Services on Windows host

[bomahony]

I am back again with another issue!
TBH I have not really worked with Windows in a good fifteen years, concentrating more on Unix/Linux and Mainframes. Hence I have no damn clue how to approach these.
I have a handful of windows machines in my environment due to stupid software requiring them. Unfortunately I cant take them out the back and shoot them. I have enabled the checks via NSClient++ and enabled the default checks. Nothing else really, as they are just basic windows machines. I am getting different errors across the machines, like below:

1. Service Control Manager, The WinHTTP Web Proxy Auto-Discovery Service service depends on the DHCP Client service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabl
2. Microsoft-Windows-DistributedCOM, DCOM got error "1068" attempting to start the service netprofm with arguments "Unavailable" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}, Service Control Manager, The Network List Service service dep

And so forth. Anychance someone could give me a pointer on how to resolve or ignore this?

[lmiltchev]

How are these checks configured? Are you using check_nt or check_nrpe with NSClient++? Can you show us the actual check run from the command line, along with the output of it?

[bomahony]

It is check_nrpe I believe.

I am not actually sure how to run it from the cli, but ill have a look on the nsclient++ webpage when i get time this afternoon. Hopefully.

[lmiltchev]

Go to the CCM > Services, click on your service, click on the "Run Check Command" button under the "Common Settings" tab, then click on "Run Check Command, and show us the command and the output of it.

[bomahony]

Microsoft-Windows-DistributedCOM, DCOM got error "1068" attempting to start the service netprofm with arguments "Unavailable" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}, Service Control Manager, The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start., Service Control Manager, The Network Location Awareness service depends on the DHCP Client service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it., Microsoft-Windows-DistributedCOM, DCOM got error "1068" attempting to start the service netprofm with arguments "Unavailable" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}, Service Control Manager, The Network List Service service depends on the Network Location Awareness service which failed to start because of the foll

Bah seems to be looking for DHCP service which is disabled. Is it possible to exclude these from the eventviewer check ?

[lmiltchev]

What is the actual command that you are running? You showed us only the output but not the command itself.

[bomahony]

Ah sorry mate:
usr/local/nagios/libexec/check_nrpe -H win-001 -c checkeventlog

Have to jump through numerous hoops to get at the windows machine, so grabbed the cfg:

Code: Select all

[/settings/NRPE/server]
verify mode = none
insecure = true
port=5666

[/modules]
CheckExternalScripts = disabled
CheckHelpers = disabled
CheckEventLog = enabled
CheckNSCP = disabled
CheckDisk = enabled
CheckSystem = enabled

NRPEServer = enabled

[lmiltchev]

Since you are using NSClient++ with checkeventlog, I would recommend reviewing the official NSClient++ documentation here:

https://docs.nsclient.org/0.5.0/referen ... ntLog.html

Depending on the agent's version, you may have a different options and filters. You could probably use something like this:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H x.x.x.x -c checkeventlog -a file=System "filter=message not like 'string1' AND message not like 'string2' AND message not like 'string3'"

where you substitute "string1/2/3" with something that makes sense, based on the output that you need to get rid of.

Note: NSClient++ is not developed or maintained by us (Nagios). We would recommend that (for faster resolution) you also ask your questions on the NSClient++ support forum and get help from the agen't developer.

[bomahony]

Nice one mate. I have been swamped with load testing and troubleshooting so havent had a chance to even view this forum post

Ill have a stab off the below later today and get back to you. Provided I dont get hit over the head with another issue.

[lmiltchev]

Sure. Let us know if you have any further questions. We will keep the topic open for the time being.