Passive Check Not working

[tariqkipkemei]

Hi,

Just installed XI,confiugred passive services and host.Confgured NSCA with decryption method and password,made sure it is running and listening on port 5667.
Configured send_nsca at client with encyption method and password same as on server.
Sent data from client and got response '2 data packet(s) sent to host successfully'.

But,on tailing 'nagios.log' nothing seems to be coming through.
Firewall and iptables on server both open on port 5667.

Any advise on what I might be overlooking?
Thanks

[rkennedy]

From the Nagios XI machine, do you see data incoming if you run a tcpdump?

Code: Select all

tcpdump -s 0 -i any port 5667

This should help to see if it's reaching the XI machine or not, then we can see if it's not processing properly.

[tariqkipkemei]

Yes,data is incoming.

Code: Select all

18:48:24.645612 IP 10.190.83.22.nsca > 10.190.84.83.conclave-cpp: Flags [S.], seq 2909711137, ack 1616225547, win 14600, options [mss 1460,nop,nop,sackOK], length 0
18:48:24.646460 IP 10.190.84.83.conclave-cpp > 10.190.83.22.nsca: Flags [.], ack 1, win 65535, length 0
18:48:24.776914 IP 10.190.83.22.nsca > 10.190.84.83.conclave-cpp: Flags [P.], seq 1:133, ack 1, win 14600, length 132
18:48:24.781600 IP 10.190.84.83.conclave-cpp > 10.190.83.22.nsca: Flags [F.], seq 1, ack 133, win 65403, length 0
18:48:24.782235 IP 10.190.83.22.nsca > 10.190.84.83.conclave-cpp: Flags [.], ack 2, win 14600, length 0
18:48:25.777990 IP 10.190.83.22.nsca > 10.190.84.83.conclave-cpp: Flags [F.], seq 133, ack 2, win 14600, length 0

50 packets captured
54 packets received by filter
0 packets dropped by kernel

Please advise

[tariqkipkemei]

I increased the debug level=1,now seeing error:

Code: Select all

  Dropping packet with invalid CRC32 - possibly due to client using wrong password or crypto algorithm?

Even though the password and algorithm are the same on both nsca.cfg(server) and send_nsca.cfg on client.

Please advise.

[tariqkipkemei]

Went ahead and removed both password and encryption on both files.Still getting same error as above.

Please advise.

[tariqkipkemei]

OK managed by downgrading from NSCA 2.9.1 to NSCA to 2.7.2.
I now see the passive check coming in when tailing nagios.log
Still an issue though,the host and services on web interface are still on status 'PENDING'.

Please note,i have made sure that the hostname and service description both match on incoming passive check and on nagios server.
There is no error of 'CANNOT FIND HOST OR SERVICE' on the log,which means things are ok.

Please advise on what I might be overlooking.

[tariqkipkemei]

The web interface finally started updating.

[rkennedy]

Did it just take time? Was the machine hitting a resource limit by any chance? This would explain why it took a while.

[tariqkipkemei]

The machine is,i can seen the passive checks coming in on nagios.log
But the web interface is taking upto to an hour to update.

What could I be overlooking?

The check interval is set to 5mins.

[rkennedy]

What is the output of top|head -n5 and ps -ef? It sounds like you're hitting a resource throttle.