Problems With NRDP Clients - Windows and Mac

[TCN-Link]

Thank you, @ssax!

Here's the requested screenshot. The "Start in" is, in entirety, C:\PROGRA~1\Nagios\NRDS_Win.

Screen Shot 2017-02-27 at 3.25.46 PM.jpg

It's worth noting that I had a couple of coworkers, both using Windows, install the NRDS client. They have the same problems. The issue is not limited to my test machine.

[ssax]

When viewing the scheduled task, scroll over to the right, what does the Last Run Result say?

I'm not able to replicate it on mine, I just freshly set it up and it works the first time and then it works repeatedly afterwards. Do you see anything in your windows event logs either under security or application that may be related? I'm wondering if you have some windows hardening (group policy) settings that may be restricting it.


Thank you

[TCN-Link]

The Last Run Result says the Operation Was Succesful. Nothing shows up in the event logs.

When you installed it, did you use my server and configuration? If so, did any of my scripts download into the plugins folder? I ask because, like my other three computers which I tested this, your system didn't come up in our Unconfigured Objects.

Screen Shot 2017-02-28 at 7.38.52 AM.jpg

So, the scheduled task is running. It tries running the vbs script. The vbs script doesn't appear to be much of doing anything. There doesn't seem to be anything out of the ordinary in the Event Logs for the times the script tried to run.

Is there a chance you could have a peak on the server and see if something's wrong there? This happens on multiple Windows and Mac systems, so I don't think the problem is specific to the system. If there are any settings or group policies restricting it, then it's happening on Windows' default settings.

[ssax]

No, we do not have access to your server, I just set it up on a fresh install and then ran the NRDS installer on my windows machine and it sent them into my XI server, I just did it for testing to see if I could replicate it. It did download the plugins that I created on my server and it also downloaded new ones when I added more.

I apologize, we don't offer remote sessions for non-customers.

Run these commands on your XI server:
- Make sure to change X.X.X.X to the IP of your windows server

Code: Select all

yum install tcpdump
tcpdump -n src host X.X.X.X

Do you see any communication coming from the windows server at all? (let it run longer than the interval that you set on NRDS_Win installation).

[ssax]

Oh, also, in addition to my previous post, please run this tail command in another XI SSH session while waiting for the results of the other one, I want to see if there are any errors listed that might be related:

Code: Select all

tail -f /var/log/httpd/*error_log

[TCN-Link]

Sure, but which IP address should I use? Since, again, we literally have no infrastructure and no centralized connectivity, we don't have any direct connections to nor can we assign IP addresses to any clients we plan to monitor. They're all connecting via the Internet. So, in monitoring one of the Windows clients, will tcpdump still work with that computer's actual IP address or do I need to use the IP address of the router or cable modem provided by the ISP?

Here's what happens when I tail the log file you asked for thus far:
==> /var/log/httpd/error_log <==

Code: Select all

[Wed Mar 01 01:31:54.597889 2017] [:error] [pid 23915] [client 196.53.32.11:60385] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 02:01:54.076112 2017] [:error] [pid 23915] [client 196.53.32.11:60789] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 02:31:54.442511 2017] [:error] [pid 24647] [client 196.53.32.11:61160] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 03:01:54.283865 2017] [:error] [pid 24316] [client 196.53.32.11:61565] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 03:31:53.925974 2017] [:error] [pid 30842] [client 196.53.32.11:61965] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 04:01:53.981803 2017] [:error] [pid 22591] [client 196.53.32.11:62369] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 04:31:53.918681 2017] [:error] [pid 24647] [client 196.53.32.11:62741] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 05:01:53.885540 2017] [:error] [pid 24316] [client 196.53.32.11:63116] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 05:31:53.780478 2017] [:error] [pid 30842] [client 196.53.32.11:63507] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 06:01:53.692091 2017] [:error] [pid 14455] [client 196.53.32.11:63891] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270

==> /var/log/httpd/ssl_error_log <==
[Wed Mar 01 01:17:11.450836 2017] [ssl:error] [pid 16475] [client 208.93.152.88:35466] AH02042: rejecting client initiated renegotiation

I'll keeping tailing it and see if anything else arises.

