Web Transaction service not working

[Amit_Alone]

Hi Team,
We are holding Nagios XI 5.7.3 version. As per new requirement we are trying to enable the URL monitoring using Web Transaction.

However, after trying to enable multiple web URL which are under different host all were displaying the same error message "CRITICAL - Socket timeout" for host and for service we are observing "WebInject CRITICAL - Test case number 1 failed". But, when we tried to enable the same URL monitoring using HTTP service alert is working as expected.

Below is the testdata.xml file.

Code: Select all

<testcases repeat="1">

<case
    id="1"
    url="http://10.173.15.173:80/Treasury/"
/>

</testcases>

Below one is config.xml

Code: Select all

<testcasefile>AGASPWINVT0416__Web_Transaction_testdata.xml</testcasefile>
<useragent>WebInject Application Tester</useragent>
<timeout>10</timeout>
<globaltimeout>30</globaltimeout>
<reporttype>nagios</reporttype>

To monitor the alert we are using default script that is webinject.pl and it is present on below location.
/usr/local/nagiosxi/etc/components/webinject
Version=1.41

[benjaminsmith]

Hi,

That test case looks pretty straightforward test case, I would suggest increasing the timeout from 10 to 30 seconds to rule out that has an issue and let me know us know the results.

Thanks,
Benjamin

[Amit_Alone]

Thanks for reply.

As suggested, I have increased the time out from 10 to 30 sec but still observing the same.

Code: Select all

<testcasefile>AGASPWINVT0416__Web_Transaction_testdata.xml</testcasefile>
<useragent>WebInject Application Tester</useragent>
<timeout>30</timeout>
<globaltimeout>30</globaltimeout>
<reporttype>nagios</reporttype>

Please note I have deleted the previous configuration and re-created the new one by increasing the time out.

[benjaminsmith]

Hi,

Let's run a curl command on the URL in your test case to check the output. It might be throwing the script a curveball. Please post the full output of the command to the thread below.

Code: Select all

curl -k -L -v  http://10.173.15.173:80/Treasury/

[Amit_Alone]

Hi,

As suggested I have run the command and it throws the connection time out error. I have attach the o/p screen shot AGASPWINVT0416.png. However, it looks like Nagios server has some access issue with this URL.

Any way as I said I have tried different URL all where showing same problem. So, attaching the same o/p for different server AGASPWINVP0094. However, I was able to enable HTTP alert for AGASPWINVP0094 and it is working as expected. I have attach the GUI screen shot.

AGASPWINVP0094__Web_Transaction_testdata.xml

Code: Select all

<testcases repeat="1">

<case
    id="1"
    url="https://10.88.87.11:443/quantum/"
/>

</testcases>

AGASPWINVP0094__Web_Transaction_config.xml

Code: Select all

<testcasefile>AGASPWINVP0094__Web_Transaction_testdata.xml</testcasefile>
<useragent>WebInject Application Tester</useragent>
<timeout>30</timeout>
<globaltimeout>30</globaltimeout>
<reporttype>nagios</reporttype>

[benjaminsmith]

Hi,

If the Curl test is coming back with a curl (7) failed to connect this usually indicates something is blocking the connection. I'm surprised check_http would work in this case. If we cannot establish an HTTP get request with the site, the Web Inject will not be able to process the test case.

You might try connecting over https instead as you did in the other case ( url="https://10.88.87.11:443/quantum/" ). What is the output to a map command on that IP address?

Code: Select all

nmap 10.173.15.173

Benjamin

Reference:
https://stackoverflow.com/questions/992 ... ct-to-host

[Amit_Alone]

Sorry for confusion Benj. Let me explain you about my previous statement.

1. Screen shot which is displaying curl (7) failed to connect this o/p belongs to server AGASPWINVT0416 i.e. 10.173.15.173 IP for which I have open this ticket. After observing the curl response I come to know something gone wrong with access with the 10.173.15.173 IP. I tried configuring the http alert as well but still I observed socket time out alert.

2. So, as I explain earlier I have tried multiple host and observed the same result because of that I have tried other host server AGASPWINVP0094 i.e. 10.88.87.11 IP and for this server after performing curl command I have observed the different o/p and same I have attach in the AGASPWINVP0094.txt file. GUI screen shot belongs to the server AGASPWINVP0094.

Below nmap o/p is from AGASPWINVP0094 server.

