CHECK_NRPE: Invalid packet version - OK on Nagios GUI

[nms]

Hi,

Whilst monitoring a server via NRPE, noticed that even though NRPE replies with an invalid packet received from the server, the monitor still has the "Ok" status, which is not right.

Capture.PNG

Most probably this is due that still, the plugin returns the required information within the second line and the command is TRUE.

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H am1-sha-VeeamBKP01-p -t 60 -c check_cpu -a 'warn=load>90' 'crit=load>95'
CHECK_NRPE: Invalid packet version received from server.
OK: CPU load is ok.|'total 5m'=13%;90;95 'total 1m'=7%;90;95 'total 5s'=20%;90;95
[root@am1-sha-nagios1-p ~]# echo $?
0

Is there a way to make this trigger an unknown (3) instead?

Rgds,
Matt

[benjaminsmith]

HI Matt,

This type of issue is usually due to a new version of the plugin talking to an older version of the agent. Try adding the -2 option to your command to force the version 2 packet type.

The steps are outlined in the following KB article.

https://support.nagios.com/kb/article/n ... s-786.html

And let me know if the issue is corrected for you.

[nms]

Hi Benjamin,

Thanks for the reply. This partially fixes the issue, as mainly there are two things:

The main issue is if there is a way to make this trigger an unknown (3) instead. Reason being that we will never know about any change since an "Ok" is returned even though there is an incompatibility between versions.

The next one is that I added the "-2" option but for some, it fails with "Failed to validate filter see log for details"

For example, check_uptime and check_drivesize fail when adding thresholds:

Capture.PNG

Capture2.PNG

Strangely enough when running for example the check_cpu directly from the cli it works, even when changing the threshold:

Code: Select all

[nagios@am1-sha-nagios1-p ~]$ /usr/local/nagios/libexec/check_nrpe -2 -H am1-sha-VeeamBKP01-p -t 60 -c check_cpu -a 'warn=load>90' 'crit=load>95'
OK: CPU load is ok.|'total 5m'=13%;90;95 'total 1m'=14%;90;95 'total 5s'=9%;90;95

[nagios@am1-sha-nagios1-p ~]$ /usr/local/nagios/libexec/check_nrpe -2 -H am1-sha-VeeamBKP01-p -t 60 -c check_cpu -a 'warn=load>90' 'crit=load>99'    OK: CPU load is ok.|'total 5m'=13%;90;99 'total 1m'=7%;90;99 'total 5s'=5%;90;99

Not sure maybe we need to change something in the parameters for thresholds here?

Rgds,
Matthew

[benjaminsmith]

Hi Matthew,

What version of check_nrpe is installed on the Nagios XI server?

Code: Select all

./check_nrpe -V

Due to security restrictions in the GUI, that Run Check Comand feature will sometimes fail but the check command will work. Given that it's working on the CLI, is the service behaving correctly in Nagios XI?

In other words, Is it returning valid check results without the error message when you have this service check configured?

[nms]

Hi Benjamin,

it's 4.0.3. this has been changed from 3.2.1 since we upgraded Nagios to 5.7 lately. So I guess that's why.

Code: Select all

[root@am1-sha-nagios1-p libexec]# ./check_nrpe -V
NRPE Plugin for Nagios
Version: 4.0.3

Indeed the service if changed, works although it gives that error. I was able to see a good status in the ones with - "-2" now.

Also on a side note...I noticed that in the nrpe log of some remote machines there were a lot of errors related to SSL.

Code: Select all

1600358849] Error: (use_ssl == true): Request packet version was invalid!
[1600358849] Could not read request from client 10.192.254.55, bailing out...

At this point, we observed that there were some high cpu usage on them, which started after the upgrade. My thoughts are to upgrade nrpe to the same version hopefully to solve it. Any thoughts about this for cpu utilization?

What difference is there between 4.0.3 and 3.2.1?

rgds,
Matt

[benjaminsmith]

Hi Matt,

In regards to the error you're seeing below, that should be resolved by adding the -2 option to the check command. Let me know if that's the case or not.

Code: Select all

1600358849] Error: (use_ssl == true): Request packet version was invalid!
[1600358849] Could not read request from client 10.192.254.55, bailing out.

The main difference between version 3 and 4 was adding support for TLSv1.3+ , you can view the changelog on the NRPE GitHub page.
https://github.com/NagiosEnterprises/nr ... ANGELOG.md

Not exactly sure why you're seeing the increased CPU usage on the service. It looks like this command is for a Windows system running the NSClient agent. Is this happening for Window checks or checks using the NRPE agent on a remote Linux machine?