How nagios XI monitor services in the client?

[srikgali]

We have Nagios xi installed on Linux, even clients are linux servers.
I am just trying to understand that how nagios monitor the clients. lets say check_tcp service.
i see same command is there on nagios client /usr/local/nagios/libsvc and same command is available on nagios server. now i want to check weather the port 21 is open on that server. we have nagios server and client are in different subnet. when i run test on nagios server with the client, it is showing connection refused. but when i really login to the client and check the port status it is up and running and even i have checked with client server check_tcp script. saying port is open.

but not working from the server. saying connection refused.

[eloyd]

Connection refused is likely a firewall issue. Either your network in between the Nagios server and the remote client, or the remote client refusing connections via iptables from the Nagios server.

Basically, Nagios works like this:

Nagios server schedules a check
The check is executed via a plugin
Plugins typically live in /usr/local/nagios/libexec
Plugins are typically named check_<something>
Nagios executes /usr/local/nagios/libexec/check_<something> <some parameters>
The result code (0, 1, or 2) is processed as OK, Warning, or Critical
Any text that is outputted is returned to Nagios

So check_tcp must know what host to connect to and what port (port 21, in your case) and runs from the Nagios server to port 21 on the remote host. Anther way to do it is to use an agent running on the remote host. Then Nagios connects to the agent, the agent issues the service check locally on behalf of Nagios, and returns the results back to Nagios. This is also how passive checks are done. Use a search engine to find out more about "Nagios agents" and "Nagios passive checks."

[srikgali]

Thanks for your information.
SO I have nagios agent installed on client server. still nagios server checks the client from nagios server plugins? because i got same plugins are there in client machine too.

Ex: our network guys opened port (21) to other server in the client server not to the nagios server.
Nagios Client (port 21) ----> open -->remote host
Nagios client (port 21) ----> close ----> Nagios server

in this case what message i will get in the nagios server for check_tcp on 21 port?

[gormank]

Many checks run on the client via an agent, but the TCP check and check_ping just check from the Nagios server for port 21 being open on the client, and receiving valid a ICMP response for the latter.
You could ping the host and check w/ nmap/ssh to see if port 21 is
You could define a host w/ a host check of check_ping or check_icmp, and a service check of check_tcp on port 21.

[eloyd]

Agents are only used if you use whatever the method is to invoke the agent. I don't know what agent you installed, but a common one is NRPE. To use NRPE, you would need to use the check_nrpe module, which would then send a command to the NRPE agent on the remote box, the remote box would then process that command, and return the result back to check_nrpe, which then sends it back to Nagios for processing and display.

For something like checking to see if the FTP port is open, you do not need an agent. You can check this from the outside, assuming that there is no firewall blocking access. To check something like disk space usage, you would need an agent, as there is no way to find out how much disk is being used from the outside of the box. You must be logged in (or running an agent) to find out.

In order for Nagios to probe port 21 on a remote server using check_tcp, there needs to be an open firewall path from the Nagios server to the remote server, and the internal firewall of the remote server (iptables, most likely) needs to allow the connection as well.

[rkennedy]

Thanks @gormank and @eloyd!

As an example of how check_tcp works, I'll leave this here -

Code: Select all

[root@localhost libexec]# ./check_tcp -H 127.0.0.1 -p 80
TCP OK - 0.000 second response time on 127.0.0.1 port 80|time=0.000058s;;;0.000000;10.000000
[root@localhost libexec]# ./check_tcp -H google.com -p 80
TCP OK - 0.021 second response time on google.com port 80|time=0.021338s;;;0.000000;10.000000
[root@localhost libexec]# ./check_tcp -H google.com -p 1234
CRITICAL - Socket timeout after 10 seconds
[root@localhost libexec]#

As google.com doesn't have the port '1234' open, it's going to fail. Say we wanted to check an additional machine, to see if SSH was open. We would just change the 80 to 22.

Code: Select all

[root@localhost libexec]# ./check_tcp -H 192.168.3.190 -p 22
TCP OK - 0.000 second response time on 192.168.3.190 port 22|time=0.000498s;;;0.000000;10.000000

@srikgali - let us know if you have any further questions.

[srikgali]

Got it thakns

[mcapra]

Is it alright if we lock this thread and mark the issue as resolved?

[srikgali]

Yes.. Thanks for your support..