Problem running Check IIS App Pool plugin

[jkelly1959]

Having trouble getting started with Check IIS Application pool plugin.

When setting up and attempting to run of nagios server we get the following:

NRPE Plugin for Nagios
Copyright (c) 1999-2008 Ethan Galstad ([email protected])
Version: 2.15
Last Modified: 09-06-2013
License: GPL v2 with exemptions (-l for more info)
SSL/TLS Available: Anonymous DH Mode, OpenSSL 0.9.6 or higher required

Usage: check_nrpe -H <host> [ -b <bindaddr> ] [-4] [-6] [-n] [-u] [-p <port>] [-t <timeout>] [-c <command>] [-a <arglist...>]

Options:
-n = Do no use SSL
-u = Make socket timeouts return an UNKNOWN state instead of CRITICAL
<host> = The address of the host running the NRPE daemon
<bindaddr> = bind to local address
-4 = user ipv4 only
-6 = user ipv6 only
[port] = The port on which the daemon is running (default=5666)
[timeout] = Number of seconds before connection times out (default=10)
[command] = The name of the command that the remote daemon should run
[arglist] = Optional arguments that should be passed to the command. Multiple
arguments should be separated by a space. If provided, this must be
the last option supplied on the command line.

Note:
This plugin requires that you have the NRPE daemon running on the remote host.
You must also have configured the daemon to associate a specific plugin command
with the [command] option you are specifying here. Upon receipt of the
[command] argument, the NRPE daemon will run the appropriate plugin command and
send the plugin output and return code back to *this* plugin. This allows you
to execute plugins on remote hosts and 'fake' the results to make Nagios think
the plugin is being run locally.

When I attempt to run the command from our XI server we get the following:

[nagios@lnxvnaghq001 libexec]$ ./check_nrpe -H plbuwebhqpcf002.cinfin.com -p 5666 -t 60 -c check_ms_iis_application_pool -a "Diamond"
Arguments not allowed see nsclient.log for details





Running the command on the remote agent on the server the powershell script works fine:(NOTE I hardcoded the app pool in a test script version)

PS F:\Monitoring\NSClient++\scripts\powershell> F:\Monitoring\NSClient++\scripts\powershell\check_ms_iis_application_pooltest.ps1
OK: Application Pool "Diamond" with 1 Applications. {CPU: 100 %}{Memory: 5878.01 MB} | 'pool_cpu
'=100%;;;0;100 'pool_memory'=5878.01MB;;;0; 'app_count'=1

This is in servers nsclient log file after a few attempts:

018-10-08 15:12:10: error:c:\source\master\modules\CheckExternalScripts\CheckExternalScripts.cpp:360: Arguments not allowed in CheckExternalScripts set /settings/external scripts/allow arguments=true
2018-10-08 15:12:36: error:c:\source\master\modules\CheckExternalScripts\CheckExternalScripts.cpp:360: Arguments not allowed in CheckExternalScripts set /settings/external scripts/allow arguments=true
2018-10-08 15:14:03: error:c:\source\master\modules\CheckExternalScripts\CheckExternalScripts.cpp:360: Arguments not allowed in CheckExternalScripts set /settings/external scripts/allow arguments=true
2018-10-08 15:16:01: error:c:\source\master\modules\CheckExternalScripts\CheckExternalScripts.cpp:360: Arguments not allowed in CheckExternalScripts set /settings/external scripts/allow arguments=true
2018-10-08 15:16:55: error:c:\source\master\modules\CheckExternalScripts\CheckExternalScripts.cpp:360: Arguments not allowed in CheckExternalScripts set /settings/external scripts/allow arguments=true
2018-10-08 15:28:09: error:c:\source\master\modules\CheckExternalScripts\CheckExternalScripts.cpp:360: Arguments not allowed in CheckExternalScripts set /settings/external scripts/allow arguments=true
2018-10-08 15:36:48: error:c:\source\master\modules\CheckExternalScripts\CheckExternalScripts.cpp:360: Arguments not allowed in CheckExternalScripts set /settings/external scripts/allow arguments=true



Definition of command on xi server:

command image.docx

Here is nsclient.conf:

nsclient.ini

any thoughts as to what I am doing wrong?

Thanks JK

[tgriep]

When running External Scripts using NSClient++, you have to enable the "allow arguments" and the "allow nasty characters" so they can be passed to the external script.
It is a separate setting from the NRPE server settings.
Edit the nsclient.ini file and ad the following to it.

Code: Select all

[/settings/external scripts]
allow arguments = true
allow nasty characters = true

Save the changes and restart NSClient++ on the Windows system.

