URL status monitoring

[RIDS_I2MP]

Hi Team,

We are using Nagios XI 2014 R 2.7 for monitoring our servers. URL status monitoring is also enabled. Recently we had a issue for few URLs but we didn't receive alerts for one URL whereas alerts for rest URLs were received.

URL response on the browser (alert was received)
- "The page can't be displayed" similar message was received.

URL response on the browser (alert was not received)
- Heading of URL was displayed for eg: "IBM Cognos" below that message was displayed "An error has occurred, the dispatcher can't service the request at this time...."

Kindly can you let us know below points:
1) why we didn't receive the alert?
2) what exactly is monitored in "URL status" ?

[ssax]

Please attach a sanitized copy of the service entry and the command that it uses from your /usr/local/nagios/var/objects.cache file so that we can review it.

Are you checking to see if the port is open or if the expected content is on the screen?

Thank you

[RIDS_I2MP]

Please attach a sanitized copy of the service entry and the command that it uses from your /usr/local/nagios/var/objects.cache file so that we can review it.

Are you checking to see if the port is open or if the expected content is on the screen?

Thank you

Hi Team,

Below entry is made in the /usr/local/nagios/var/objects.cache:

define command {
command_name check-host-alive-http
command_line $USER1$/check_http -H $HOSTADDRESS$
}

and below is the command used:

/usr/local/nagios/libexec/check_http -H <hostip> -f ok -I <IP> -u <extended part of URL>-p 80

We want to monitor whether the URL is responding and displaying the basic page.

[ssax]

Ok, it looks like you were just checking the port to see if the port was open, that's a different type of check than checking if the page is up and service the content you expect, let's adjust it to use the -s parameter so that it will search the returned HTML to see if a string is present, change it to something like this:

Code: Select all

/usr/local/nagios/libexec/check_http -H <hostip> -f follow -I <IP> -u '<extended part of URL>' -p 80 -s 'string you expect to be on the page if the web server is working properly'

You can run most plugins with the -h parameter to see all the available options so that you can customize the checks to your liking:

Code: Select all

[root@ssc66xi ~]# /usr/local/nagios/libexec/check_http -h
check_http v2.0.3 (nagios-plugins 2.0.3)
Copyright (c) 1999 Ethan Galstad <[email protected]>
Copyright (c) 1999-2014 Nagios Plugin Development Team
        <[email protected]>

This plugin tests the HTTP service on the specified host. It can test
normal (http) and secure (https) servers, follow redirects, search for
strings and regular expressions, check connection times, and report on
certificate expiration times.


Usage:
 check_http -H <vhost> | -I <IP-address> [-u <uri>] [-p <port>]
       [-J <client certificate file>] [-K <private key>]
       [-w <warn time>] [-c <critical time>] [-t <timeout>] [-L] [-E] [-a auth]
       [-b proxy_auth] [-f <ok|warning|critcal|follow|sticky|stickyport>]
       [-e <expect>] [-d string] [-s string] [-l] [-r <regex> | -R <case-insensitive regex>]
       [-P string] [-m <min_pg_size>:<max_pg_size>] [-4|-6] [-N] [-M <age>]
       [-A string] [-k string] [-S <version>] [--sni] [-C <warn_age>[,<crit_age>]]
       [-T <content-type>] [-j method]
NOTE: One or both of -H and -I must be specified

