Nagios checks failing with error restricted path in error

[mohan23]

Hi,

We have mod gearman integrated with nagios and we are trying to monitoring vms that are in azure and we are seeing below error.

"ERROR: restricted path in effect, but command contains forbidden charater"

We have below entries in our worker.conf file

restrict_path=/usr/local/nagios/libexec

also plugin path is same on nagios and mod gearman worker node

Can some one suggest what can be done to fix this?

[scottwilkerson]

From the mod_gearman documentation

restrict_path

‘restrict_path` allows you to restrict this worker to only execute plugins from these particular folders. Can be used multiple times to specify more than one folder. Note that when this restriction is active, no shell will be spawned and no shell characters ($&();<>`"’|) are allowed in the command line itself.

Code: Select all

restrict_path=/usr/local/plugins/

https://labs.consol.de/nagios/mod-gearman/index.html

Based on the above, combined with the error you are getting, I would suspect your command contains one of the following which is throwing the error

Code: Select all

$&();<>`"’|

[mohan23]

I have disable restrict path in worker.conf and I still see the same error

I ran gearmand -V and I see version as 0.33

[scottwilkerson]

Did you restart all the worker services (including the one on the local nagios server) after changing the restrict path on all of the configs?

[mohan23]

Yes I did, that restrict path error has gone. But I'm seeing another receive header error. Below is the complete error.

CHECK_NRPE: Receive header underflow - only -1 bytes received (4 expexted). I see below errors in gearmand.log( see logs in attached screenshot)

[scottwilkerson]

The errors in the screenshot don't appear to be related to a NRPE error.

Are you sure all of your serves have all of the workers IP addresses in their nrpe.cfg as allowed hosts?

[mohan23]

Those errors are from gearmand.log not from nrpe

[scottwilkerson]

Those errors are from gearmand.log not from nrpe

You got this in the gearmand.log?

Code: Select all

CHECK_NRPE: Receive header underflow - only -1 bytes received (4 expexted)

[mohan23]

I see these in web console

[scottwilkerson]

Which leads back to my question

Are you sure all of your servers have all of the workers IP addresses in their nrpe.cfg as allowed hosts?