Code: Select all

[e5613751@avgdlnxvp127 ~]$ nmap 10.88.87.11

Starting Nmap 6.47 ( http://nmap.org ) at 2020-10-19 07:58 EDT
Nmap scan report for 10.88.87.11
Host is up (0.089s latency).
Not shown: 987 closed ports
PORT      STATE    SERVICE
80/tcp    open     http
135/tcp   open     msrpc
161/tcp   filtered snmp
443/tcp   open     https
2103/tcp  open     zephyr-clt
2105/tcp  open     eklogin
3389/tcp  open     ms-wbt-server
5666/tcp  open     nrpe
49152/tcp open     unknown
49153/tcp open     unknown
49154/tcp open     unknown
49155/tcp open     unknown
49156/tcp open     unknown

Nmap done: 1 IP address (1 host up) scanned in 1.38 seconds

So, here could you please explain me for the same IP URL why HTTP is working but not the working with web transaction.

[benjaminsmith]

Hi,

Thanks for the clarification there. And as to why check_http is working but Web Inject is not working, we are not fully certain yet, but it could be an issue with how re-directs are handled.

Please run a curl command against that URL with the -i option to view the headers and post the output.

Code: Select all

curl -i <URL>

[ssax]

Your HTTP service looks like you are not using -f follow (which follows redirects) please edit the service and change that.

The current version of

Code: Select all

/usr/local/nagiosxi/etc/components/webinject.pl

does NOT support redirects (even though it says it does), I had to install the Webinject CPAN module and then update our webinject.pl file to work with the new module.

Code: Select all

cp -p /usr/local/nagiosxi/etc/components/webinject/webinject.pl /usr/local/nagiosxi/etc/components/webinject/webinject.pl.bak
cpan -i Webinject
wget 'https://raw.githubusercontent.com/sni/Webinject/master/Webinject/bin/webinject.pl' -O /usr/local/nagiosxi/etc/components/webinject/webinject.pl

Then add <max_redirect>5</max_redirect> to your config:

Code: Select all

<testcasefile>AGASPWINVT0416__Web_Transaction_testdata.xml</testcasefile>
<useragent>WebInject Application Tester</useragent>
<timeout>30</timeout>
<globaltimeout>30</globaltimeout>
<reporttype>nagios</reporttype>
<max_redirect>5</max_redirect>

If these are self-singed certs you'll need to do this:

Code: Select all

https://github.com/sni/Webinject/issues/33#issuecomment-578987578

You can do that after running the commands at the top and modifying /usr/local/share/perl5/Webinject.pm and change line 619 from this:

Code: Select all

    my $useragent  = LWP::UserAgent->new(keep_alive=>$keepalive);

To this:

Code: Select all

        my $useragent  = LWP::UserAgent->new(
        keep_alive=>$keepalive,
        ssl_opts => {
            verify_hostname => 0,
        }
    );

Then test again.

[Amit_Alone]

Sorry for late reply. I was on leave.

Thanks @ssax for sharing new steps. We are already using -f follow in HTTP service configuration.

Code: Select all

check_xi_service_http! -f follow -I 10.88.87.11 -u "/quantum/" -S -p 443

We have followed the shared steps and now it is working as expected. However, while performing cpan command I have observed below error.

Code: Select all

[root@avgdlnxvp127 ~]# cpan -i Webinject
Fetching with LWP:
http://www.cpan.org/modules/by-module/DBD/DBD-Oracle-1.74.tar.gz/authors/01mailrc.txt.gz
LWP failed with code[500] message[Can't connect to www.cpan.org:80 (Connection refused)]

Trying with

So, I have downloaded the Webinject.pm file from https://github.com/sni/Webinject/blob/m ... binject.pm

While performing negative testing I have observed that Nagios is displaying all the test id details from config.xml as shown below. So, is it possible to display only the affected test id details rather than whole test id details.

Code: Select all

[root@avgdlnxvp127 webinject]# ./webinject.pl -c AGASPWINVP0094__Web_Transaction_config.xml
WebInject CRITICAL - Test case number 2 failed

Test: AGASPWINVP0094__Web_Transaction_testdata.xml - 1
GET Request: https://10.88.87.11:443/quantum/
Passed HTTP Response Code Verification (not in error range)
TEST CASE PASSED
Response Time = 0.471 sec
-------------------------------------------------------
Test: AGASPWINVP0094__Web_Transaction_testdata.xml - 2
Desc: 200 response received
GET Request: https://10.88.87.11:443/quantum/
Passed HTTP Response Code Verification (not in error range)
Verify: '200'
Failed Positive Verification
Verify Negative: 'Expected response not received'
Passed Negative Verification
TEST CASE FAILED
Response Time = 0.093 sec
-------------------------------------------------------

Test Cases Run: 2
Test Cases Passed: 1
Test Cases Failed: 1
Verifications Passed: 3
Verifications Failed: 1
|time=0.611s;0;30;0;0 case1=0.471s;0;0;0;0 case2=0.093s;0;0;0;0