Event Handler - Powershell script not able to import module

[scomdco]

I've created a script the triggers when a host goes into a DOWN state. When it triggers it'll grab the private IP address of the AWS Instance(host), and use that IP to run the command "ipconfig /registerdns" on the instance using winexe. The script is successfully executing and grabbing the arguments from the command line. This issue is described in the second scenario below:

Nagios XI version: 5.6.7
PowerShell Core version = 6.2.3 (installed through yum)
Linux = Linux 3.10.0-862.14.4.el7.x86_64

Scenario 1: When the script is ran through SSH on the nagios server, logged in as root, it executes successfully.

Here's an example of the command that i run through SSH with the arguments manually inputted:

Code: Select all

pwsh /usr/local/nagios/libexec/powershell/RegisterDNS.ps1 "SWSIM-9E20A0" "check_icmp: Failed to resolve SWSIM-9E20A0.prod02.aws.local" "DOWN"

Scenario 2: When the script is executed by the Event Handler, it fails due to the powershell module it needs to import AWS.Tools.EC2 is not able to get imported (It says an associated cmdlet can't be found)

Here's the error message that gets captured from line 18

Code: Select all

The error message was The term 'Get-EC2Tag' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again. for SWSIM-9E20A0

In Nagios, i have the command for the script to run as follows:

Code: Select all

pwsh /usr/local/nagios/libexec/powershell/RegisterDNS.ps1 "$HOSTNAME$" "$HOSTOUTPUT$" "$HOSTSTATE$"

The only difference between these two processes is that the 2nd scenario is the script getting executed by Nagios. I can't figure out why this is not working, please help! i have the script with redacted personal info attached.

RegisteredDNSShared.zip

What user does nagios execute event handler commands as?

I have the permissions set up as such for the script itself,

Code: Select all

-rwxrwxrwx 1 root root 2688 Oct 31 10:47 RegisterDNS.ps1

i have the module getting automatically imported whenever a pwsh session starts, so really the importing of the module within the script shouldn't be necessary but i have it configured as such given the issue i'm having.

/root/.config/powershell/Microsoft.PowerShell_profile.ps1

Code: Select all

$PSModuleAutoloadingPreference = 'All'

Import-Module AWS.Tools.Common,AWS.Tools.EC2

For folks who don't know, AWS released a version of their AWSPowerShell.NetCore that has each service separated into their own modules, hence why you see those specific modules. I first started out using their original module, AWSPowerShell.NetCore, but moved over to this other version due to thinking it it may help but there is no difference of the results.

[mbellerue]

Everything gets executed as either nagios, or apache. The first thing I'm noticing is that there is no path to AWS.Tools.EC2. If you do which AWS.Tools.EC2 as root, and then as the nagios user (use su - nagios to switch to the nagios user, so you get nagios' environment). I imagine that's where the failure is.

[scomdco]

Thank you for the insight! Your theory looks to be true.

2ndpost.png

I've tried a couple things so far without success which i'll share, but granted i know this is more something on the linux level i'll need to figure out. rather than an issue with Nagios.

i installed the AWS.Tools.EC2 module through the nagios user and tried again, no success so i uninstalled it so i don't have two separate copies.
In the script, i added the direct path to the module for the import-module cmdlet, no success
Maybe it's using the apache user in which i'll give that a shot and inform of the results.

[mbellerue]

Excellent, we'd be glad to hear about your adventures with Powershell in Linux. I have a feeling this is only going to get more and more popular as time goes on.

When you installed the AWS.Tools.EC2 module through the nagios user, did you end up with the modules in ~/.local/share/powershell/Modules? That seems like a really strange way to install shared modules.

What if you copied those Powershell modules to like /tmp/powershell/Modules, made the whole thing world readable, and then in your script's import-module, use the full path to the module. I'm not entirely sure the import-module cmdlet allows for that. But maybe it gets you what you need?

[scomdco]

Thanks to your insight i was able to get the modules to successfully import in the script when executed from Nagios!

If possible, it'd like to make a feature request for the Bulk Modification Tool to be able to Modify the Event Handler field. i do see that it has the ability to enable or disable the event handler which i took advantage of at least. I'm thinking in Nagios XI's current state (5.6.7) utilizing the global event handler feature will be my only option to implement this for all my already configured host (900+). Is it possible to associate the script in the event handler field for hosts using the API? I have all the host i'd want it to be associated with in a single hostgroup if it's possible from that level.

I created a path and placed the module folders with all their content in them as shown below:

Code: Select all

Import-Module -Name /home/nagios/powershell/Modules/AWS.Tools.Common/3.3.604.0/AWS.Tools.Common.psd1
Import-Module -Name /home/nagios/powershell/Modules/AWS.Tools.EC2/3.3.604.0/AWS.Tools.EC2.psd1

In regards to the directory the modules ended up in, i confirmed with some powershell enthusiasts that the location is indeed to default location that powershell installs modules. I tried to still see if i could get the script to execute successfully in the default location, and even with nagios user in the root group, it would not work. It seems as though the "hidden" folders are just not visible by the Nagios user for some reason when executed by Nagios. When executed through SSH the script worked fine without any of these modifications needed.

If you may have any insight into why this may be the case it'd be great to hear!

Here's the location where their installed by default for each user and what i mean by the hidden file it's contained in:

Root: /root/.local/share/powershell/Modules

root.png

Nagios: /home/nagios/.local/share/powershell/Modules

nagios.png

[ssax]

I've submitted the feature request on your behalf with a link back to this thread:

Code: Select all

FR: XI - Bulk Modifications Tool - Add ability to change Event Handler

Please keep in mind that the decision to implement the enhancement is at the discretion of our development team.

You can use the API for this, see here on your system and just add &event_handler=WHATEVERYOUWANT to the URL:

http://YOURXISERVER/nagiosxi/help/api-c ... it-service

This could certainly be related to remote UAC:

Code: Select all

https://support.microsoft.com/en-us/help/951016/description-of-user-account-control-and-remote-restrictions-in-windows

Let me know if you have any questions or if I can clarify anything.

[scomdco]

Hey ssax, thanks for submitting the feature request, and for the details on how to utilize the API for this! To note am successfully utilizing the Global Event Handler currently to execute the script and resolve the issue, but i'll be switching this now with the info you gave.

in regards to remote UAC potentially being the root cause for the modules not being read by Nagios when in a hidden folder, i'd like to clarify that the screenshots of the folders i provided are from a WinSCP session into my linux Nagios XI server, given that information would you still suspect that UAC may be related to the issue? If so please elaborate.

[ssax]

Sorry, I thought you were running the powershell stuff against a windows host which may have additional restrictions with remote UAC.

[scomdco]

No problem! i appreciate your response regardless.

For sanity sake, would you be able to replicate this same issue within a nagios server in-house? i'm trying to figure out the root-cause of why a script executed through event handler, or global event handler can't see content within a hidden folder, when that same script could be executed through an SSH session using the Nagios or root user.

[mbellerue]

Alright, I think I confirmed this properly. Let me lay out what I've done to make sure that we're on the same page.

I've created a Powershell file (testnaga.ps1) to import, it is a class that just creates a file in /tmp. I've put this file in /mnt/.mypsmods/, so hidden directory.
I then created a test Powershell script (test_import.ps1) that imports testnaga.ps1, instantiates the class, and then the file is created in /tmp.
I tested it as root and nagios at the command line.
I then created a misc command in CCM that calls the test_import.ps1 script, pwsh $USER1$/test_import.ps1
I then make one of my existing services use that command as an event handler command (I also turned on Event handler at the service, just to be sure it would run)
I then make the service go critical

And then I got the file in /tmp.