That will enable it to receive arguments.

[jkelly1959]

Im still doing something wrong....I added your sugguestions to nclient ini restarted and got same error.

I ran nscp test --log trace and got the following:

:\Monitoring\NSClient++>nscp test --log trace
D core NSClient++ 0.5.2.35 2018-01-28 x64 Loading settings and logger...
D core Settings not ready so we cant lookup: base-path
D core Settings not ready so we cant lookup: exe-path
D settings Boot.ini found in: F:\Monitoring\NSClient++/boot.ini
D core Settings not ready so we cant lookup: shared-path
D settings Activating: ini://${shared-path}/nsclient.ini
D settings Creating instance for: ini://${shared-path}/nsclient.ini
D core Settings not ready so we cant lookup: shared-path
D settings Loading: F:\Monitoring\NSClient++/nsclient.ini
D core NSClient++ 0.5.2.35 2018-01-28 x64 booting...
D core Booted settings subsystem...
D core On crash: restart: NSCP
D core Archiving crash dumps in: F:\Monitoring\NSClient++/crash-dumps
D core Found: CheckDisk
D core Found: CheckEventLog
D core Found: CheckExternalScripts
D core Found: CheckHelpers
D core Found: CheckNSCP
D core Found: CheckSystem
D core Found: NRPEServer
D core Found: NSClientServer
D core Found: allow arguments
D core Found: allow nasty characters
D core Loading module F:\Monitoring\NSClient++\modules\CheckDisk.dll ()
D core Loading module F:\Monitoring\NSClient++\modules\CheckEventLog.dll ()
D core Loading module F:\Monitoring\NSClient++\modules\CheckExternalScripts.dll ()
D core Loading module F:\Monitoring\NSClient++\modules\CheckHelpers.dll ()
D core Loading module F:\Monitoring\NSClient++\modules\CheckNSCP.dll ()
D core Loading module F:\Monitoring\NSClient++\modules\CheckSystem.dll ()
D core Loading module F:\Monitoring\NSClient++\modules\NRPEServer.dll ()
D core Loading module F:\Monitoring\NSClient++\modules\NSClientServer.dll ()
E core Failed to find plugin: allow arguments in F:\Monitoring\NSClient++\modules
c:\source\master\service\plugin_manager.cpp:296
E core Failed to find plugin: allow nasty characters in F:\Monitoring\NSClient++\modules
c:\source\master\service\plugin_manager.cpp:296
D core Loading plugin: CheckDisk
D core Loading plugin: CheckEventLog
D core Loading plugin: CheckExternalScripts
D ext-script No aliases found (adding default)
D ext-script Detected a $ARG??$ expression with allowed arguments flag set to false (perhaps this is not the intent)
D core Loading plugin: CheckHelpers
D core Loading plugin: CheckNSCP
D check_nscp Crash folder is: F:\Monitoring\NSClient++/crash-dumps
D core Loading plugin: CheckSystem
D core Loading plugin: NRPEServer
D nrpe Allowed hosts definition: 10.224.4.32(255.255.255.252), 127.0.0.1(255.255.255.255)
D nrpe Server config: address: :5666, ssl enabled: none, no certificate, dh: F:\Monitoring\NSClient++/security/nrpe_dh_512.pem, ciphers: ADH, ca: F:\Monitoring\NSClient++/security/ca.pem, options: ADH
D nrpe Binding to: [::]:5666(ipv6)
D nrpe Attempting to bind to: [::]:5666(ipv6)
D nrpe Binding to: 0.0.0.0:5666(ipv4), reopen: true, reuse: true
D nrpe Attempting to bind to: 0.0.0.0:5666(ipv4)
D core Loading plugin: NSClientServer
D check_nt Allowed hosts definition: 10.224.4.32(255.255.255.252), 127.0.0.1(255.255.255.255)
D check_nt Binding to: [::]:12489(ipv6)
D check_nt Attempting to bind to: [::]:12489(ipv6)
D check_nt Binding to: 0.0.0.0:12489(ipv4), reopen: true, reuse: true
D check_nt Attempting to bind to: 0.0.0.0:12489(ipv4)
T :scheduler starting all threads
T :scheduler Thread pool contains: 2
D core NSClient++ - 0.5.2.35 2018-01-28 Started!
D core Loading module F:\Monitoring\NSClient++\modules\CommandClient.dll ()
D core Loading plugin: CommandClient...
D cli Enter command to execute, help for help or exit to exit...
D w32system Loading counter: disk_queue_length_0 C: = \\PLBUWEBHQPCF002\PhysicalDisk(0 C:)\% Disk Time
D w32system Loading counter: disk_queue_length_1 F: = \\PLBUWEBHQPCF002\PhysicalDisk(1 F:)\% Disk Time
D w32system Loading counter: disk_queue_length__Total = \\PLBUWEBHQPCF002\PhysicalDisk(_Total)\% Disk Time

I attached the updated nsclient.ini .... I added in multiple places and it didnt help.

