Issue with monitoring VM in Nagios

[eclerigo83]

Hi Everyone,

I am just new here and hoping you can help me on this. I am having issue when I added our IAD VM's in Nagios. Here's the message that I got:

CHECK_VMWARE_API.PL CRITICAL - Server version unavailable at 'https://hostname:443/sdk/vimService.wsdl' at /usr/share/perl5/VMware/VICommon.pm line 704, line 2.

I have tried upgrading the Perl module in CentOS 7 but still have this issue. I appreciate any advice that you can give.


Thanks!

[cdienger]

What is the result of:

Code: Select all

curl https://hostname:443/sdk/vimService.wsdl -v

and:

Code: Select all

/usr/local/nagios/libexec/check_vmware_api.pl -V

?

What version VMWare is the host on?

[eclerigo83]

Hi,

Thanks for the reply. Below are the info you requested:

1) curl https://172.27.98.4:443/sdk/vimService.wsdl -v

[root@ctl ~]# curl https://172.27.98.4:443/sdk/vimService.wsdl -v
* About to connect() to 172.27.98.4 port 443 (#0)
* Trying 172.27.98.4...
* Connected to 172.27.98.4 (172.27.98.4) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* Server certificate:
* subject: C=US,ST=Texas,L=Houston,OU=ISS,O=Hewlett-Packard Company,CN=ILO MXQ53704QS
* start date: Sep 20 13:53:18 2015 GMT
* expire date: Sep 19 13:53:18 2030 GMT
* common name: ILOMXQ53704QS
* issuer: C=US,ST=Texas,L=Houston,OU=ISS,O=Hewlett-Packard Company,CN=iLO Default Issuer (Do not trust)
* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
* Peer's Certificate issuer is not recognized.
* Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
[root@ctl ~]#

[root@ctl ~]# /usr/local/nagios/libexec/check_vmware_api.pl -V
check_vmware_api.pl 0.7.1

Host is currently on VMware ESXi 6.7.0

Thanks!

[cdienger]

Run the curl command again but with the -k option added:

Code: Select all

curl https://172.27.98.4:443/sdk/vimService.wsdl -v -k

Is the VWware SDK on X version 6.7 as well? Check it with:

Code: Select all

/usr/bin/vmware-cmd --version

If it is an older version then I would upgrade. Check out the "Installing VMware SDK" section in https://assets.nagios.com/downloads/nag ... ios-XI.pdf.

[eclerigo83]

Hi,

Sorry for the late reply. I will provide the output today. Thanks!

[eclerigo83]

Hi,

Here's the output that you requested. I can see that VMWare SDK is running on latest version 6.7.0

[root@ctl ~]# curl https://172.27.98.4:443/sdk/vimService.wsdl -v -k
* About to connect() to 172.27.98.4 port 443 (#0)
* Trying 172.27.98.4...
* Connected to 172.27.98.4 (172.27.98.4) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* SSL connection using TLS_RSA_WITH_3DES_EDE_CBC_SHA
* Server certificate:
* subject: C=US,ST=Texas,L=Houston,OU=ISS,O=Hewlett-Packard Company,CN=ILOMXQ53704QS
* start date: Sep 20 13:53:18 2015 GMT
* expire date: Sep 19 13:53:18 2030 GMT
* common name: ILOMXQ53704QS
* issuer: C=US,ST=Texas,L=Houston,OU=ISS,O=Hewlett-Packard Company,CN=iLO Default Issuer (Do not trust)
> GET /sdk/vimService.wsdl HTTP/1.1
> User-Agent: curl/7.29.0
> Host: 172.27.98.4
> Accept: */*
>
< HTTP/1.1 404 Not Found
< Content-Type: text/html
< Date: Wed, 29 Jul 2020 19:45:25 GMT
< X-Content-Type-Options: nosniff
< X-Frame-Options: sameorigin
< X-XSS-Protection: 1; mode=block
< Content-Length: 0
<
* Connection #0 to host 172.27.98.4 left intact
[root@ctl ~]# /usr/bin/vmware-cmd --version
vSphere SDK for Perl version: 6.7.0
Script 'vmware-cmd' version: 6.7.0
[root@ctl ~]#

[lmiltchev]

There are different things that can cause this error. Look at the various reports by users here:

https://exchange.nagios.org/directory/P ... pi/details

The easiest thing that you can try in order to solve the issue is adding this line:

Code: Select all

$ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0;

on the top of the "check_vmware_api.pl" plugin, right below the comments.

If this doesn't work, you could try installing an older version of SDK. In our documentation it says:

Important: There have been some issues with SDK 6.7. We recommend downloading SDK 6.5 instead.

https://assets.nagios.com/downloads/nag ... ios-XI.pdf

Hope this helps.

[eclerigo83]

Thanks. Will give it a try.

[lmiltchev]

Let us know if this helped. Thank you!

[eclerigo83]

By the way I already tried the suggestion from this link: https://assets.nagios.com/downloads/nag ... ios-XI.pdf

but it still did not work.