check_http results in HTTP WARNING: HTTP/1.1 400 Bad Request

chrisan · Post by **chrisan** » Thu Jan 28, 2016 10:02 am

Hello, I am getting a "WARNING" status with information: HTTP WARNING: HTTP/1.1 400 Bad Request

Bit of background

I am not a nagios expert, someone else set this up prior to leaving and gave me a walk through. I know enough to be dangerous
Yesterday I installed NPRE plugins which did some upgrades I think on the system. I should have paid more attention..
After the fact I realized the guy had installed from source instead of apt-get and I had multiple versions of nagios on the system

The previous person setup 2 checks, 1 that a redirect exists, and 2 that it redirects to the proper location. We are testing Amazon Cloudfront's ability to redirect HTTP to HTTPS

Code: Select all

# domain.cfg

define host{
   use ec2-server
   host_name example
   alias example
   address example.com
}
define service{
    use     generic-service
    host_name  example
    service_description   site redirect has 301
    check_command check_http!-H example.com -e 'HTTP/1.1 301' -k 'Accept: text/html'
}
define service{
    use     generic-service
    host_name  example
    service_description   site redirect has proper location
    check_command check_http!-u / -H example.com -d 'https://example.com'
}

The first check used to have a "-u /" at the start like the second, but I couldnt find what that parameter was doing and removed it but same result either way. I also added the "-k 'Accept: text/html'" to that command from another thread on this forum but it didnt seem to help. The second service works with or without the "-u / "

Here is some debugging information. Since I found 3 copies of check_http (and I'm not sure which one my nagios is using right now) there are 3 examples

Code: Select all

root@nagios:/etc/nagios# find / -name "check_http"
/usr/lib/nagios/plugins/check_http
/usr/local/nagios-4.0.7/libexec/check_http
/home/ubuntu/nagios-plugins-2.0.3/plugins/check_http

And the debug output:

Code: Select all

root@nagios:/etc/nagios# /usr/lib/nagios/plugins/check_http -H example.com -e '301' -k "Accept: text/html" -vv
GET / HTTP/1.1
User-Agent: check_http/v1.5 (nagios-plugins 1.5)
Connection: close
Host: example.com
Accept: text/html


http://example.com:80/ is 557 characters
STATUS: HTTP/1.1 301 Moved Permanently
**** HEADER ****
Server: CloudFront
Date: Thu, 28 Jan 2016 14:50:11 GMT
Content-Type: text/html
Content-Length: 183
Connection: close
Location: https://example.com/
X-Cache: Redirect from cloudfront
Via: 1.1 ec0cb1e56868eb0962679bf88410618b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: jBNITB3t2LXDKLcxTCk_hyR7PK0tsud8AKTR_HOjL9RNCRi76SC37A==
**** CONTENT ****
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>CloudFront</center>
</body>
</html>

Status line output matched "301" -
HTTP OK: Status line output matched "301" - 557 bytes in 0.006 second response time |time=0.006177s;;;0.000000 size=557B;;;0
root@nagios:/etc/nagios#
root@nagios:/etc/nagios#
root@nagios:/etc/nagios#
root@nagios:/etc/nagios# /usr/local/nagios-4.0.7/libexec/check_http -H example.com -e '301' -k "Accept: text/html" -vv
GET / HTTP/1.1
User-Agent: check_http/v2.0.3 (nagios-plugins 2.0.3)
Connection: close
Host: example.com
Accept: */*
Accept: text/html


http://example.com:80/ is 557 characters
STATUS: HTTP/1.1 301 Moved Permanently
**** HEADER ****
Server: CloudFront
Date: Thu, 28 Jan 2016 14:50:20 GMT
Content-Type: text/html
Content-Length: 183
Connection: close
Location: https://example.com/
X-Cache: Redirect from cloudfront
Via: 1.1 cbaf24859f4c3a79134eec74af18bbb8.cloudfront.net (CloudFront)
X-Amz-Cf-Id: q6ENe9uzs1868FU348T3qXnGQmgB4s-HDJrL_L4jk1UnI3kLydxZZA==
**** CONTENT ****
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>CloudFront</center>
</body>
</html>