Options:
 -h, --help
    Print detailed help screen
 -V, --version
    Print version information
 --extra-opts=[section][@file]
    Read options from an ini file. See
    https://www.nagios-plugins.org/doc/extra-opts.html
    for usage and examples.
 -H, --hostname=ADDRESS
    Host name argument for servers using host headers (virtual host)
    Append a port to include it in the header (eg: example.com:5000)
 -I, --IP-address=ADDRESS
    IP address or name (use numeric address if possible to bypass DNS lookup).
 -p, --port=INTEGER
    Port number (default: 80)
 -4, --use-ipv4
    Use IPv4 connection
 -6, --use-ipv6
    Use IPv6 connection
 -S, --ssl=VERSION
    Connect via SSL. Port defaults to 443. VERSION is optional, and prevents
    auto-negotiation (1 = TLSv1, 2 = SSLv2, 3 = SSLv3).
 --sni
    Enable SSL/TLS hostname extension support (SNI)
 -C, --certificate=INTEGER[,INTEGER]
    Minimum number of days a certificate has to be valid. Port defaults to 443
    (when this option is used the URL is not checked.)
 -J, --client-cert=FILE
   Name of file that contains the client certificate (PEM format)
   to be used in establishing the SSL session
 -K, --private-key=FILE
   Name of file containing the private key (PEM format)
   matching the client certificate
 -e, --expect=STRING
    Comma-delimited list of strings, at least one of them is expected in
    the first (status) line of the server response (default: HTTP/1.)
    If specified skips all other status line logic (ex: 3xx, 4xx, 5xx processing)
 -d, --header-string=STRING
    String to expect in the response headers
 -s, --string=STRING
    String to expect in the content
 -u, --url=PATH
    URL to GET or POST (default: /)
 -P, --post=STRING
    URL encoded http POST data
 -j, --method=STRING  (for example: HEAD, OPTIONS, TRACE, PUT, DELETE)
    Set HTTP method.
 -N, --no-body
    Don't wait for document body: stop reading after headers.
    (Note that this still does an HTTP GET or POST, not a HEAD.)
 -M, --max-age=SECONDS
    Warn if document is more than SECONDS old. the number can also be of
    the form "10m" for minutes, "10h" for hours, or "10d" for days.
 -T, --content-type=STRING
    specify Content-Type header media type when POSTing

 -l, --linespan
    Allow regex to span newlines (must precede -r or -R)
 -r, --regex, --ereg=STRING
    Search page for regex STRING
 -R, --eregi=STRING
    Search page for case-insensitive regex STRING
 --invert-regex
    Return CRITICAL if found, OK if not

 -a, --authorization=AUTH_PAIR
    Username:password on sites with basic authentication
 -b, --proxy-authorization=AUTH_PAIR
    Username:password on proxy-servers with basic authentication
 -A, --useragent=STRING
    String to be sent in http header as "User Agent"
 -k, --header=STRING
    Any other tags to be sent in http header. Use multiple times for additional headers
 -E, --extended-perfdata
    Print additional performance data
 -L, --link
    Wrap output in HTML link (obsoleted by urlize)
 -f, --onredirect=<ok|warning|critical|follow|sticky|stickyport>
    How to handle redirected pages. sticky is like follow but stick to the
    specified IP address. stickyport also ensures port stays the same.
 -m, --pagesize=INTEGER<:INTEGER>
    Minimum page size required (bytes) : Maximum page size required (bytes)
 -w, --warning=DOUBLE
    Response time to result in warning status (seconds)
 -c, --critical=DOUBLE
    Response time to result in critical status (seconds)
 -t, --timeout=INTEGER
    Seconds before connection times out (default: 10)
 -v, --verbose
    Show details for command-line debugging (Nagios may truncate output)

Notes:
 This plugin will attempt to open an HTTP connection with the host.
 Successful connects return STATE_OK, refusals and timeouts return STATE_CRITICAL
 other errors return STATE_UNKNOWN.  Successful connects, but incorrect reponse
 messages from the host result in STATE_WARNING return values.  If you are
 checking a virtual server that uses 'host headers' you must supply the FQDN
 (fully qualified domain name) as the [host_name] argument.

 This plugin can also check whether an SSL enabled web server is able to
 serve content (optionally within a specified time) or whether the X509
 certificate is still valid for the specified number of days.

 Please note that this plugin does not check if the presented server
 certificate matches the hostname of the server, or if the certificate
 has a valid chain of trust to one of the locally installed CAs.

