Nagios XI Unicode Character issue

[emartine]

I was asked to investigate an issue where two servers where up and were showing up as down in nagios.
icmp commands were the same as on other servers and finally after breaking my head open I copied the command in vi to compare them and sure enough I saw the half-width space Unicode Characters where although it was invisible at the command line and in the web interface it was clearly visible in vi in blue.

/usr/local/nagios/libexec/check_icmp -H <200b><IPADDRESS> -w 3000.0,80% -c 5000.0,100% -p 5

I have been unable to find out who made the changes to the hosts since they had been up for quite some time before the issue occurred 7-8 days ago. The only items I found in the logs that were relevent and correlated to the down time frames were these:


2019-01-17 16:50:01 150206 Core Config Manager MODIFY system localhost File imported - File \[overwrite flag\]: /usr/local/nagios/etc/import/SERVERNAME.cfg \[1\]
2019-01-18 10:12:57 150344 Core Config Manager MODIFY system localhost File imported - File \[overwrite flag\]: /usr/local/nagios/etc/import/SERVERNAME-2.cfg \[1\]


Prior to this there were users making modifications to another server such as acknowledgements and supression of alerts and I was initiating a writeConfig in the CCM on another server but not to these two systems. So I am scratching my head here. I've asked and no one has imported the any config files.

Any idea what might have happened?

[benjaminsmith]

Hello @emartine,

Do you have any files in the import directory?

Code: Select all

ls -l /usr/local/nagios/etc/import

Thanks.

[emartine]

ls -l /usr/local/nagios/etc/import
total 0

[benjaminsmith]

Hi @emartine,

After discussing this with the other techs, we've seen this happen here when cutting in pasting from certain applications (e.g. osTicket) and someone may have cut and pasted the IP address from another application that added the zero-width space character.

[emartine]

That is what I am assuming happened. But who did it is the question.

[cdienger]

The fact that it logged the user as "system" in the audit logs means it wasn't done through the web interface. A review of command line users' history file may shed some light on this.