check_ssh OK on command line but not Core UI

[timxjr1300]

Interesting problem, I cannot seem to resolve.
I have a Debian 7 VM running in Virtualbox which runs Nagios Core, it is also the 'local host' nrpe.
I have a second Debian 7 VM running in VMWare Player 7.1.2 which is a remote host
I have a Debian 8 VM again running in VMWare player 7.1.2 as a remote host
The windows host machine (win 7 pro) is a 'windows server'.

All is well with the exception of ssh and ftp,
One problem at a time.

From the Nagios core machine command line I can run "/usr/local/nagios/libexec/check_ssh <IP Address> and I get back
"SSH OK - OpenSSH_6.0p1 Debian-4+deb7u2 (protocol 2.0) | time=0.008823s;;;0.000000;10.000000"

All seems well, this works on all of the Debian VMs including the Nagios Core machine.

However, the Core UI says that the status of the SSH Service is . . .

Current Status:
UNKNOWN
(for 0d 3h 7m 16s)
Status Information: check_ssh: Invalid hostname/address - $
Usage:
check_ssh [-4
Performance Data: -6] [-t <timeout>] [-r <remote version>] [-p <port>] <host>
Current Attempt: 3/3 (HARD state)
Last Check Time: 06-26-2015 16:06:30
Check Type: ACTIVE

The commands.cfg definition for SSH is:
# 'check_ssh' command definition
define command{
command_name check_ssh
command_line $USER1$/check_ssh -H $HOSTADDRESS$
}

And my assumption that with the exception of ftp all of the other services are working means that the HOSTADDRESS is configured correctly.
CPU Load OK 06-26-2015 16:10:52 0d 3h 16m 59s 1/3 OK - load average: 0.00, 0.01, 0.05
Current Users OK 06-26-2015 16:10:52 0d 3h 16m 59s 1/3 USERS OK - 2 users currently logged in
FTP Monitoring CRITICAL 06-26-2015 16:16:53 1d 5h 10m 4s 3/3 NRPE: Command 'check_ftp' not defined
SSH Monitoring UNKNOWN 06-26-2015 16:16:30 0d 3h 10m 59s 3/3 check_ssh: Invalid hostname/address - $

Any help most welcome.

[abrist]

Can you post the service check definition as well?

[millisa]

Code: Select all

command_line $USER1$/check_ssh -H $HOSTADDRESS$

Your command definition is probably what's wrong; check_ssh doesn't use -H.

Code: Select all

Usage:
check_ssh [-46] [-t <timeout>] [-r <remote version>] [-p <port>] <host>

Use

Code: Select all

        command_line    $USER1$/check_ssh $HOSTADDRESS$

or if you want to get fancy and be able to send the -46, or -t or -r or -p arguments from the service definition, something like

Code: Select all

        command_line    $USER1$/check_ssh $ARG1$ $HOSTADDRESS$

(you could use the $ARG1$ to send things like the -t ## or -r stuff before the host, and if you didn't send an argument, it'd be find with that, too)
But just start by getting rid of the -H and make sure it works as expected.

[lmiltchev]

Thanks, millisa!

@timxjr1300
Let us know if millisa's suggestion fixed your issue.

[timxjr1300]

What I cannot seem to do is work out what should be in nrpe.cfg on the monitored server.

Currently I have this:

command[check_ssh]=/usr/lib/nagios/plugins/check_ssh

And it doesn't work all I get in the gui is:

SSH UNKNOWN 04-13-2016 16:46:20 0d 0h 16m 33s 3/3 check_ssh: Could not parse arguments

When I change the nrpe line to:
command[check_ssh]=/usr/lib/nagios/plugins/check_ssh $HOSTADDRESS$

I get:
SSH UNKNOWN 04-13-2016 16:56:20 0d 0h 18m 49s 3/3 Usage:

Finally when I change nrpe to:
command[check_ssh]=/usr/lib/nagios/plugins/check_ssh $ARG1$ $HOSTADDRESS$

I get the same response as above.

When I issue /usr/local/nagios/libexec/check_ssh 192.168.x.x from the command line on the Nagios monitoring server I get. .
SSH OK - OpenSSH_6.7p1 Raspbian-5+deb8u1 (protocol 2.0) | time=0.077579s;;;0.000000;10.000000

I'm afraid I cannot work out what is going on, loads of advice on the web but I can't find away to get this to go.

Any help welcome

[rkennedy]

Are you attempting to go Nagios -> NRPE -> SSH? I'm trying to understand the process, because you've introduced NRPE into the equation.

Can you post the service definitions for the services in question? I don't think $HOSTADDRESS$ is going to pass properly through NRPE.

[timxjr1300]

Are you attempting to go Nagios -> NRPE -> SSH? I'm trying to understand the process, because you've introduced NRPE into the equation.

Can you post the service definitions for the services in question? I don't think $HOSTADDRESS$ is going to pass properly through NRPE.

Reading your response has made me think.
the service definition on the Nagios monitoring server is:
define service{
use generic-service
host_name webserver
service_description SSH
check_command check_nrpe!check_ssh
}

and the command on the monitored (web server) server in nrpe.cfg is:-
command[check_ssh]=/usr/lib/nagios/plugins/check_ssh 192.168.x.x <<---- IP address of this server

What I am now getting is that SSH is OK and O/S info but it is not giving me the number of logged in users like SSH on the local Nagios monitoring server does.
Is this correct?

When I don't user nrpe!check_ssh but check_ssh I get the same result.

I was under the impression that you use nrpe to run checks on remote systems which is why I have been using it this way. Is that correct.
I'm about to put nrpe on another server which has a different operating system to the two I have used so far because I remain unconvinced that I am seeing the monitored (web server) results.

[rkennedy]

Ah! Check_ssh will only pertain to the SSH version. You actually don't need to run it through NRPE unless the Nagios server cannot directly access it.

To provide a bit of background for you -

check_by_ssh - will act as a middleman. This is how you can have the Nagios server directly establish a SSH connection to your client. From there, you can have it run any commands (uptime, users, df, etc.)
NRPE - will also act as a middleman. Instead of using SSH authentication, it uses NRPE to do so. You can run pre-built scripts (which similar to you have done, with your command[check_ssh]).

To sum it up, you'll really only need to do one, unless for example, you had an internal network where you wanted to use a server as a 'gateway'. Example -
Nagios (10.0.0.2/24) <-> WAN <-> NRPE (different network, 192.168.0.2/24) <-> Bobs Computer (192.168.0.3/24)

Instead of opening up Bob's computer with port forwarding for SSH / NRPE, you would use the NRPE to be the 'middleman' for communication.