NRPE - check_procs always shows CRITICAL

[cadillacrick]

Hello everyone,

I am new to the Nagios environment and have been trying to configure NRPE check_procs so that it doesn't always show CRITICAL but alas I can't seem to find the correct configuration to make it do what I need....

in my nrpe.cfg file i have it set like so:

command[check_procs]=/usr/lib/nagios/plugins/check_procs -c $ARG1$


in my commands.cfg file like so:

# 'check_nrpe' command definition
define command{
command_name check_nrpe
command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -c $ARG1$
}



and finally in the device itself like so:

define service{
use generic-service
host_name Win2012
service_description Total Processes
check_command check_nrpe!check_total_procs 250
}


I guess i'm missing something real obvious but since its new to me I probably don't see it... because on the dashboard it always shows as it is CRITICAL like so:

Current Status: CRITICAL (for 0d 0h 18m 22s)
Status Information: PROCS CRITICAL: 228 processes
Performance Data: procs=228;150;200;0;




Any guidance would be greatly appreciated!


Thanks !


Richard

[tgriep]

In the nrpe.cfg file is the check_total_procs command which is hard coded for warnings of 150 and critical of 200. See below.

command[check_total_procs]=/usr/local/nagios/libexec/check_procs -w 150 -c 200

This is the command that you are using in your service check and that is why you are always receiving a critical alert.

What you could do is edit the nrpe.cfg file and the command to define warning and critical thresholds like the example below.

Code: Select all

command[check_total_procs]=/usr/local/nagios/libexec/check_procs  -w $ARG1$ -c $ARG2

Then you will need to edit your service from

Code: Select all

check_command check_nrpe!check_total_procs 250

to

Code: Select all

check_command check_nrpe!check_total_procs!-a '250 300'

That will set your warning level to 250 and critical to 300. You can adjust those to what you need.
Try is you and let us know if you need anything else.

[Box293]

to

Code: Select all

check_command check_nrpe!check_total_procs!-a '250 300'

Remove the single quotes around 250 300 otherwise the NRPE client will see them as $ARG1$ and will try to execute -w 250 300 -c and remove the ! here cs!-a and replace with a space as the check_nrpe command definition is only configured to use $ARG1$.

Code: Select all

check_command check_nrpe!check_total_procs -a 250 300

[cadillacrick]

Hey guys,

I've made the changes as suggested. Now I don't get a "critical" warning anymore now its changed to "unknown" as follows:


Current Status: UNKNOWN (for 0d 0h 57m 8s)
Status Information: CHECK_NRPE: Received 0 bytes from daemon. Check the remote server logs for error messages.


I've tried to check the logs on the remote device that's being monitored.. in this case a Windows Server 2012. Looked in C:\Program Files\NSClient++ and found the nsclient.log but I don't see anything with today's date in there. Should I be looking anywhere for other clues ?


Thanks for any assistance !!


Richard

[hsmith]

Did you make sure that you have allowed the host in NSClient.ini?

Snippet from my machine:

Code: Select all

; ALLOWED HOSTS - A comaseparated list of allowed hosts. You can use netmasks (/ syntax) or * to create ranges.
allowed hosts = 192.168.4.67, 192.168.4.11

[cadillacrick]

Yes I have made sure the host's IP address is listed in the .ini file.

All other services seem to be working fine and before I made any changes to the NRPE.cfg file it was showing some 227 processes and calling it Critical.



This is what that client machine is responding to Nagios so far...

C:\ Drive Space OK 09-15-2015 16:10:27 1d 12h 14m 44s 1/3 c: - total: 1862.67 Gb - used: 1081.96 Gb (58%) - free 780.72 Gb (42%)
CPU Load OK 09-15-2015 16:11:09 8d 3h 33m 42s 1/3 CPU Load 5% (5 min average)
Explorer OK 09-15-2015 16:11:07 1d 12h 14m 33s 1/3 explorer.exe: Running
Memory Usage OK 09-15-2015 16:10:39 3d 3h 13m 22s 1/3 Memory usage: total:9397.25 MB - used: 3330.03 MB (35%) - free: 6067.22 MB (65%)
NSClient++ Version OK 09-15-2015 16:10:28 9d 18h 59m 31s 1/3 NSClient++ 0,4,1,73 2012-12-17
Print Spooler OK 09-15-2015 16:10:39 3d 17h 45m 52s 1/3 Print Spooler: Started
Total Processes UNKNOWN 09-15-2015 16:10:22 0d 1h 34m 53s 3/3 CHECK_NRPE: Received 0 bytes from daemon. Check the remote server logs for error messages.
Uptime OK 09-15-2015 16:10:33 1d 12h 14m 35s 1/3 System Uptime - 16 day(s) 21 hour(s) 58 minute(s)
W3SVC OK 09-15-2015 16:10:38 3d 3h 13m 22s 1/3 W3SVC: Started

[tgriep]

Sorry, for the confusion, I thought you were trying to test the total processes for a linux host.
Is the remote system you are testing a Windows host?
If so, can you post the nsclient.ini file from it?

