check_files plugin in Nagios XI

[RIDS_I2MP]

Hi Team,

I want to monitor a log file/text file on a Windows server and if that particular file is not updated in last 15 minutes, Nagios should send alert.
We are using NSCP-0.5.2.35-x64 version of Nagios Xi.
I referred to File modified (NSClient++ via check_nrpe) section from below:

https://support.nagios.com/kb/article.p ... e_modified

The plugin that I am using is :
check_files.vbs - external script to be used with nsclient

Below steps I performed:

1. I am attaching the nsclient config file here, please let me know what all changes needs to be done there. I have made below changes after referring to different articles:

[/settings/external scripts/wrappings]
ps1 = cmd /c echo scripts\\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -
vbs=cscript.exe //T:30 //NoLogo %SCRIPT% %ARGS%

[/settings/external scripts/wrapped scripts]
missing = missing.ps1
ok = check_test.ps1
check_files = scripts\check_files.exe -l 'F:\\Nagios_logs_testing' pattern=*.* 'filter= written < -10n' 'crit= count > 0' 'empty-state=ok' 'empty-syntax=${status}: No files found' 'top-syntax=${status}: ${count} files found'

[/settings/external scripts/scripts]
restart_service = scripts\restart_service.bat "$ARG1$"
check_files=scripts\check_files.vbs

2. The check_files plugin is already there in C:\Program Files\NSClient++\scripts path on target server.
3. I downloaded the same plugin on Nagios server as well.

After implementing it in GUI, I am getting below error:

Failed to execute check_files seems more like a script maybe you need a script executable first: failed to lookup error code: 193 (reason: 126)

I am attaching the config file, the service definition and command definition screenshot from Nagios.

Please let me know what additional changes I need to do in config file , in command definition, in service definition.

Thanks in advance!!

[tgriep]

The check_files command is a command that is built in to nsclient so I would change the command name.
Lets call it check_files1


Edit the nsclient.ini file and in this section

Code: Select all

[/settings/default]

Delete this

Code: Select all

check_files

Under this section

Code: Select all

[/settings/external scripts/wrapped scripts]

Change this from

Code: Select all

check_files = scripts\check_files.exe -l 'F:\\Nagios_logs_testing' pattern=*.* 'filter= written < -10n' 'crit= count > 0' 'empty-state=ok' 'empty-syntax=${status}: No files found' 'top-syntax=${status}: ${count} files found'

to

Code: Select all

check_files1 = scripts\check_files.vbs -l 'F:\\Nagios_logs_testing' pattern=*.* 'filter= written < -10n' 'crit= count > 0' 'empty-state=ok' 'empty-syntax=${status}: No files found' 'top-syntax=${status}: ${count} files found'

You also had .exe for the script name, should be .vbs for the command.

Under this section

Code: Select all

[/settings/external scripts/scripts]

Change this from

Code: Select all

check_files=scripts\check_files.vbs

to

Code: Select all

check_files1=scripts\check_files.vbs

Under this section

Code: Select all

[/settings/external scripts/wrappings]

remove this line.

Code: Select all

vbs=cscript.exe //T:30 //NoLogo %SCRIPT% %ARGS%

Save the change and restart NSClient++ and change the command in XI to check_files1 for $ARG1$ and see if it works in the XI GUI.

[RIDS_I2MP]

Hi,

I have made all the changes as per your suggestion and restarted the nsclient++ service.
I made the changes to command as well, still getting the same error as below:

"Failed to execute check_files1 seems more like a script maybe you need a script executable first: failed to lookup error code: 193 (reason: 126)"

It seems it is looking for the executable file, as the plugin is available in .vbs format, means its a script.

I am again attaching here all the details to make sure we miss nothing.
I want it to get worked at the earliest.

Thanks again for your help!!

[tgriep]

Lets just use the built in check_files command to see if you can get it to work.
Run this and post the output here. Replace xxx.xxx.xxx.xxx with the IP address of the EU2NAPW446 host.

