Passive checks not reaching Nagios server

[crhoppe]

We have a nagios core server that is not receiving passive nrdp checks. On the agent side, the messages say sent, however on the server side, there are no updates. Running a token check appears to work, however nothing is displayed in the unconfigured object screen. We have compared the configuration files between this and another core server and all appears to be the same. How do we PD this? Any help would be appreciated!!

[rkennedy]

Can you post your host / service check definition for us to take a look at?

[crhoppe]

Here is the host definition and one of the passive checks. We have this same service and host configured on another NagiosXI server and it works on that one.

define host {
host_name bedrock17
alias bedrock17
address 173.1.1.123
check_command check_ping!3000,80%!5000,100%!!!!!!
max_check_attempts 1
check_interval 2
retry_interval 1
check_period xi_timeperiod_24x7
notification_period xi_timeperiod_24x7
register 1
}


define service {
service_description Check_mem_host
use xiwizard_passive_service
hostgroup_name gfpcpe-hosts
max_check_attempts 1
check_interval 1
retry_interval 1
check_period xi_timeperiod_24x7
event_handler xi_service_event_handler_gfp_cpe
event_handler_enabled 1
notification_interval 60
notification_period xi_timeperiod_24x7
notifications_enabled 0
contacts nagiosadmin
_xiwizard passiveobject
register 1
}

[hsmith]

Can you do a tcpdump to see if the checks are reaching the server?

[crhoppe]

It appears they are. I ran a tcpdump on the managed device and this nagiosxi server (not updating) as well as the other nagiosxi server that is updating correctly. Traffic is flowing both ways. Incoming packets from the bedrock17 device are evident as are acknowledgements from the nagiosxi servers back to the device.

[tmcdonald]

Since you mention a token I assume you are using NRDP. Can you post some apache logs from the malfunctioning server? NRDP is basically just a PHP application so if it is failing it should log.

[crhoppe]

I kicked off the script on the client side to each server in turn. Here is the httpd access_log on the server that is not working during that time.

::1 - - [22/Dec/2015:15:33:22 +0000] "POST /nagiosxi/backend/ HTTP/1.1" 200 809 "-" "BinGet/1.00.A (http://www.bin-co.com/php/scripts/load/)"
173.1.1.123 - - [22/Dec/2015:15:33:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"
173.1.1.123 - - [22/Dec/2015:15:33:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"
173.1.1.123 - - [22/Dec/2015:15:33:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"
173.1.1.123 - - [22/Dec/2015:15:33:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"
173.1.1.123 - - [22/Dec/2015:15:33:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"


I also noticed on the non-working server there thousands of files in the /usr/local/nagios/var/spool/checkresults directory. They disappear on the working server.

./nagios/var/spool/checkresults/coKR17N.ok
./nagios/var/spool/checkresults/cjDqNoA.ok
./nagios/var/spool/checkresults/cazFUGj.ok
./nagios/var/spool/checkresults/cTFV01J.ok
./nagios/var/spool/checkresults/cesmxto.ok
./nagios/var/spool/checkresults/cA3pxbi.ok

On the working server I see this:

::1 - - [22/Dec/2015:15:38:22 +0000] "POST /nagiosxi/backend/ HTTP/1.1" 200 810 "-" "BinGet/1.00.A (http://www.bin-co.com/php/scripts/load/)"
173.1.1.123 - - [22/Dec/2015:15:38:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"
173.1.1.123 - - [22/Dec/2015:15:38:34 +0000] "POST /nrdp/pmstat_r.php/ HTTP/1.1" 200 156 "-" "curl/7.35.0"
173.1.1.123 - - [22/Dec/2015:15:38:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"
173.1.1.123 - - [22/Dec/2015:15:38:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"
173.1.1.123 - - [22/Dec/2015:15:38:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"
173.1.1.123 - - [22/Dec/2015:15:38:34 +0000] "POST /nrdp/ HTTP/1.1" 200 170 "-" "libwww-perl/6.13"

Are there other logs that might shed more light?

[ssax]

What is the output of this command:

Code: Select all

service nagios status

There may be way too many to process, you should clear them out and then restart the nagios process.

[crhoppe]

service nagios status
nagios (pid 18326) is running...

[rkennedy]

Here is the host definition and one of the passive checks. We have this same service and host configured on another NagiosXI server and it works on that one.

define host {
host_name bedrock17
alias bedrock17
address 173.1.1.123
check_command check_ping!3000,80%!5000,100%!!!!!!
max_check_attempts 1
check_interval 2
retry_interval 1
check_period xi_timeperiod_24x7
notification_period xi_timeperiod_24x7
register 1
}


define service {
service_description Check_mem_host
use xiwizard_passive_service
hostgroup_name gfpcpe-hosts
max_check_attempts 1
check_interval 1
retry_interval 1
check_period xi_timeperiod_24x7
event_handler xi_service_event_handler_gfp_cpe
event_handler_enabled 1
notification_interval 60
notification_period xi_timeperiod_24x7
notifications_enabled 0
contacts nagiosadmin
_xiwizard passiveobject
register 1
}

To clarify, this looks like an XI service definition - what are you using for the service / host definition on your core machine? Are your servers running XI or Core?