Could not parse JSON

[mkeey]

We used the Nagios XI Server wizard to defined hosts and services for our XI instances. Seems to be working well except we frequently receive the following alerts via email. Frequently they say "Could not parse JSON from..." What is this and how can we stop the problem?


Affected CI=NAGIOSXI
Assignment Group=MYTEAMNAME
Category=Network
Subcategory=Circuit
Impact=3
Urgency=3
Description=Service: Nagios XI Daemons
Host: NAGIOSXI
Address: 000.00.0.000
State: CRITICAL
Info:
Error: Could not parse JSON from http://nagiosxi/nagiosuser/ (false)
Date/Time: 2019-07-17 02:39:38

Respond: http://naigosixserver/nagiosxiuser/rr.p ... d469c43178
Nagios URL: http://nagiosxiserver/nagiosxiuser/

Nagios has detected a problem with this service.
Notification Type: PROBLEM

Doc URL: http://nagiosxiserverdocumentation/nagiosxiserver.docx

[ssax]

Please PM me one of the full original messages.

Additionally, please Please send me a copy of your profile, you can download it from Admin > System Profile > Download Profile.

If you're unable to generate the the profile through the web interface, please try generating it from the command line by running these commands as root:

Code: Select all

rm -rf /usr/local/nagiosxi/var/components/profile*​​
/usr/local/nagiosxi/html/includes/components/profile/getprofile.sh SUPPORT

Then send me the resulting /usr/local/nagiosxi/var/components/profile.zip​ file.​

If the profile script fails, please include the ENTIRE output.

Additionally, please send the output of these commands (as root):
- NOTE: You may need to adjust the -h 127.0.0.1, the -uroot, and -pnagiosxi in the first command if your DB is offloaded to another server and/or you've changed the root mysql password

Code: Select all

echo "SELECT table_name AS 'Table', round(((data_length + index_length) / 1024 / 1024), 2) 'Size in MB' FROM information_schema.TABLES WHERE table_schema IN ('nagios', 'nagiosql', 'nagiosxi');" | mysql -h 127.0.0.1 -uroot -pnagiosxi --table

Then run this command:

Code: Select all

grep mysql /usr/local/nagiosxi/html/config.inc.php | wc -l

If it outputs the number 2, run the command below as well and include the output, if it outputs anything other than 2 - don't run the command. (some XI systems use both mysql and postgresql if they were install prior to XI 5.0 and then upgraded from there).

Code: Select all

echo "SELECT relname as Table, pg_size_pretty(pg_total_relation_size(relid)) As Size, pg_size_pretty(pg_total_relation_size(relid) - pg_relation_size(relid)) as ExternalSize FROM pg_catalog.pg_statio_user_tables ORDER BY pg_total_relation_size(relid) DESC;" | psql nagiosxi nagiosxi

Thank you

[mkeey]

PM Sent with requested information - MKeey

[ssax]

Replying by PM

[mkeey]

Sent new info via PM - MKeey

[ssax]

None of the data provided really shows an issue that I can pinpoint (not enough logs, I don't see any apache API requests being logged, which is how they are checked so you'll need to see if you have any other logs in the /var/log/httpd directory after it archived them off.

What do you see in the apache logs on the remote system being checked? Any errors around those times in these files?

Code: Select all

/var/log/httpd/error_log
/var/log/httpd/ssl_error_log

So we'll either see the connections in the apache logs with an error or we'll just see the connections, please take a look around the times you received them to see if the remote system had some PHP errors or any other kind of warning/error in the apache logs.

Additionally, it could theoretically occur in older versions of XI if they are applying configuration while the check is trying to run.

What versions of XI are reporting this?

[ssax]

Additionally, (please see previous post), check /var/log/messages on those machines and check the output of this command:
- Change the 16 to the day of the month that you experienced this last

Code: Select all

sar -A -f /var/log/sa/sa16

[mkeey]

I ran the command you recommended but I wasn't really sure what server to run the command on.
We received this today...

2019-07-22 08:20:27 SERVICE ALERT: HOSTNAME;Load;CRITICAL;SOFT;1;Error: Could not parse JSON from http://HOSTNAME/nagiosxi (false

So I logged onto HOSTNAME and performed the command. See attached TXT file for output. I have no idea what I'm looking for in that.

Secondly I can look at the messages file but you weren't very specific on what to look for.

[ssax]

Are the services ever going CRITICAL HARD? If someone applies configuration on that system the JSON would not be available and could certainly cause that, the SOFT states are there to help with false positives.

That info looks fine, if you are unsure of what to look for in /var/log/messages you will need to provide them to us for investigation (from HOSTNAME) as there are too many things to list, it could be any number of issues.

But generally, yes, HOSTNAME is the one that you'd want to check the logs on and run the commands on as it's having trouble parsing the JSON response from that server, we need to find out what it's outputting (or not) at that time.

[mkeey]

Sorry for the excessive delay. A lot going on here at work lately. Sent you 2 PM's containing the information you requested.