[TCN-Link]

More on the tailed error log as of the time of this post reply:

Code: Select all

==> /var/log/httpd/error_log <==
[Wed Mar 01 06:31:53.597859 2017] [:error] [pid 24647] [client 196.53.32.11:64249] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 07:01:53.619314 2017] [:error] [pid 5888] [client 196.53.32.11:64698] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 07:31:53.574915 2017] [:error] [pid 7692] [client 196.53.32.11:65174] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 08:01:53.512574 2017] [:error] [pid 11621] [client 196.53.32.11:49678] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 08:31:53.405630 2017] [:error] [pid 8804] [client 196.53.32.11:50217] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 09:01:53.444449 2017] [:error] [pid 20830] [client 196.53.32.11:50933] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 09:31:53.382027 2017] [:error] [pid 19076] [client 196.53.32.11:51591] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
2017-03-01 09:56:53,512 - NRDS - INFO - invoking NRDS Taylor
2017-03-01 09:56:53,512 - NRDS - DEBUG - entering debug mode
2017-03-01 09:56:53,512 - NRDS - DEBUG - remove silent install arguments
2017-03-01 09:56:53,512 - NRDS - DEBUG - working file =/usr/local/nrdp/win_clients/tmp/NRDS_Win_64.nsi
sh: /usr/local/nsis/bin/makensis: No such file or directory
[Wed Mar 01 10:01:53.122216 2017] [:error] [pid 12334] [client 196.53.32.11:52187] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 10:01:56.165781 2017] [:error] [pid 12390] [client 71.85.156.81:41510] PHP Warning:  simplexml_load_file(https://www.nagios.com/backend/feeds/products/nagiosxi/): failed to open stream: HTTP request failed! HTTP/1.0 404 Not Found\r\n in /usr/local/nagiosxi/html/includes/components/xicore/ajaxhelpers-misc.inc.php on line 532, referer: http://nagios.codingnetwork.com/nagiosxi//includes/page-home-main.php?&=
[Wed Mar 01 10:01:56.165842 2017] [:error] [pid 12390] [client 71.85.156.81:41510] PHP Warning:  simplexml_load_file(): I/O warning : failed to load external entity "https://www.nagios.com/backend/feeds/products/nagiosxi/" in /usr/local/nagiosxi/html/includes/components/xicore/ajaxhelpers-misc.inc.php on line 532, referer: http://nagios.codingnetwork.com/nagiosxi//includes/page-home-main.php?&=
[Wed Mar 01 10:01:56.165857 2017] [:error] [pid 12390] [client 71.85.156.81:41510] PHP Notice:  Trying to get property of non-object in /usr/local/nagiosxi/html/includes/components/xicore/ajaxhelpers-misc.inc.php on line 537, referer: http://nagios.codingnetwork.com/nagiosxi//includes/page-home-main.php?&=
[Wed Mar 01 10:01:56.165863 2017] [:error] [pid 12390] [client 71.85.156.81:41510] PHP Notice:  Trying to get property of non-object in /usr/local/nagiosxi/html/includes/components/xicore/ajaxhelpers-misc.inc.php on line 537, referer: http://nagios.codingnetwork.com/nagiosxi//includes/page-home-main.php?&=
[Wed Mar 01 10:01:56.165867 2017] [:error] [pid 12390] [client 71.85.156.81:41510] PHP Warning:  Invalid argument supplied for foreach() in /usr/local/nagiosxi/html/includes/components/xicore/ajaxhelpers-misc.inc.php on line 537, referer: http://nagios.codingnetwork.com/nagiosxi//includes/page-home-main.php?&=
[Wed Mar 01 10:31:53.371409 2017] [:error] [pid 3261] [client 67.248.172.169:53034] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270
