socket/client.hpp:148
D       nsca Retrying attempt 0 of 3
E       nsca Failed to read data: End of file
                    D:\source\nscp\include\socket/client.hpp:148
D       nsca Retrying attempt 1 of 3
E       nsca Failed to read data: End of file
                    D:\source\nscp\include\socket/client.hpp:148
D       nsca Retrying attempt 2 of 3
E       nsca Failed to read data: End of file
                    D:\source\nscp\include\socket/client.hpp:148
D       nsca Retrying failed

[ssax]

If you look at your /etc/xinetd.d/nsca file on your XI server, is the client allowed in the only_from setting?

[michaelli]

HI saax,

I have already comment only_from in nsca and restart xinetd. Other windows2003/2008 can send passive system log nagios with same nsclient.ini file.
Just this windows 2008 hit this problem.

Code: Select all

[root@ngonap01 log]# cat /etc/xinetd.d/nsca
# default: on
# description: NSCA (Nagios Service Check Acceptor)
service nsca
{
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = nagios
        group           = nagios
        server          = /usr/local/nagios/bin/nsca
        server_args     = -c /usr/local/nagios/etc/nsca.cfg --inetd
        log_on_failure  += USERID
        disable         = no
#       only_from       = 127.0.0.1

[ssax]

Do you have any anit-virus/spyware/firewall/IPS on it or in between that server and your XI server that could be affecting it?

[michaelli]

Hi ssax,

We just use Symantec anti-virus with global setting.

When I generate testing error messages, I find nagios service has this log. Hope this help for problem isolation.

Code: Select all

Jun 11 11:49:23 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 11:49:23 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 11:49:23 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 11:49:23 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166

[michaelli]

HI saax,

I find the error by google, but I am no right to read below link. Actually, We have subscription for Nagios XI interprise. How Can I access the customer support forum?

http://support.nagios.com/forum/viewtop ... =16&t=5958

[michaelli]

Hi saax,

More information for troubleshoot procedure.

1. delete all service for SDSNAP02 in CCM
2. delete host in CCM
3. create host and service in CCM
4. in client side generate error messages
5. error services can see in "Unconfigured Objects"
6. match "unconfigurd objects" to host SDSNAP02
7. generate error message for testing

8. Find nagios logged below messages in /var/log/messages
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166

I guess some mistake we should fix in nagios server.

[Box293]

So when you click the "play" button on "unconfigurd objects" for the host SDSNAP02, these services get added to CCM.

Does the functionality work after this?

[michaelli]

Hi box293 and saax,

A good news is after I reboot nagios, its work for getting all alerts and can display in nagios.

Finally, what is the root cause for this issue because we would not like this issue happening in production environment.

[jdalrymple]

michaelli

I suspect this was your problem all along:

8. Find nagios logged below messages in /var/log/messages
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166

add the following lines to your /etc/xinetd.d/nsca file and I think you'll be all set:

Code: Select all

     per_source = UNLIMITED
     instances = UNLIMITED

Make sure to restart xinetd

As for getting you access to the customer support forums - please send an E-mail to [email protected] to make them aware of the situation.