Status line output matched "301" -
HTTP OK: Status line output matched "301" - 557 bytes in 0.007 second response time |time=0.007097s;;;0.000000 size=557B;;;0
root@nagios:/etc/nagios#
root@nagios:/etc/nagios#
root@nagios:/etc/nagios#
root@nagios:/etc/nagios# /home/ubuntu/nagios-plugins-2.0.3/plugins/check_http -H example.com -e '301' -k "Accept: text/html" -vv
GET / HTTP/1.1
User-Agent: check_http/v2.0.3 (nagios-plugins 2.0.3)
Connection: close
Host: example.com
Accept: */*
Accept: text/html


http://example.com:80/ is 557 characters
STATUS: HTTP/1.1 301 Moved Permanently
**** HEADER ****
Server: CloudFront
Date: Thu, 28 Jan 2016 14:50:28 GMT
Content-Type: text/html
Content-Length: 183
Connection: close
Location: https://example.com/
X-Cache: Redirect from cloudfront
Via: 1.1 409a64e6cd31cf9171c6b6182a1b31e3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: eBBqmuQLrGx6f8Hpfr5nJk0eNHDe3VbhuSNy8FcTn7X4iZdqL2KMrg==
**** CONTENT ****
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>CloudFront</center>
</body>
</html>

Status line output matched "301" -
HTTP OK: Status line output matched "301" - 557 bytes in 0.008 second response time |time=0.007535s;;;0.000000 size=557B;;;0
root@nagios:/etc/nagios#

curl and nmap

Code: Select all

root@nagios:/etc/nagios# curl -vv example.com
* Rebuilt URL to: example.com/
* Hostname was NOT found in DNS cache
*   Trying 123.123.123.123...
* Connected to example.com (123.123.123.123) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.35.0
> Host: example.com
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
* Server CloudFront is not blacklisted
< Server: CloudFront
< Date: Thu, 28 Jan 2016 14:57:52 GMT
< Content-Type: text/html
< Content-Length: 183
< Connection: keep-alive
< Location: https://example.com/
< X-Cache: Redirect from cloudfront
< Via: 1.1 d66e526e5d9c918a5daace826a60d202.cloudfront.net (CloudFront)
< X-Amz-Cf-Id: Zf4Zs6S4luWz79ofyfleym3KoAnGfAWzXlP-RLLJYx3_2vWwmZ12Hw==
<
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>CloudFront</center>
</body>
</html>
* Connection #0 to host example.com left intact


root@nagios:/etc/nagios# nmap example.com -p 80

Starting Nmap 6.40 ( http://nmap.org ) at 2016-01-28 14:58 UTC
Nmap scan report for example.com (123.123.123.123)
Host is up (0.0021s latency).
Other addresses for example.com (not scanned): 123.123.123.122 123.123.123.124 123.123.123.125 123.123.123.126 123.123.123.127 123.123.123.128
rDNS record for 123.123.123.123: server-123.123.123.123.iad123.r.cloudfront.net
PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 1.29 seconds
root@nagios:/etc/nagios#

What else can I do to debug this?

tmcdonald · Post by **tmcdonald** » Thu Jan 28, 2016 6:04 pm

Are one of your check_http versions up to 2.0.3? I have the "-f" flag on mine which allows you to specify what to do with a redirect. "-f follow" should properly follow a 301.

chrisan · Post by **chrisan** » Fri Jan 29, 2016 6:48 am

Two of them are 2.0.3 the other is 1.5. Is there a way I can tell which version is being used by nagios? All 3 appear to have the -f follow parameter when I run it via command line

Since we are checking that HTTP redirects to HTTPS I had to add the --sni flag and it works from the command line but again I get a "400 Bad Request" when nagios runs it

Code: Select all

define service{
    use     generic-service
    host_name  example
    service_description   Testing 301
    check_command check_http!-u / -H example.com -f follow --sni -e 'HTTP/1.1 301'
}

