NSClient Not Working

[mkeey]

Good thoughts, but I've checked that already.

[scottwilkerson]

Can you perform these steps on this server?

To find the version the NSClient++ agent, go to this folder

Code: Select all

C:\Program Files\NSClient++

Right click the nscp.exe file and click on Properties.
Click on the Details tab and it should show the version.

Try and restart the NSClient++ agent on the Windows system to make sure it reloads the nsclient.ini file.

Then, login to the Windows server and go to this folder in a command prompt.

Code: Select all

C:\Program Files\NSClient++>

Then run the following to validate the NSClient++ configuration.

Code: Select all

nscp settings --validate

Any errors, fix them and retest the command from the Nagios server to see if it works.

Code: Select all

./check_nt -H IPADDR01 -p 12489 -v CLIENTVERSION

One more thing, post the command definition for the Disk and Memory checks in Nagios here so we can see the actual command.

[mkeey]

See attached screen print

[scottwilkerson]

Out of curiosity, when you are running this are you actually putting the password from the nsclient.ini in the quotes that follow the -s argument?

Can you compare the nsclient.ini for the systems that are working vs. this server that are not for any discrepancies?

[mkeey]

Ok, Had to reboot the remote host and since this is a production server we had to wait for the scheduled maint window. There is now a log file and it says...

2019-05-27 10:33:55: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host

nscp.exe is running and windows firewall service is disabled.

[tgriep]

It could be that the counters are corrupt that the NSClient++ agent is using and they need to be reset on the Windows system.
To rebuild all Performance counters including extensible and third-party counters, type the following commands at an Administrative command prompt. Press ENTER after each command.

Rebuilding the counters:

Code: Select all

cd c:\windows\system32
lodctr /R
cd c:\windows\sysWOW64
lodctr /R

Resyncing the counters with Windows Management Instrumentation (WMI):

Code: Select all

WINMGMT.EXE /RESYNCPERF

Stop and restart the Performance Logs and Alerts service.
Stop and restart the Windows Management Instrumentation service.

Try that and post if it fixes the issue.

[mkeey]

Issued the sync commands but I can't restart services, especially WMI, without a change record as this is a production server. Had to wait for Saturday night for the server to reboot.

[npolovenko]

@mkeey, Thanks for the update. We'll leave this ticket open for you.

[mkeey]

Now this is showing up in the log...

2019-06-03 09:44:27: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-03 10:36:24: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-04 09:14:12: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-04 09:16:00: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-10 09:45:08: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-10 10:37:17: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-18 12:15:05: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-18 12:16:48: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-19 09:04:00: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-19 09:25:00: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-19 09:42:55: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-24 09:43:13: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host
2019-06-24 10:35:05: error:c:\source\nscp\include\socket/connection.hpp:137: Failed to read data: An existing connection was forcibly closed by the remote host

[lmiltchev]

Can you post the entire nsclient.ini file from the Windows machine? Hide/obfuscate sensitive info.

Also run the following command from the command line on the Nagios XI server, and show the output:

Code: Select all

nmap <client ip> -p 12489,5666