Executing event Handlers to correct action

[ITOMB_IMT]

Do you want to me create the script as a service and test?

[benjaminsmith]

Hi @ISSB_MAOST,

Well, I' think the best option is to execute the script using NRPE since it is running on the remote host. Let me know which parts you need more clarification. Thanks.

[ITOMB_IMT]

As of now i have configured nagios to monitor files in core directory and alerts us if it finds any files. we would like to configure event handlers with the script i wrote to make corrective actions. I need more clarification on how to execute event handlers on remote machine.

[benjaminsmith]

Hi,

I need more clarification on how to execute event handlers on remote machine.

When you run the script on the remote hosts is it working correctly? What folder is the file located in? Next, do you have NRPE installed on the remote host?

[ITOMB_IMT]

yes, when i run individually it works, but when i setup with even handlers its not. the files are in /core folder. Nrpe has been installed and monitoring that folder.

[benjaminsmith]

Hi @ISSB_MAOST,

Can you PM your system profile along with the exact name of the service that will call the event handler and I can review the configurations? Also, if the event handler script is not too big, can you attach that as well.

Thanks.

Benjamin

[ITOMB_IMT]

Sent aPM

[benjaminsmith]

Hi @ISSB_MAOST,

Perfect, thank you for sending over the profile and script. Let's see if we can get this working for you now. Here's what we need to do:

1. Update the command for the event handler. In the Nagios XI web interface Navigate to Configure > Core Config Manager > Commands, and find the remove_core command, update to the following:

Code: Select all

define command {
    command_name    remove_core
    command_line     $USER1$/check_nrpe -H $HOSTADDRESS$ -c remove_core
}

2. Create the new command in NRPE configuration file (restart NRPE after making changes). On the remote host open up /usr/local/nagios/etc/nrpe.cfg, and create a new command:

Code: Select all

command[remove_core]=sudo /usr/local/nagios/libexec/remove_core.sh

3. Add sudo privileges to this command so it can be successfully run by NRPE. Open up /etc/sudoers,and add the following line:

Code: Select all

nagios   ALL = NOPASSWD:/usr/local/nagios/libexec/remove_core.sh

4. Log into Nagios XI and test it. Does it work? If you get any error messages running the test, please post them to the thread. Thanks!

Code: Select all

cd /usr/local/nagios/libexec
./check_nrpe -H <ipaddress-remote-host> -c remove_core

References:
https://assets.nagios.com/downloads/nag ... ios-XI.pdf
https://support.nagios.com/kb/article/n ... d-612.html
https://support.nagios.com/kb/article/n ... t-620.html

[ITOMB_IMT]

Hi @ISSB_MAOST,

Perfect, thank you for sending over the profile and script. Let's see if we can get this working for you now. Here's what we need to do:

1. Update the command for the event handler. In the Nagios XI web interface Navigate to Configure > Core Config Manager > Commands, and find the remove_core command, update to the following:

Code: Select all

define command {
    command_name    remove_core
    command_line     $USER1$/check_nrpe -H $HOSTADDRESS$ -c remove_core
}

2. Create the new command in NRPE configuration file (restart NRPE after making changes). On the remote host open up /usr/local/nagios/etc/nrpe.cfg, and create a new command:

Code: Select all

command[remove_core]=sudo /usr/local/nagios/libexec/remove_core.sh

3. Add sudo privileges to this command so it can be successfully run by NRPE. Open up /etc/sudoers,and add the following line:

Code: Select all

nagios   ALL = NOPASSWD:/usr/local/nagios/libexec/remove_core.sh

4. Log into Nagios XI and test it. Does it work? If you get any error messages running the test, please post them to the thread. Thanks!

Code: Select all

cd /usr/local/nagios/libexec
./check_nrpe -H <ipaddress-remote-host> -c remove_core

References:
https://assets.nagios.com/downloads/nag ... ios-XI.pdf
https://support.nagios.com/kb/article/n ... d-612.html
https://support.nagios.com/kb/article/n ... t-620.html

I followed all the steps you provided. I tried to execute the script both locally and remote. Both didn't work using nrpe.
cd /usr/local/nagios/libexec/
./check_nrpe -H remote_host_IP -c remove_core
NRPE: Unable to read output

./check_nrpe -H localhost -c remove_core
NRPE: Unable to read output

I have configured command in nrpe as
command[remove_core]=sudo /usr/local/nagios/libexec/remove_core.sh and restarted nrpe and remove_core.sh is located in /usr/local/nagios/libexec/ directory.

The script has all necessary permissions to execute.

[benjaminsmith]

Hi @ISSB_MAOST,

Getting really close, this is a common error message that is usually caused by incorrect plugin paths or permissions. Take a look at the troubleshooting guide as a reference:

NRPE - NRPE: Unable To Read Output

Can you log into the remote host and make sure you can run the plugin as the nagios user.

Code: Select all

#On the remote host
su nagios
sudo /usr/local/nagios/libexec/remove_core.sh

Does it execute successfully? If not, please show the output.