[cadillacrick]

That's ok... Maybe I wasn't too clear in my original post as well.. Yes the remote machine is a Windows Server 2012.


Here is the content of the nsclient.ini

Code: Select all

[/settings/NRPE/server]
allow arguments=true


; Undocumented section
[/modules]

; CheckDisk - CheckDisk can check various file and disk related things. The current version has commands to check Size of hard drives and directories.
CheckDisk = 1

; Event log Checker. - Check for errors and warnings in the event log. This is only supported through NRPE so if you plan to use only NSClient this wont help you at all.
CheckEventLog = 1

; Check External Scripts - A simple wrapper to run external scripts and batch files.
CheckExternalScripts = 1

; Helper function - Various helper function to extend other checks. This is also only supported through NRPE.
CheckHelpers = 1

; Check NSCP - Checkes the state of the agent
CheckNSCP = 1

; CheckSystem - Various system related checks, such as CPU load, process state, service state memory usage and PDH counters.
CheckSystem = 1

; NRPE server - A simple server that listens for incoming NRPE connection and handles them.
NRPEServer = 1

; NSClient server - A simple server that listens for incoming NSClient (check_nt) connection and handles them. Although NRPE is the preferred method NSClient is fully supported and can be used for simplicity or for compatibility.
NSClientServer = 1


; Undocumented section
[/settings/default]
allow arguments=true

; ALLOWED HOSTS - A comaseparated list of allowed hosts. You can use netmasks (/ syntax) or * to create ranges.
allowed hosts = 0.0.0.0

; PASSWORD - Password used to authenticate againast server
password = XXXXXXXXX


; A list of aliases available. An alias is an internal command that has been "wrapped" (to add arguments). Be careful so you don't create loops (ie check_loop=check_a, check_a=check_loop)
[/settings/external scripts/alias]
allow arguments=true

; alias_cpu - Alias for alias_cpu. To configure this item add a section called: /settings/external scripts/alias/alias_cpu
alias_cpu = checkCPU warn=80 crit=90 time=5m time=1m time=30s

; alias_cpu_ex - Alias for alias_cpu_ex. To configure this item add a section called: /settings/external scripts/alias/alias_cpu_ex
alias_cpu_ex = checkCPU warn=$ARG1$ crit=$ARG2$ time=5m time=1m time=30s

; alias_disk - Alias for alias_disk. To configure this item add a section called: /settings/external scripts/alias/alias_disk
alias_disk = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll FilterType=FIXED

; alias_disk_loose - Alias for alias_disk_loose. To configure this item add a section called: /settings/external scripts/alias/alias_disk_loose
alias_disk_loose = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll FilterType=FIXED ignore-unreadable

; alias_event_log - Alias for alias_event_log. To configure this item add a section called: /settings/external scripts/alias/alias_event_log
alias_event_log = CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1 "filter=generated gt -2d AND severity NOT IN ('success', 'informational') AND source != 'SideBySide'" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"

; alias_file_age - Alias for alias_file_age. To configure this item add a section called: /settings/external scripts/alias/alias_file_age
alias_file_age = checkFile2 filter=out "file=$ARG1$" filter-written=>1d MaxWarn=1 MaxCrit=1 "syntax=%filename% %write%"

; alias_file_size - Alias for alias_file_size. To configure this item add a section called: /settings/external scripts/alias/alias_file_size
alias_file_size = CheckFiles "filter=size > $ARG2$" "path=$ARG1$" MaxWarn=1 MaxCrit=1 "syntax=%filename% %size%" max-dir-depth=10

; alias_mem - Alias for alias_mem. To configure this item add a section called: /settings/external scripts/alias/alias_mem
alias_mem = checkMem MaxWarn=80% MaxCrit=90% ShowAll=long type=physical type=virtual type=paged type=page

; alias_process - Alias for alias_process. To configure this item add a section called: /settings/external scripts/alias/alias_process
alias_process = checkProcState "$ARG1$=started"

; alias_process_count - Alias for alias_process_count. To configure this item add a section called: /settings/external scripts/alias/alias_process_count
alias_process_count = checkProcState MaxWarnCount=$ARG2$ MaxCritCount=$ARG3$ "$ARG1$=started"