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H xxx.xxx.xxx.xxx -c check_file -a path='F:\\Nagios_logs_testing' pattern=*.* 'filter= written < -10n' 'crit= count > 0' 'empty-state=ok' 'empty-syntax=${status}: No files found' 'top-syntax=${status}: ${count} files found'

If it works, just use that command instead of the vbs script.
The command line options you have defined in the nsclient.ini file for thwe VBS script, do not match what you have defined so the whole command needs to be changed

When I run the check_files.vbs script, these are the arguments it needs.

check_files.vbs /path:<value> [/namefilter:<value>] [/age:<value>] [/selage:<value>] [/searchdepth:<value>] [/seldat:<value>] [/size:<value>] [/warning:<value>] [/critical:<value>] [/expectmatch:<value>] [/weekdays:<value>] [/alias:<value>]

/path Path

[/namefilter] Filename Filter
[/age] Age
[/selage] newer, older, hour, ignore
[/searchdepth] depth of subdirs to search
[/seldat] modified or created
[/size] size
[/warning] warning threshold
[/critical] critical threshold
[/expectmatch] expect at least x matches
[/weekdays] 1,2,3,... 1-Sun 2-Mon 3-Tue...
[/alias] Alias

You will have to edit the vbs command in the nsclient.ini file to match the above options.


Also, remove this line from the nsclient.ini file. It is not needed.
check_files1=scripts\check_files.vbs

[RIDS_I2MP]

Hi,

Thank you for your help!!

I have made the modifications as per your suggestion and it is working fine when I tested it on a test server.
Now, we actually wanted to monitor a file which gets updated every minute as a job runs continuously and keeps updating it. I made all the modifications as I did on test server but it is not working fine here.

We want Nagios to monitor it and send crtical alert if the file is not updated in last 15 mins (which clearly means job is not running from last 15 mins).

File path: C:\\AA_Bot_Logs\\WLM_Heartbeat ----file is under this WLM_Heartbeat folder


But Nagios is sending critical alert every now and then, it is randomly sending recovery alert as well.

I am unable to understand why is it behaving like that.
Can we please connect on call and you can check in screen sharing session, please let me know.

I am attaching here the nsclient.cfg file and service definition screenshot for your reference.

[tgriep]

There looks like there is a typo in the command.
Change this from

Code: Select all

-15n

to

Code: Select all

-15m

Save the change and test the command from the XI GUI.

[RIDS_I2MP]

Hi Team,

Thanks for your help again!!

Yes it is working fine now. Below is the correct command:

/usr/local/nagios/libexec/check_nrpe -H 10.147.209.40 -c check_files -a path='F:\\Nagios_logs_testing' pattern=*.* 'filter= written < -15M' 'crit= count > 0' 'empty-state=critical' 'empty-syntax=${status}: Files updated' 'top-syntax=${status}: ${count} Files not updated'

Now just one last query, when Nagios finds the older files, it should send critical alert and when the files are updated it should send OK alert.

Above command is giving correct output but, in Nagios GUI, it is showing status as Critical and even if the output is OK.
In other words, its always showing status as critical but in message description it shows proper data.

I am attachng screenshot here for your reference.

I have already tried modifying the above command as below:

/usr/local/nagios/libexec/check_nrpe -H 10.147.209.40 -c check_files -a path='F:\\Nagios_logs_testing' pattern=*.* 'filter= written < -15M' 'crit= count > 0' 'empty-state=${status}' 'empty-syntax=${status}: Files updated' 'top-syntax=${status}: ${count} Files not updated'

where i have changed "empty-state=critical" to "empty-state=${status}"

Still it shows always critical status in GUI wiith OK output.

Please suggest.

[tgriep]

Try changing the crit count to be greater than 1 because I think the test is doing anything 0 or greater and not just greater than.

Code: Select all

crit = count > 1

[RIDS_I2MP]

Hi,

Thanks!!
It is working fine now.

[scottwilkerson]

Hi,

Thanks!!
It is working fine now.

great!

Locking thread