getting check_nrpe to work on new nagios core install

Support forum for Nagios Core, Nagios Plugins, NCPA, NRPE, NSCA, NDOUtils and more. Engage with the community of users including those using the open source solutions.
Locked
Pierogi
Posts: 21
Joined: Thu Feb 15, 2018 10:28 am

getting check_nrpe to work on new nagios core install

Post by Pierogi »

I'm a noob to using Nagios Core but now have an environment configured to monitor several Windows/Exchange servers and it's working great. I have it configured to monitor all critical services and send email notificatiosn but now I want to get NRPE configured so I can call on powershell scripts.

Client communication has not worked for NRPE scripts so I wanted to start local; it seems as though I should be able to run 'check_nrpe' against the local Nagios Core server to make sure it's working and then try to reach the client. However, when I try to do that, I just get errors.

If I run "/usr/local/nagios/libexec/check_nrpe -H 127.0.0.1", I get, "CHECK_NRPE: Error receiving data from daemon."

If I run it on a monitored NSClient++ subject, I get, "CHECK_NRPE: Received 0 bytes from daemon. Check the remote server logs for error messages."

The logs on the client will read, "Seems we other end is not using ssl: unknown protocol" and "Please review the ssl option as well as ssl options in settings."

The NRPE version installed is 2.15.

OpenSSL 1.0.2g version is installed.

In the /usr/local/nagios/etc/nrpe.cfg file on the Nagios Core server, the following lines are configured:

server_port=5666
allowed_hosts=127.0.0.1,[IP of nagios core server]

The services file has the NRPE port specified.
sudo vi /etc/services
nrpe 5666/tcp

/usr/local/nagios/etc/nagios.cfg
uncommented: cfg_dir=/usr/local/nagios/etc/servers

I run sudo /etc/init.d/nagios-nrpe-server restart after making changes.

The config file /etc/xinetd.d/nrpe file contains the right port and server.

I might be getting a little ahead of myself but basically want to make sure check_nrpe works before I try communicating with clients.

Any thoughts one the direction I should take or what to check next?
npolovenko
Support Tech
Posts: 3457
Joined: Mon May 15, 2017 5:00 pm

Re: getting check_nrpe to work on new nagios core install

Post by npolovenko »

Hi, @Pierogi. The NRPE consists of two parts:
1. The daemon that runs on a client-server and collects the various information about the system by executing service checks.
2. The check_nrpe plugin that you have on your nagios core. It is just a script that connects to the daemon on the remote server and gathers the information.
basically want to make sure check_nrpe works before I try communicating with clients.
Not sure why'd you want to do that if you're not planning to monitor the nagios server itself from some other server. We don't know if you have the nrpe daemon running on the nagios server. If your goal is to monitor a windows server let's focus on that instead.

So you installed the NSCLient on the windows server, right? So when you run:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H windows_client_ip 
You get "CHECK_NRPE: Received 0 bytes from daemon", Correct?

Please share the nsclient.ini file from the windows server.

Code: Select all

C:\Program Files\NSClient++\nsclient.ini
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy.
Pierogi
Posts: 21
Joined: Thu Feb 15, 2018 10:28 am

Re: getting check_nrpe to work on new nagios core install

Post by Pierogi »

Thanks npolovenko. I think your questions is getting me back on the right track. I was originally thinking of resolving the errors to the local nagios core to start close to the source and work out from there but I like your idea of cutting right to what I'm ultimately trying to do; get NRPE working between Nagios Core and a monitored Windows Server.

Yes, I receive the "CHECK_NRPE: Received 0 bytes from daemon" error.

I've uploaded the nsclient.ini file. It seems like I've made the most test changes to the "allowed ciphers", "verify mode", "NRPE: use ssl" and "NRPE: insecure" lines but with no luck.

Thank you very much.
Attachments
nsclient.ini
(28.83 KiB) Downloaded 357 times
npolovenko
Support Tech
Posts: 3457
Joined: Mon May 15, 2017 5:00 pm

Re: getting check_nrpe to work on new nagios core install

Post by npolovenko »

@Pierogi, No problem. Are you able to ping the windows server IP address from the Nagios server?
Your nsclient.ini file seems to be ok, however, I like to give people the one I configured myself, and the one I know is working.
You can replace the existing ini file with the one i'm attaching, then restart the NSCLient service.
After that try run the command from the Nagios server one more time.
If it fails please run the following command from the nagios server:

Code: Select all

nmap 192.168.3.145 
*Replace the ip address with the windows server IP address.
Attachments
nsclient.ini
(23.16 KiB) Downloaded 367 times
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy.
Pierogi
Posts: 21
Joined: Thu Feb 15, 2018 10:28 am

Re: getting check_nrpe to work on new nagios core install

Post by Pierogi »

Yes, I can ping with no issue.

ping 10.192.3.160
PING 10.192.3.160 (10.192.3.160) 56(84) bytes of data.
64 bytes from 10.192.3.160: icmp_seq=1 ttl=127 time=0.181 ms
64 bytes from 10.192.3.160: icmp_seq=2 ttl=127 time=0.181 ms

When I dropped the nsclient.ini file you sent (which contains server information from the one I sent you), I get all warnings with 'could not fetch information from server'.

I put my original back in place and the warnings stopped.

I attached the namp results.
Attachments
56392-14 nmap results.txt
(844 Bytes) Downloaded 322 times
npolovenko
Support Tech
Posts: 3457
Joined: Mon May 15, 2017 5:00 pm

Re: getting check_nrpe to work on new nagios core install

Post by npolovenko »

@Pierogi , When did you get the warnings?
Have you tried running:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H windows_client_ip
with my ini file?
Can you post the nsclient.log file here?
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy.
Pierogi
Posts: 21
Joined: Thu Feb 15, 2018 10:28 am

Re: getting check_nrpe to work on new nagios core install

Post by Pierogi »

I got the warnings after I put your ini file into production and restarted the NSClient service. Are you sure you sent the correct one? The one you sent has my server IP in it

so wasn't sure if it was new.

I tried using your file a second time just now and immediately get 'status critical; connect to address 10.192.3.160 and port 12489: Connection refused".

After about a minute of running, most changed to Unkown with "NSClient - ERROR: Invalid password", all except the NSClient version.

Here are the results I get with the command:

/usr/local/nagios/libexec/check_nrpe -H 10.192.3.160
CHECK_NRPE: Received 0 bytes from daemon. Check the remote server logs for error messages.

I'm attaching the log file from the test.

Also going through the ini files and comparing mine and yours. I did notice my 'password' is UNKNOWN and yours is welcome. I may try to test again and change the password on yours. I've not learned how to match the password on the client with the Nagios Server yet.
Attachments
nsclient 20180514.log
(15.76 KiB) Downloaded 323 times
npolovenko
Support Tech
Posts: 3457
Joined: Mon May 15, 2017 5:00 pm

Re: getting check_nrpe to work on new nagios core install

Post by npolovenko »

@Pierogi, Exactly, that is most likely where the problem lays.
Also going through the ini files and comparing mine and yours. I did notice my 'password' is UNKNOWN and yours is welcome. I may try to test again and change the password on yours. I've not learned how to match the password on the client with the Nagios Server yet.
Please send me a couple NSClient check definitions from your Nagios Core and I'll show you how to add a token.


PS: Usually the token goes after -t. So in this case the token is Str0ngT0k3n.

Code: Select all

./check_ncpa.py -H 10.25.254.50 -t Str0ngT0k3n -M cpu/percent --warning 90 --critical 95
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy.
Locked