[Wed Mar 01 10:44:44.587420 2017] [:error] [pid 487] [client 71.85.156.81:46950] PHP Warning:  explode() expects parameter 2 to be string, array given in /usr/local/nagiosxi/html/includes/utilsl.inc.php on line 3456, referer: http://nagios.codingnetwork.com/nagiosxi/includes/components/ccm/?cmd=view&type=host
[Wed Mar 01 10:44:44.587450 2017] [:error] [pid 487] [client 71.85.156.81:46950] PHP Warning:  Invalid argument supplied for foreach() in /usr/local/nagiosxi/html/includes/utilsl.inc.php on line 3457, referer: http://nagios.codingnetwork.com/nagiosxi/includes/components/ccm/?cmd=view&type=host
[Wed Mar 01 10:45:48.729936 2017] [:error] [pid 3261] [client 71.85.156.81:37448] PHP Warning:  explode() expects parameter 2 to be string, array given in /usr/local/nagiosxi/html/includes/utilsl.inc.php on line 3456, referer: http://nagios.codingnetwork.com/nagiosxi/includes/components/ccm/index.php?cmd=view&type=host&page=1
[Wed Mar 01 10:45:48.729966 2017] [:error] [pid 3261] [client 71.85.156.81:37448] PHP Warning:  Invalid argument supplied for foreach() in /usr/local/nagiosxi/html/includes/utilsl.inc.php on line 3457, referer: http://nagios.codingnetwork.com/nagiosxi/includes/components/ccm/index.php?cmd=view&type=host&page=1
[Wed Mar 01 10:47:01.683310 2017] [:error] [pid 12390] [client 71.85.156.81:33337] PHP Warning:  explode() expects parameter 2 to be string, array given in /usr/local/nagiosxi/html/includes/utilsl.inc.php on line 3456, referer: http://nagios.codingnetwork.com/nagiosxi/includes/components/ccm/?cmd=view&type=host
[Wed Mar 01 10:47:01.683344 2017] [:error] [pid 12390] [client 71.85.156.81:33337] PHP Warning:  Invalid argument supplied for foreach() in /usr/local/nagiosxi/html/includes/utilsl.inc.php on line 3457, referer: http://nagios.codingnetwork.com/nagiosxi/includes/components/ccm/?cmd=view&type=host
[Wed Mar 01 10:54:26.735548 2017] [:error] [pid 1511] [client 71.85.156.81:41052] PHP Warning:  array_multisort(): Argument #1 is expected to be an array or a sort flag in /usr/local/nagiosxi/html/includes/utils-tools.inc.php on line 33, referer: http://nagios.codingnetwork.com/nagiosxi/
[Wed Mar 01 11:01:53.229314 2017] [:error] [pid 31329] [client 67.248.172.169:53476] PHP Notice:  Undefined variable: api_version in /usr/local/nrdp/server/plugins/nrdsconfigupdate/nrdsconfigupdate.inc.php on line 270

I did build a new NRDS configuration for a remote Windows server that we sometimes have to troubleshoot, but that's not the focus right now.

[avandemore]

Is the remote client hitting SSL? I find this log entry very curious:

Code: Select all

[Wed Mar 01 01:17:11.450836 2017] [ssl:error] [pid 16475] [client 208.93.152.88:35466] AH02042: rejecting client initiated renegotiation

[TCN-Link]

It shouldn't be. The server address is only http. I've done nothing with SSL on it. I'm not sure why it would be.

[avandemore]

If it was me writing the script, I'd have it create some sort of log of it's actions and state. This way it would easier to tell differences from when it's run as a scheduled command or interactively. They usually have quite different environment.

Otherwise given the info in your logs there really isn't enough to go on. The access_log will also list the ending part of the url visited and the source IP so it may be easier to match things up with that info.