; alias_process_hung - Alias for alias_process_hung. To configure this item add a section called: /settings/external scripts/alias/alias_process_hung
alias_process_hung = checkProcState MaxWarnCount=1 MaxCritCount=1 "$ARG1$=hung"

; alias_process_stopped - Alias for alias_process_stopped. To configure this item add a section called: /settings/external scripts/alias/alias_process_stopped
alias_process_stopped = checkProcState "$ARG1$=stopped"

; alias_sched_all - Alias for alias_sched_all. To configure this item add a section called: /settings/external scripts/alias/alias_sched_all
alias_sched_all = CheckTaskSched "filter=exit_code ne 0" "syntax=%title%: %exit_code%" warn=>0

; alias_sched_long - Alias for alias_sched_long. To configure this item add a section called: /settings/external scripts/alias/alias_sched_long
alias_sched_long = CheckTaskSched "filter=status = 'running' AND most_recent_run_time < -$ARG1$" "syntax=%title% (%most_recent_run_time%)" warn=>0

; alias_sched_task - Alias for alias_sched_task. To configure this item add a section called: /settings/external scripts/alias/alias_sched_task
alias_sched_task = CheckTaskSched "filter=title eq '$ARG1$' AND exit_code ne 0" "syntax=%title% (%most_recent_run_time%)" warn=>0

; alias_service - Alias for alias_service. To configure this item add a section called: /settings/external scripts/alias/alias_service
alias_service = checkServiceState CheckAll

; alias_service_ex - Alias for alias_service_ex. To configure this item add a section called: /settings/external scripts/alias/alias_service_ex
alias_service_ex = checkServiceState CheckAll "exclude=Net Driver HPZ12" "exclude=Pml Driver HPZ12" exclude=stisvc

; alias_up - Alias for alias_up. To configure this item add a section called: /settings/external scripts/alias/alias_up
alias_up = checkUpTime MinWarn=1d MinWarn=1h

; alias_updates - Alias for alias_updates. To configure this item add a section called: /settings/external scripts/alias/alias_updates
alias_updates = check_updates -warning 0 -critical 0

; alias_volumes - Alias for alias_volumes. To configure this item add a section called: /settings/external scripts/alias/alias_volumes
alias_volumes = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll=volumes FilterType=FIXED

; alias_volumes_loose - Alias for alias_volumes_loose. To configure this item add a section called: /settings/external scripts/alias/alias_volumes_loose
alias_volumes_loose = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll=volumes FilterType=FIXED ignore-unreadable

; allow_arguments - Alias for allow_arguments. To configure this item add a section called: /settings/external scripts/alias/allow_arguments
allow_arguments = 1

; default - Alias for default. To configure this item add a section called: /settings/external scripts/alias/default
default = 

; runcmd - Alias for runcmd. To configure this item add a section called: /settings/external scripts/alias/runcmd
runcmd = scripts\runcmd.bat "$ARG1$"


[/settings/external scripts/scripts]
allow arguments = true
; spooler - Alias for runcmd. To configure this item add a section called: /settings/external scripts/alias/runcmd
spooler = scripts\runcmd.bat spooler

[tgriep]

There isn't a check total processes built in to the NSClient++ software but you could create one by adding a powershell script on to the Windows system and defining a command in the nsclient.ini file.
Here is a previous support post that has an example on how to do that.
https://support.nagios.com/forum/viewto ... 34&t=29045
Take a look at the post dated

Sun Sep 14, 2014 8:18 am

for the details on how to set that up.

[Box293]

NSClient++ does have a check called "check_process" however I've played with it a bit and it feels like it's still in beta I had some of the syntax incorrect.

Code: Select all

Command:
check_nrpe -H win2008r2-01 -c check_process -a "process=*" warning='count > 50' critical='count > 100'

Output when OK:
OK: all processes are ok.|'count'=46;50;100

Output when Warning (warning changed to 40):
WARNING: Tail.exe=started, vds.exe=started, TrustedInstaller.exe=started, Geany.exe=started, nscp.exe=started, taskeng.exe=started|'count'=46;40;100

Primarily I wanted to change the output when there a threshold was crossed however I didn't have much success. This is the best I could do:

Code: Select all

Command:
check_nrpe -H win2008r2-01 -c check_process -a "process=*" warning='count > 40' critical='count > 100' top-syntax='%(status): %(count) Processes Total'

Output when warning triggered:
WARNING: 42 Processes Total|'count'=42;40;100

Output when OK:
OK: all processes are ok.|'count'=42;50;100

Here's the official documentation:
http://docs.nsclient.org/reference/wind ... ck-process

This testing was done on NSClient++ 0.4.3.143

I'm hoping the 0.4.4 release of NSClient++ will improve on these features.