check_nrpe giving different result to running actual command

[martinm]

Debian Squeeze, Nagios 3.2.3, monitoring (info2) server nrpe v2.0, monitored server (info1) v2.12

I've got a weird problem - the system is working fine except for two plugins.

First one is cron process count is showing as 2. Running the local and remote check commands on the monitored server gives different results :

Code: Select all

info1:~$ /usr/lib/nagios/plugins/check_procs -c 1:1 -a /usr/sbin/cron
PROCS OK: 1 process with args '/usr/sbin/cron'

Code: Select all

info1:~$ /usr/local/nagios/libexec/check_nrpe -t 30 -H localhost  -c check_cron
PROCS CRITICAL: 2 processes with args '/usr/sbin/cron'

Syslog gives no more info

Code: Select all

Feb  6 09:19:12 info1 nrpe[4345]: Connection from xx.xx.xx.xx port 47233
Feb  6 09:19:12 info1 nrpe[4345]: Host address is in allowed_hosts
Feb  6 09:19:12 info1 nrpe[4345]: Handling the connection...
Feb  6 09:19:12 info1 nrpe[4345]: Host is asking for command 'check_cron' to be run...
Feb  6 09:19:12 info1 nrpe[4345]: Running command: /usr/lib/nagios/plugins/check_procs -c 1:1 -a /usr/sbin/cron
Feb  6 09:19:12 info1 nrpe[4345]: Command completed with return code 2 and output: PROCS CRITICAL: 2 processes with args '/usr/sbin/cr
on'
Feb  6 09:19:12 info1 nrpe[4345]: Return Code: 2, Output: PROCS CRITICAL: 2 processes with args '/usr/sbin/cron'
Feb  6 09:19:12 info1 nrpe[4345]: Connection from xx.xx.xx.xx closed.

Any ideas what could be causing this?

Thanks,

Martin.

[jsmurphy]

What's the output if you do a 'ps -ef | grep cron' from the command line? Something somewhere would have to be referencing cron... there's a better command for determining this sort of thing but it escapes me right now.

[martinm]

ps -ef | grep cron
root 1794 1 0 Feb03 ? 00:00:00 /usr/sbin/cron
root 3583 19036 0 11:19 pts/0 00:00:00 grep cron


As expected.