Monitor Memory Useage on a single service

[smetzler]

Hello,

I was wondering if anyone has been able to monitor the memory usage of a single service. For instance, if I wanted to monitor the memory usage of the NSClient Service on a Windows Server and display a warning at 1GB of RAM used and a critical warning at 4GB. I have researched and understand the NSClient ++ software has the capability and since Nagios already monitors the services/hard drive useage/etc. I figured Nagios would easily be able to monitor the memory usage. I have tried several different ways to write the script in SSH to test before implementing in the GUI with negative results. Any input would greatly be appreciated.

Thank you,

Shane Metzler

[lmiltchev]

One way this could be done is by using a custom powershell script. I am NOT a powershell expert... not even close.

Here's one really basic script that can at least point you to the right direction. You can place it in the NSClient++ scripts directory.

process_mem.ps1

Code: Select all

param([int] $warn, [int] $crit)

$Output1 = ""
$LastExitCode = 0
$output = ""
$myprocess = Get-Process nscp | Measure-Object WS -Sum
$myprocess = ("{0:N2} " -f ($myprocess.sum / 1KB))
$myprocess = [math]::Round($myprocess)

if ($myprocess -gt $crit)      {            
            echo "CRITICAL: NSClient++ Memory Usage was $myprocess KB"
            $LastExitCode = 2
        }
    elseif ($myprocess -gt $warn)
        {
            echo "WARNING: NSClient++ Memory Usage was $myprocess KB"
            $LastExitCode = 1
        }
    else
        {
            echo "OK: NSClient++ Memory Usage was $myprocess KB"
            $LastExitCode = 0
        }

exit  $LastExitCode

Then, add a command to nsclient.ini file:

Code: Select all

check_process_memory = cmd /c echo scripts\process_mem.ps1 "$ARG1$" "$ARG2$"; exit $LastExitCode | powershell.exe -command -

and restart NSClient++ service.

Tested it from the Nagios XI server by running the following command from the CLI:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H <client ip> -c check_process_memory -a <warning> <critical>

where you substitute <warning> and <critical> with actual threshold values.

Hope this helps.

[snapier]

If you are using NSClient++ then the easiest way is to query the data via the REST API.
https://docs.nsclient.org/api/rest/queries/

NSClient++ includes a helper just for doing this via Nagios.

Code: Select all

GET /api/v1/queries/:query/commands/execute_nagios

You can create your own script in perl, php to query NSCP API via curl. Create the associated XI command to query NSCP API using your script and pass your thresholds via the custom attributes.

[lmiltchev]

@smetzler Let us know if you have any further questions.

[smetzler]

@lmiltchev

I have the code working on the client's side however on the Nagios side, when I type
./check_nrpe -H xxx.xxx.xxx.xxx -c check_process_memory -a <20> <40> I receive the following error:
-bash: syntax error near unexpected token '20'

If I remove the -a and try:
./check_nrpe -H xxx.xxx.xxx.xxx -c check_process_memory I receive the following error:
Unknown command(s): check_process_memory

Do you have any ideas?

Thank you,

Shane

[lmiltchev]

What is the output when you run this?

Code: Select all

./check_nrpe -H xxx.xxx.xxx.xxx -c check_process_memory -a 20 40

If this is still failing, upload the entire nsclient.ini file on the forum, so that we can review it.

[smetzler]

@lmiltchev,

When I run the code as you wrote I receive:
Exception processing request: Request contained arguments (not currently allowed, check the allow arguments option).
NSClient:
# If you want to fill this file with all available options run the following command:
# nscp settings --generate --add-defaults --load-all
# If you want to activate a module and bring in all its options use:
# nscp settings --activate-module <MODULE NAME> --add-defaults
# For details run: nscp settings --help


; in flight - TODO
[/settings/default]

; Undocumented key
password = xxxxxxxxxxxxxxxx

; Undocumented key
allowed hosts = XXX.XXX.XXX.XXX, XXX.XXX.XXX.XXX


; in flight - TODO
[/settings/NRPE/server]

; Undocumented key
ssl options = no-sslv2,no-sslv3

; Undocumented key
verify mode = none

; Undocumented key
insecure = true


; in flight - TODO
[/modules]

