NCPA plugin execution gets Timeout error

[corkyman]

I have a batch file plugin that spawns off another batch file and immediately ends. It works fine in the command window but when executed as a Nagios plugin the execution is hung for 60 sec and then ends with
{
"returncode": 1,
"stdout": "Error: Plugin command timed out. (60 sec)"
}

The test1.bat and test2.bat files are attached (rename extension to .bat). I executed the plugin on the local server where NCPA is installed like this:
https://localhost:5693/api/plugins/test ... wspwebfarm

Please advise.

[jdunitz]

This is happening because NCPA executes plugin batch files with the default working directory of C:\Windows\system32


So, you'll need to have your batch file explicitly cd to the plugins directory before calling your other batch file:

Code: Select all

@echo off
cd "\Program Files (x86)\Nagios\NCPA\plugins"
start test1.bat

Now it should do what you want.

Hope that helps!

--Jeffrey

[corkyman]

Interesting. So the hangs happens because the 'start' command does not find the script and pops up a message box,
But why in a world is the default directory not a plugins directory?
Is there a way to change the default using ncpa.cfg?

[corkyman]

I was trying to isolate the problem with Timeout of the plugin. Apparently, I isolated it incorrectly--there was a reason for a timeout.
But how about this plugin that times out?

@echo off

start msg * "The system will be rebooted in 30 min. Please save your work and logoff"

exit 2

This was the original issue that I was trying to circumvent (well, a bit more complex but I made it simple now). This plugin when executed gets a timeout in 60 sec. the msg command is a system command. What's going on here?

[jdunitz]

Well, this worked for me...

Code: Select all

@echo off
echo ok
start msg * "hi"

That's not working for you?

[corkyman]

Here is what I discovered with further testing and it is weird.
I tested this snippet on the prod server and it is working. But when I tested it on my virtual machine where I am administrator it is hanging and gives a timeout error in 60 sec. The difference I believe was that somehow I did not have permission on the plugin folder (could not even save the file modified in Notepad). I then changed the permission (since I am the admin) to the folder and ran the API again from the same local virtual machine. Now the result is still bizarre -- it wait for 60 sec (!), then it returns with the proper json return (stdout is "ok") but the return code is 1:
{
"returncode": 1,
"stdout": "ok"
}

Another thing is that I do not get a message box that should say "hi" from the batch command:

@echo off

echo ok
start msg * "hi"

Have you seen anything like that? I can't explain any of it:
1. Why I can't save file in plugins dir when I was the one installing NCPA agent and I am admin
2. Why wait for about a min before returning reply?
3. Why return code 1?
4. Why no msg box pop up?

[jdunitz]

It seems like you may still be running into permissions-related issues somewhere.

Is it possible that UAC is getting in the way, here? Do you know what your UAC level is set to?

Thanks!

--Jeffrey

[corkyman]

I think you are right--on my laptop the setting is

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA REG_DWORD 0x0

and on my VM where I was doing testing it is

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA REG_DWORD 0x1

I'd say the settings are per the corporate policy and I will not be able to change it. Where does it leave me with Nagios? Is it supported? Is this behavior expected/documented?

[jdunitz]

What happens if, instead of running this via the API, you just login as the nagios user and run the cmd file from a cmd window?

start-from-cmd.PNG

In my screenshot I'm running it as Administrator, but you'd do it as nagios. If that does something like you'd expect, then it's not a Nagios issue or question of what's supported, but the constraints of your local environment.

Let me know how this works.

Thanks!

[jdunitz]

You might also want to have a look at the properties of the NCPA service and set that user to be able to interact with the desktop.

Here's a screenshot:

ncpa-user.PNG

Of course, this may also be prevented by your local policy, but it's one more thing to consider.

Hope that helps!

--Jeffrey