Code: Select all

root@nagios:/etc/nagios# /usr/lib/nagios/plugins/check_http -u / -H example.com -f follow --sni -e 'HTTP/1.1 301'
HTTP OK: Status line output matched "HTTP/1.1 301" - 557 bytes in 0.011 second response time |time=0.010578s;;;0.000000 size=557B;;;0

root@nagios:/etc/nagios# /home/ubuntu/nagios-plugins-2.0.3/plugins/check_http -u / -H example.com -f follow --sni -e 'HTTP/1.1 301'
HTTP OK: Status line output matched "HTTP/1.1 301" - 557 bytes in 0.006 second response time |time=0.006336s;;;0.000000 size=557B;;;0

root@nagios:/etc/nagios# /usr/local/nagios-4.0.7/libexec/check_http -u / -H example.com -f follow --sni -e 'HTTP/1.1 301'
HTTP OK: Status line output matched "HTTP/1.1 301" - 557 bytes in 0.007 second response time |time=0.006509s;;;0.000000 size=557B;;;0

rkennedy · Post by **rkennedy** » Fri Jan 29, 2016 12:05 pm

Can you try putting the / in quotes?

Code: Select all

check_command check_http!-u '/' -H example.com -f follow --sni -e 'HTTP/1.1 301'

chrisan · Post by **chrisan** » Fri Jan 29, 2016 12:54 pm

Same error as before.

Post by **tgriep** » Fri Jan 29, 2016 2:52 pm

Can we see how the check_http command is setup in the commands.cfg file?

chrisan · Post by **chrisan** » Fri Jan 29, 2016 4:17 pm

So I recall when I installed the plugins and restarted nagios I got warnings about duplicate definitions

In /etc/nagios/objects/commands.cfg I had

Code: Select all

# 'check_http' command definition
#define command{
#        command_name    check_http
#        command_line    $USER1$/check_http -I $HOSTADDRESS$ $ARG1$
#        }
#define command{
#        command_name    check_https
#        command_line    $USER1$/check_http -S -I $HOSTADDRESS$ $ARG1$
#        }

Which I commented out to resolve the errors and let the new plugins directory define them where they have it in this format. I was thinking "newer is better" and the separation of commands seemed nicer vs the huge commands.cfg this guy made (or added to)

/etc/nagios-plugins/config/http.cfg

Code: Select all

# 'check_http' command definition
define command{
        command_name    check_http
        command_line    /usr/lib/nagios/plugins/check_http -H '$HOSTADDRESS$' -I '$HOSTADDRESS$' '$ARG1$'
        }

# 'check_http_hostname' command definition
define command{
        command_name    check_httpname
        command_line    /usr/lib/nagios/plugins/check_http -H '$HOSTNAME$' -I '$HOSTADDRESS$' '$ARG1$'
        }

# 'check_http2' command definition
define command{
        command_name    check_http2
        command_line    /usr/lib/nagios/plugins/check_http -H '$ARG1$' -I '$HOSTADDRESS$' -w '$ARG2$' -c '$ARG3$' $
        }
# etc etc

Reverting to the original format and commenting out the check_http in the plugins directory resolved the warning and all is well. Thank you for your help and direction, sorry for this goose chase!

rkennedy · Post by **rkennedy** » Mon Feb 01, 2016 10:11 am

No problem, we're here to help! I'll close this out now, if you need any assistance in the future feel free to open a new thread.

Nagios Support Forum

check_http results in HTTP WARNING: HTTP/1.1 400 Bad Request

check_http results in HTTP WARNING: HTTP/1.1 400 Bad Request

Re: check_http results in HTTP WARNING: HTTP/1.1 400 Bad Req

Re: check_http results in HTTP WARNING: HTTP/1.1 400 Bad Req

Re: check_http results in HTTP WARNING: HTTP/1.1 400 Bad Req

Re: check_http results in HTTP WARNING: HTTP/1.1 400 Bad Req

Re: check_http results in HTTP WARNING: HTTP/1.1 400 Bad Req

Re: check_http results in HTTP WARNING: HTTP/1.1 400 Bad Req

Re: check_http results in HTTP WARNING: HTTP/1.1 400 Bad Req