Plugin: check_yum giving "NRPE: Unable to read output"

[bumbo]

Hello Nagios Support -

I'm having problems getting the check_yum plugin working for one of my remote servers (centos 7.5).I'm using the check_yum plugin located here: https://github.com/HariSekhon/nagios-pl ... eck_yum.py

The webgui is giving me a status of NPRE: Unable to read output

1.Host system: s-nagios
2.Remote system: s-ftp
user nrpe and nagios don't have login ability on s-ftp

I have other checks running successfully like CPU_Load, Check_dsk on s-ftp.

Whats working:
I can successfully run the ./check_yum locally on s-ftp and it gives me an output of "YUM OK: 0 security updates available and 196 non-security updates available. So i know i have installed the plugin correctly.

All of my plugins are located at :/usr/lib64/nagios/plugins on s-ftp. The owner of all the plugins are root:root and check_yum has -rxwr-xr-x as permission.

My npre.cfg is located /etc/nagios/npre.cfg

I have also edited my /etc/sudoers file to include the following:
Defaults:nrpe !requiretty
nrpe ALL=NOPASSWD: /usr/lib64/nagios/plugins/check_yum
nagios ALL=NOPASSWD: /usr/lib64/nagios/plugins/check_yum

I have edited the npre.cfg on s-ftp to include the command:
command[check_yum]=/usr/bin/sudo /usr/lib64/nagios/plugins/check_yum

I don't have the "check_nrpe" on my s-ftp server but i do have it on my s-nagios host so when i run command
[root@s-nagios] /usr/lib64/nagios/plugins/check_nrpe -H -192.175.92.333 -t 30 -c check_yum it get
NRPE: unable to read output

I have read some forums that you have to modify selinux but I'm not sure how to do this. I believe it mentions it here: http://codeforthesoul.blogspot.com/2012 ... ckyum.html

Thank you for looking and offering any assistance!

[npolovenko]

Hello, @bumbo. Please check whether SELinux is enabled on the NRPE server by running sestatus or getenforce.

If its enabled you can run the following commands to disable:

setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

[bumbo]

when you mean NRPE server do you mean s-ftp? if so i setenforce 0 and now current mode is permissive on s-ftp. I then logged into s-nagios and issued the command "/usr/lib64/nagios/plugins/check_nrpe -H -IPname -t 30 -c check_yum" and got YUM OK with 0 security updates and 196 non security updates! it looks like it did the trick.

but

when i check the status information for that particular service I get CHECK_NRPE STATE CRITICAL: socket timeout after 10 seconds.

It looks like the commandline can pull the status but the webgui can't.

btw - i don't want to turn off selinux completely..just create a hole for this particular service.

[npolovenko]

@bumbo

when you mean NRPE server do you mean s-ftp

Yes

It looks like the commandline can pull the status but the webgui can't.

Interesting. Can you show me the service check definition and the command from the Nagios server?

btw - i don't want to turn off selinux completely..just create a hole for this particular service.

We don't support SElinux with our software. I suggest that we get it to work with disabled SElinux first, and then you can implement exclusion rules for the service.