Examples:
 CHECK CONTENT: check_http -w 5 -c 10 --ssl -H www.verisign.com

 When the 'www.verisign.com' server returns its content within 5 seconds,
 a STATE_OK will be returned. When the server returns its content but exceeds
 the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,
 a STATE_CRITICAL will be returned.

 CHECK CERTIFICATE: check_http -H www.verisign.com -C 14

 When the certificate of 'www.verisign.com' is valid for more than 14 days,
 a STATE_OK is returned. When the certificate is still valid, but for less than
 14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when
 the certificate is expired.

 CHECK CERTIFICATE: check_http -H www.verisign.com -C 30,14

 When the certificate of 'www.verisign.com' is valid for more than 30 days,
 a STATE_OK is returned. When the certificate is still valid, but for less than
 30 days, but more than 14 days, a STATE_WARNING is returned.
 A STATE_CRITICAL will be returned when certificate expires in less than 14 days

Send email to [email protected] if you have questions regarding use
of this software. To submit patches or suggest improvements, send email to
[email protected]

Let us know if you have any questions.


Thank you

[RIDS_I2MP]

Hi Team,

I have used the -s option to detect the string on the web page, but I am receiving a wrong output. it is unable to detect the string.

COMMAND: /usr/local/nagios/libexec/check_http -H <hostip> -f ok -I <ip> -u 'extended URL'-p 80 -s 'Namespace:'
OUTPUT: HTTP CRITICAL: HTTP/1.1 301 Moved Permanently - string 'Namespace:' not found on '<URL>'- 448 bytes in 0.003 second response time |time=0.003217s;;;0.000000 size=448B;;;0

As mentioned above 'Namespace:' is not found but string is present on the web page of this URL.

URL_snapshot.PNG

Kindly suggest.

[ssax]

Try changing -f ok to -f follow and try it again.

Thank you

[RIDS_I2MP]

Hi Team,

Yet receiving the same error:

COMMAND: /usr/local/nagios/libexec/check_http -H <IP> -f follow -I <IP> -u <extended URL>-p 80 -s 'Namespace:'
OUTPUT: HTTP CRITICAL: HTTP/1.1 200 OK - string 'Namespace:' not found on <URL> - 1068 bytes in 0.002 second response time |time=0.002194s;;;0.000000 size=1068B;;;0


what does exactly use of -f follow mean?

[ssax]

It means that if it hits a redirect, follow it to the final destination.

Please add the -v option to it to see what you are getting:

Code: Select all

/usr/local/nagios/libexec/check_http -H <IP> -f follow -I <IP> -u <extended URL>-p 80 -s 'Namespace:' -v

[RIDS_I2MP]

Hi Team,

Below mentioned is the output:

COMMAND: /usr/local/nagios/libexec/check_http -H <IP> -f ok -I <IP> -u <extended URL> -p 80 -s 'Namespace:' -v
OUTPUT: GET <extended URL>HTTP/1.1
User-Agent: check_http/v2.0.3 (nagios-plugins 2.0.3)
Connection: close
Host: <IP>
Accept: */*


<URL> is 448 characters
STATUS: HTTP/1.1 301 Moved Permanently
**** HEADER ****
Date: Fri, 02 Jun 2017 06:42:42 GMT
Server: Apache
Location: <URL>
Content-Length: 236
Connection: close
Content-Type: text/html; charset=iso-8859-1
**** CONTENT ****
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="<URL>">here</a>.</p>
</body></html>

HTTP CRITICAL: HTTP/1.1 301 Moved Permanently - string 'Namespace:' not found on <URL>- 448 bytes in 0.001 second response time |time=0.001167s;;;0.000000 size=448B;;;0

Close
* = Required for this object type

kindly suggest.

[ssax]

Now run this command with -f follow and see the difference in output, the first one stops at the redirect, this one should continue through to the page:

Code: Select all

/usr/local/nagios/libexec/check_http -H <IP> -f follow -I <IP> -u <extended URL> -p 80 -s 'Namespace:' -v