; Undocumented key
CheckExternalScripts = enabled

; Undocumented key
CheckHelpers = enabled

; Undocumented key
CheckEventLog = enabled

; Undocumented key
CheckNSCP = enabled

; Undocumented key
CheckDisk = enabled

; Undocumented key
CheckSystem = enabled

; Undocumented key
NSClientServer = enabled

; Undocumented key
NRPEServer = enabled

check_process_memory = cmd /c echo scripts\memory_test.ps1 "$ARG1$" "$ARG2$"; exit $LastExitCode | powershell.exe - command -

memory_test.ps1:

Code: Select all

param([int] $warn, [int] $crit)
cls
$Output1 = ""
$LastExitCode = 0
$output = ""
[int]$size = Get-WmiObject Win32_PerfFormattedData_PerfProc_Process -Filter "Name='explorer'" | Select-Object -Expand WorkingSetPrivate;
$size = $size
if ($size -ge $crit)      {            
            echo "CRITICAL: NSClient++ Memory Usage was $sizeint MB"
            $LastExitCode = 2
        }
    elseif ($size -ge $warn)
        {
            echo "WARNING: NSClient++ Memory Usage was $sizeint MB"
            $LastExitCode = 1
        }
    else
        {
            echo "OK: NSClient++ Memory Usage was $sizeint MB"
            $LastExitCode = 0
        }

exit  $LastExitCode

Thank you,

Shane

[lmiltchev]

When I run the code as you wrote I receive:
Exception processing request: Request contained arguments (not currently allowed, check the allow arguments option).

Add the following two lines under both sections - [/settings/NRPE/server] and [/settings/external scripts]:

Code: Select all

allow nasty characters = 1
allow arguments = 1

Save, exit, and restart NSClient++ service. Test your check again. Did it work now?

[smetzler]

@lmiltchev,

I added the code and got the same result. The modified code is:

# If you want to fill this file with all available options run the following command:
# nscp settings --generate --add-defaults --load-all
# If you want to activate a module and bring in all its options use:
# nscp settings --activate-module <MODULE NAME> --add-defaults
# For details run: nscp settings --help


; in flight - TODO
[/settings/default]

; Undocumented key
password = xxxxxxxxxxxx
; Undocumented key
allowed hosts = xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx
; in flight - TODO
[/settings/NRPE/server]
allow nasty characters = 1
allow arguments = 1

; Undocumented key
ssl options = no-sslv2,no-sslv3

; Undocumented key
verify mode = none

; Undocumented key
insecure = true


; in flight - TODO
[/modules]

; Undocumented key
CheckExternalScripts = enabled

; Undocumented key
CheckHelpers = enabled

; Undocumented key
CheckEventLog = enabled

; Undocumented key
CheckNSCP = enabled

; Undocumented key
CheckDisk = enabled

; Undocumented key
CheckSystem = enabled

; Undocumented key
NSClientServer = enabled

; Undocumented key
NRPEServer = enabled

check_process_memory = cmd /c echo scripts\memory_test.ps1 "$ARG1$" "$ARG2$"; exit $LastExitCode | powershell.exe - command -

[/settings/external scripts]
allow nasty characters = 1
allow arguments = 1

[lmiltchev]

I am not sure why you have "explorer" in the filter, but "nsclient++" in the output... Maybe, you need to modify your script as such:

Code: Select all

param([int] $warn, [int] $crit)
cls
$LastExitCode = 0
[int]$size = Get-WmiObject Win32_PerfFormattedData_PerfProc_Process -Filter "Name='nscp'" | Select-Object -Expand WorkingSetPrivate;

if ($size -ge $crit)      {           
            echo "CRITICAL: NSClient++ Memory Usage was $size bytes"
            $LastExitCode = 2
        }
    elseif ($size -ge $warn)
        {
            echo "WARNING: NSClient++ Memory Usage was $size bytes"
            $LastExitCode = 1
        }
    else
        {
            echo "OK: NSClient++ Memory Usage was $size bytes"
            $LastExitCode = 0
        }

exit  $LastExitCode

This is not the entire nsclient.ini file, is it? If it is, run the following command (you will find it at the top of the nsclient.ini file) from the CMD prompt as administrator:

Code: Select all

nscp settings --generate --add-defaults --load-all

This will generate all of the default entries in the nsclient.ini file. You may see a few errors/warnings in the CLI (when you run the command) - don't worry about those. Upload the entire nsclient.ini file on the forum. Remove sensitive info from the file, e.g. IPs, passwords, etc.

Also, run the following command from the CLI on the Nagios XI server, and show the output:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H <client ip> -c check_process_memory -a 20 40