Connection refused message while monitoring Windows host

[RIDS_I2MP]

error message.PNG

netstat cmd output.PNG

Hi Team,

We have enabled monitoring on a windows host, monitoring was working fine but now we are receiving attached error message i.e connection refused.

I have restarted the NSClient++ service on remote host, but still the issue persists.

I have checked below points in the NSC.ini file
1. NSClientListener.dll is uncommented.
2. File consists of nagios ip in allowed host address section as shown below:

;# ALLOWED HOST ADDRESSES
; This is a comma-delimited list of IP address of hosts that are allowed to talk to the all daemons.
; If leave this blank anyone can access the deamon remotly (NSClient still requires a valid password).
; The syntax is host or ip/mask so 192.168.0.0/24 will allow anyone on that subnet access
;allowed_hosts=127.0.0.1/32
;
;# USE THIS FILE
; Use the INI file as opposed to the registry if this is 0 and the use_reg in the registry is set to 1
; the registry will be used instead.
use_file=1
allowed_hosts=10.147.108.45
password=nag1osadm1n
;

3. NSClient port 12489 is mentioned in the NSC.ini file

[NSClient]
;# ALLOWED HOST ADDRESSES
; This is a comma-delimited list of IP address of hosts that are allowed to talk to NSClient deamon.
; If you leave this blank the global version will be used instead.
;allowed_hosts=
;
;# NSCLIENT PORT NUMBER
; This is the port the NSClientListener.dll will listen to.
;port=12489
;

4. I have executed a command "netstat -an" on remote host, refer the attachment for the output.

Kindly let us know your comments on this.

[rkennedy]

Can you check your Windows Firewall rules? Windows update may have altered them.

From the Nagios machine, what is the result of a nmap 10.148.186.140?

[RIDS_I2MP]

nmap cmd output.PNG

Hi Team,

Windows firewalls is already turned off in server level.

What firewall rules to be checked; if the details are provided, we can request network team to check.

Please find the attached snapshot consisting the nmap command output.

[tgriep]

What is the operating system version you are trying to run the NSClient++ on?

Take a look at this document for configuring the NSClient++ for your system.
https://assets.nagios.com/downloads/nag ... ios-XI.pdf

[RIDS_I2MP]

Please find the snapshot for the configuration of remote host.

And I went through the link, but I am not able to suspect anything in my NSC.ini configuration file, it seems to be as expected.

[lmiltchev]

Can you post the entire NSC.ini file in code wraps?

[RIDS_I2MP]

Hi Team,

Please find the attached NSC.ini file.

Kindly let us know What firewall rules to be checked; if the details are provided, we can request network team to check.

[hsmith]

Looking at your previous post, it looks like port 12489 is not open. Please have your network team check this, as NSClient uses that port.

[RIDS_I2MP]

As per the network team, port 12489 is already open.

Kindly can you let me know how can I crosscheck from Nagios end whether the port 12489 is open or not.

[lmiltchev]

Port 12489 should be used "by default" regardless of the fact it is commented out in the NSC.ini. Just to be on a safe side, change this:

Code: Select all

;port=12489

to this:

Code: Select all

port=12489

save, exit, and restart NSClient++ service. Make sure the service is indeed running.

example01.PNG

[root@localhost ~]# nmap 192.168.5.18 -p 12489

Check if the port is open by running the following command on the Nagios XI server:

Code: Select all

nmap <client ip> -p 12489

Example:

Code: Select all

[root@localhost ~]# nmap x.x.x.x -p 12489

Starting Nmap 6.47 ( http://nmap.org ) at 2016-02-23 08:10 CST
Nmap scan report for x.x.x.x
Host is up (0.00033s latency).
PORT      STATE SERVICE
12489/tcp open  unknown
MAC Address: xx:xx:xx:xx:xx:xx (Dell)

Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds

If this doesn't work, you may try to reinstall NSClient++ agent on the Windows server, maybe try a newer version.