check_http reponse inconsistent message?

[ikekim]

I'm monitoring a Web URL and my configured service is defined with the command below and the output is shown.

I can browse to https://abc.xyz.com/LinkWeb/LinkEntry (abc.xyz.com is 49.9.168.50) and the browser renders the web page, but the response is that 404 not found with HTTP warning from Nagios XI.

My questions are:
1) why do I get the below error message if the page is rendered when navigated using the browser?
2) If it is HTTP/1.0 404 Not Found error, shouldn't this be a CRITICAL error instead of being HTTP WARNING?
3) when check_http is executed it checks both HTTP & HTTPS protocol checks?

Code: Select all

[root@null-0800276b7f7a ~]# /usr/local/nagios/libexec/check_http -I 49.9.168.50 -f ok -I 49.9.168.50 -u '/LinkWeb/LinkEntry' -S -p 9466
HTTP WARNING: HTTP/1.0 404 Not Found - 358 bytes in 0.118 second response time |time=0.117959s;;;0.000000 size=358B;;;0

[npolovenko]

Hello, @ikekim.

Why are you passing -I 49.9.168.50 two times in your command? Is the first check supposed to be for the root directory and the second one for the specific path?
Try running the command for only one -I source at a time.

Code: Select all

/usr/local/nagios/libexec/check_http -I 49.9.168.50  -u '/LinkWeb/LinkEntry' -f ok -S -p 9466

I can browse to https://abc.xyz.com/LinkWeb/LinkEntry (abc.xyz.com is 49.9.168.50) and the browser renders the web page, but the response is that 404 not found with HTTP warning from Nagios XI.

But are you able to browse https://abc.xyz.com:9466/LinkWeb/LinkEntry ?

If it is HTTP/1.0 404 Not Found error, shouldn't this be a CRITICAL error instead of being HTTP WARNING?

The fact that your plugin says Not Found - 358 bytes in 0.11 means that the plugin reached 404 page that weights 358 bytes. In the future if you want your plugin to go critical you need to specify warning and critical thresholds, where w, c represent timeout period in seconds:

Code: Select all

/usr/local/nagios/libexec/check_http -I 49.9.168.50 -w 5 -c 10  -u '/LinkWeb/LinkEntry' -f ok -S -p 9466

Also, you can try running the plugin with specifying type of connection:

Code: Select all

/usr/local/nagios/libexec/check_http -I 49.9.168.50 -4 -w 5 -c 10  -u '/LinkWeb/LinkEntry' -f ok -S -p 9466

Let us know if that works for you.

[ikekim]

@npolovenko,

thanks for the responses.

But are you able to browse https://abc.xyz.com:9466/LinkWeb/LinkEntry ?

When I browse to https://abc.xyz.com:9466/LinkWeb/LinkEntry I get "This site can't be reached" and host refuses to connect message.

Does this mean that HTTPS protocol is bound to a different port other than 9466?

thanks,
ik

[tacolover101]

[root@null-0800276b7f7a ~]# /usr/local/nagios/libexec/check_http -I 49.9.168.50 -f ok -I 49.9.168.50 -u '/LinkWeb/LinkEntry' -S -p 9466
HTTP WARNING: HTTP/1.0 404 Not Found - 358 bytes in 0.118 second response time |time=0.117959s;;;0.000000 size=358B;;;0

your web server may have multiple hosts or SNI configured - from your example, you are using the straight IP and not abc.fqdn. try changing it to use DNS as this will affect the web server with the original request only being for the ip, thus not hitting the right configuration on your web server.

if you still have issues, look on the web server side, and read logs. it should present the file it's attempting to serve, and show logic on why it failed.

[npolovenko]

Thanks, @tacolover101!
@ikekim, Keep us updated on this issue.

[ikekim]

@tacolover101,

when I use the -H switch with hostname it works where as using the -I switch with the IP address does not work.

This worked:
/usr/local/nagios/libexec/check_http -H abc.xyz.com -u '/LinkWeb/LinkEntry' -S -p 443

If the web server has multiple hosts, should it still not work when using the IP address because I'm specifying the port parameter at the end of the command?

Also, what is SNI?


thanks!

[npolovenko]

@ikekim,

This worked:
/usr/local/nagios/libexec/check_http -H abc.xyz.com -u '/LinkWeb/LinkEntry' -S -p 443

I see you changed your port from 9466 to default 443. Could it be that you were trying to run the check against the incorrect port number?

Regarding not working -I option. When the plugin checks the web server using the IP address, the web server might automatically redirect it to another path. And the plugin ends up checking the original, nonexisting path. Versus if you run the plugin with a hostname it will check whatever path your plugin is redirected to. That could be a possible explanation?

Can you try to run the plugin with IP and -I option, and with -f flag.

Code: Select all

/usr/local/nagios/libexec/check_http -I abc.xyz.com -u '/LinkWeb/LinkEntry' -f ok -S -p 443 -f ok

If the above doesn't work please run the plugin with -v at the end and show us the output.

[tacolover101]

@tacolover101,

when I use the -H switch with hostname it works where as using the -I switch with the IP address does not work.

This worked:
/usr/local/nagios/libexec/check_http -H abc.xyz.com -u '/LinkWeb/LinkEntry' -S -p 443

If the web server has multiple hosts, should it still not work when using the IP address because I'm specifying the port parameter at the end of the command?

Also, what is SNI?


thanks!

your web server is routing traffic at an application layer as it reads the host requested in the headers. an IP works, but since you don't specify the exact host, it can't map the request properly on the file system.

in the past, SSL was a 1:1 connection for cert to IP. with SNI, multiple certs can share the same IP.
https://en.m.wikipedia.org/wiki/Server_Name_Indication

it worked because your web server expects a hostname.

[kyang]

Thanks @tacolover101!

@ikekim, Did his response clear up any of your questions?

Also, SNI is server name indication. Here's a wiki explaining it.
https://en.wikipedia.org/wiki/Server_Name_Indication

Are there any more questions or are we okay to close this topic?

[ikekim]

Thank you.

That answers all my questions!