regex wildcard service name definition for a service check

[aleksl]

So I have a collection of services, let's call them SVC_tag1, SVC_tag2, etc on a win server.

there is the check command we've been using:

$USER1$/check_nt -H $HOSTADDRESS$ -s "$ARG1$" -p 12489 -v $ARG2$ $ARG3$ $ARG4$

where last bit looks like

-v SERVICESTATE -l "SVC_tag1" -d SHOWALL

and we have a service check defined for each SVC_tag1, etc and that's a little cumbersome.

is there a way to make it look for all available SVC* names? i tried plopping a * in the name but i do not believe it likex regex in that as the test check command returns

OUTPUT: SVC_\*: Error

using single quotes (while doesnt make much sense, but thought i'd try) didnt help either.

[lmiltchev]

-v SERVICESTATE -l "SVC_tag1" -d SHOWALL

and we have a service check defined for each SVC_tag1, etc and that's a little cumbersome.

Have you tried using coma-separated service names in one check? According to the "check_nt" usage, you should be able to use: "-l SVC_tag1,SVC_tag2,SVC_tag3,..."

SERVICESTATE =
Check the state of one or several services.
Request a -l parameters with the following syntax:
-l <service1>,<service2>,<service3>,...
You can specify -d SHOWALL in case you want to see working services
in the returned string.

[aleksl]

I have, and that works for one host, but i have a hostgroup assigned to this check, and each host can have various combinations of service names (depending on the environment), which would result in a lot of alerts for missing services, wouldn't it?

e.g. host1: svc_tag1, svc_tag3; host2: svc_tag2, svc_tag3; ...etc

[lmiltchev]

I haven't had much luck using regex expressions with NSClient++. I doubt this would work with check_nt. You can try asking your question on the NSClient++ support forum as this agent is not developed or maintained by us (Nagios).

Having said that, you could probably use check_wmi_plus, for example:

Code: Select all

[root@localhost libexec]# ./check_wmi_plus.pl -H x.x.x.x -u username -p password -m checkservice -a windows. -w 0 -c 1
CRITICAL - [Triggered by _NumBad>1] - Found 28 Services(s), 11 OK and 17 with problems (0 excluded). 'Windows Audio Endpoint Builder' (AudioEndpointBuilder) is Running, 'Windows Audio' (AudioSrv) is Running, 'Windows Media Center Receiver Service' (ehRecvr) is Stopped, 'Windows Media Center Scheduler Service' (ehSched) is Stopped, 'Windows Event Log' (eventlog) is Running, 'Windows Font Cache Service' (FontCache) is Running, 'Windows Presentation Foundation Font Cache 3.0.0.0' (FontCache3.0.0.0) is Running, 'Windows CardSpace' (idsvc) is Stopped, 'Windows Firewall' (MpsSvc) is Running, 'Windows Installer' (msiserver) is Stopped, 'Quality Windows Audio Video Experience' (QWAVE) is Stopped, 'Windows Backup' (SDRSVC) is Stopped, 'Windows Image Acquisition (WIA)' (stisvc) is Stopped, 'Windows Modules Installer' (TrustedInstaller) is Stopped, 'Windows Time' (W32Time) is Stopped, 'Windows Activation Technologies Service' (WatAdminSvc) is Stopped, 'Windows Biometric Service' (WbioSrvc) is Stopped, 'Windows Connect Now - Config Registrar' (wcncsvc) is Stopped, 'Windows Color System' (WcsPlugInService) is Stopped, 'Windows Event Collector' (Wecsvc) is Stopped, 'Windows Error Reporting Service' (WerSvc) is Stopped, 'Windows Defender' (WinDefend) is Running, 'Windows Management Instrumentation' (Winmgmt) is Running, 'Windows Remote Management (WS-Management)' (WinRM) is Stopped, 'Windows Media Player Network Sharing Service' (WMPNetworkSvc) is Running, 'Windows Search' (WSearch) is Running, 'Windows Update' (wuauserv) is Running, 'Windows Driver Foundation - User-mode Driver Framework' (wudfsvc) is Stopped.|'Total Service Count'=28; 'Service Count OK State'=11; 'Service Count Problem State'=17;0;1; 'Excluded Service Count'=0;

[root@localhost libexec]# ./check_wmi_plus.pl -H x.x.x.x -u username -p password -m checkservice -a windows.m -w 0 -c 1
CRITICAL - [Triggered by _NumBad>1] - Found 5 Services(s), 2 OK and 3 with problems (0 excluded). 'Windows Media Center Receiver Service' (ehRecvr) is Stopped, 'Windows Media Center Scheduler Service' (ehSched) is Stopped, 'Windows Modules Installer' (TrustedInstaller) is Stopped, 'Windows Management Instrumentation' (Winmgmt) is Running, 'Windows Media Player Network Sharing Service' (WMPNetworkSvc) is Running.|'Total Service Count'=5; 'Service Count OK State'=2; 'Service Count Problem State'=3;0;1; 'Excluded Service Count'=0;

You could add exclusions if you want to, etc. To view the plugin's usage, run from the CLI:

Code: Select all

/usr/local/nagios/libexec/check_wmi_plus.pl -h

Hope this helps.

[aleksl]

Ok, thanks! I'll dig around with that and talk to NSClient++ guys.

thank you.

[lmiltchev]

Sounds good, aleksl. Let us know if it is all right to lock this topic. Thank you!

[aleksl]

Go ahead and close it. Thank you for your help!

[rkennedy]

I will now close this thread out, feel free to open a new one if you ever need assistance in the future.