[jkelly1959]

Note the $ARGS$ error in the trace

[tgriep]

I went through the nsclient.ini file and corrected the settings.
Replace the full content of your nsclient.ini file with the following.

Code: Select all

# If you want to fill this file with all available options run the following command:
#   nscp settings --generate --add-defaults --load-all
# If you want to activate a module and bring in all its options use:
#   nscp settings --activate-module <MODULE NAME> --add-defaults
# For details run: nscp settings --help


; in flight - TODO
[/settings/default]

; Undocumented key
password = 
; Undocumented key
allowed hosts = 10.224.4.32/30, 127.0.0.1

; in flight - TODO
[/settings/NSClient/server]
; PERFORMANCE DATA - Send performance data back to Nagios (set this to 0 to remove all performance data).
performance data = 1

; in flight - TODO
[/settings/NRPE/server]

; VERIFY MODE - Comma separated list of verification flags to set on the SSL socket.
ssl options =

; Verify Mode
verify mode = none

; ALLOW INSECURE CHIPHERS and ENCRYPTION
insecure = true

; COMMAND ARGUMENT PROCESSING
allow arguments = true 

; COMMAND ALLOW NASTY META CHARS
allow nasty characters = true

use ssl = 1

; in flight - TODO
[/modules]

; Undocumented key
CheckExternalScripts = enabled

; Undocumented key
CheckHelpers = enabled

; Undocumented key
CheckEventLog = enabled

; Undocumented key
CheckNSCP = enabled

; Undocumented key
CheckDisk = enabled

; Undocumented key
CheckSystem = enabled

; Undocumented key
NSClientServer = enabled

; Undocumented key
NRPEServer = enabled

[/settings/external scripts]
allow arguments = true 
allow nasty characters = true

[/settings/external scripts/wrappings]

; WRAPPING - An external script wrapping
ps1 = cmd /c echo scripts\\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -


[/settings/external scripts/scripts]

check_ms_iis_application_pool=cmd /c echo scripts/powershell/check_ms_iis_application_pool.ps1 $ARG1$; exit $LastExitCode | powershell.exe /noprofile -command -

Save the file, restart NSClient++.

Run the check from the Nagios Server and it is fails, post the output of the check command and get the nsclient.log file from the Windows server and post it here.
It is in the same folder as the nsclient.ini file.

[jkelly1959]

Thank you,
Inching closer but not quite there.
I try the command from the Nagios Server with and without the FQDN and get same error
The Execution policy on the plbuwebhqpcf002 server is Unrestricted.

[nagios@lnxvnaghq001 libexec]$ ./check_nrpe -H plbuwebhqpcf002 -p 5666 -t 60 -c check_ms_iis_application_pool -a "Diamond"
scripts/powershell/check_ms_iis_application_pool.ps1 : AuthorizationManager
check failed.
At line:1 char:1
+ scripts/powershell/check_ms_iis_application_pool.ps1 Diamond; exit $L ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess


OR

[nagios@lnxvnaghq001 libexec]$ ./check_nrpe -H plbuwebhqpcf002.cinfin.com -p 5666 -t 60 -c check_ms_iis_application_pool -a "Diamond"
scripts/powershell/check_ms_iis_application_pool.ps1 : AuthorizationManager
check failed.
At line:1 char:1
+ scripts/powershell/check_ms_iis_application_pool.ps1 Diamond; exit $L ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess


Is there a permission that needs to be set on the directory on the agent side?
I gave the powershell directory under scripts full control to the EVERYBODY setting.

[tgriep]

Yes, you need to enable the execution of Powershell scripts. I found this link you can use for reference.
https://superuser.com/questions/106360/ ... ll-scripts

[jkelly1959]

FYI, I had the execution policy set to Unrestriced and it wasnt working.
After reading the article you set I set the policy to Bypass. That is getting me data back. Not a format I like but I get a result.
Thank you for your help. I will do more research to see how I can format the data after it gets back.
My initial issue of not executing is fixed...thanks again

JK

[tgriep]

Your welcome. If you do net have any further questions, shall I close and lock up the post?