NCPA Agent v2.2.2 & v2.2.3 appears broken

[onegative]

G'day Support,

So I am in the middle of a huge deployment of Windows NCPA agents...was in the process of using 2.2.2 but now tried 2.2.3 both are broken. Went back and tried same command against a 2.2.0 and it functioned as expected.

So the one important issue I have found involves using check_ncpa.py to query the ncpa agent with the following command where you utilize the "match=search" or "match=regex" when querying Services, names have been changed to protect the innocent.

I need support to confirm. I really need to addressed quickly so I can determine whether to fall back to 2.2.0 or wait for 2.2.4 if it can be resolved & compiled quickly.

Thank you for your support,
Danny

NCPA Version 2.2.0
SUCCESSFUL
check_ncpa.py --verbose -H myserver1.amc.org -P 3181 -t 'my-token' -M '/system/agent_version' -q ''
Connecting to: https://edwr-exp-p1.amc.uwmedicine.org: ... en&check=1
File returned contained:
{
"returncode": 0,
"stdout": "OK: Agent_version was ['2.2.0']"
}
OK: Agent_version was ['2.2.0']

check_ncpa.py --verbose -H myserver1.amc.org -P 3181 -t 'my-token' -M 'services' -q 'service=dns,match=search,status=running'
Connecting to: https://edwr-exp-p1.amc.uwmedicine.org: ... us=running
File returned contained:
{
"returncode": 0,
"stdout": "OK: Dnscache is running"
}
OK: Dnscache is running

==================================================================================================================================================

NCPA Version 2.2.2
FAILURE
check_ncpa.py --verbose -H myserver2 -P 3181 -t 'my-token' -M '/system/agent_version' -q ''
Connecting to: https://myserver2:3181/api/system/agent ... en&check=1
File returned contained:
{
"returncode": 0,
"stdout": "OK: Agent_version was ['2.2.2']"
}
OK: Agent_version was ['2.2.2']

check_ncpa.py --verbose -H myserver2 -P 3181 -t 'my-token' -M 'services' -q 'service=dns,match=search,status=running'
Connecting to: https://myserver2:3181/api/services/?to ... us=running
An error occurred:HTTP Error 500: INTERNAL SERVER ERROR

==================================================================================================================================================

NCPA Version 2.2.3
FAILURE
check_ncpa.py --verbose -H myserver3 -P 3181 -t 'my-token' -M '/system/agent_version' -q ''
Connecting to: https://myserver3:3181/api/system/agent ... en&check=1
File returned contained:
{
"returncode": 0,
"stdout": "OK: Agent_version was ['2.3.0']"
}
OK: Agent_version was ['2.3.0']

check_ncpa.py --verbose -H myserver3 -P 3181 -t 'my-token' -M 'services' -q 'service=dns,match=search,status=running'
Connecting to: https://myserver3:3181/api/services/?to ... us=running
An error occurred:HTTP Error 500: INTERNAL SERVER ERROR

[benjaminsmith]

Hi,

On the 2.2.2 or 2.2.3 versions of NCPA, can you confirm that you are getting this same behavior on the other services and you do have a service with that exact name. I tested this with NCPA 2.2.2 running on Windows and that same check syntax is working.

Code: Select all

[root@localhost libexec]# ./check_ncpa.py --verbose -H 192.168.254.193 -t 'welcome' -M '/system/agent_version' -q ''
Connecting to: https://192.168.254.193:5693/api/system/agent_version/?token=welcome&check=1
File returned contained:
{
    "returncode": 0,
    "stdout": "OK: Agent_version was ['2.2.2']"
}
OK: Agent_version was ['2.2.2']
[root@localhost libexec]# ./check_ncpa.py --verbose -H 192.168.254.193  -t 'welcome' -M 'services' -q 'service=Spooler,match=search,status=running'
Connecting to: https://192.168.254.193:5693/api/services/?token=welcome&check=1&service=Spooler&match=search&status=running
File returned contained:
{
    "returncode": 0,
    "stdout": "OK: Spooler is running"
}
OK: Spooler is running
[root@localhost libexec]#

If I run the same command you have, I get that error ( it should really be a no services found condition so that is odd), but I do not have that service running.

Code: Select all

[root@localhost libexec]# ./check_ncpa.py --verbose -H 192.168.254.193  -t 'welcome' -M 'services' -q 'service=dns,match=search,status=running'
Connecting to: https://192.168.254.193:5693/api/services/?token=welcome&check=1&service=dns&match=search&status=running
An error occurred:
UNKNOWN: An error occurred connecting to API. (HTTP error: '500 INTERNAL SERVER ERROR'

Let me know what you find out.

Best Regards,
Benjamin

[onegative]

@benjaminsmith

So if you look at these screen shots from the GUI, you will see that match=search successfully finds the Dnscache service just by using "dns" but when you turn it into a Nagios Check that is when the error occurs.

This same functionality of the 2.2.0 NCPA agent it works as expected. I am confident that match=search disregards case-sensitivity and matches dns to DnsCache.

If I specify DnsCache with match=search if functions...my assumption here based on the previous usage from previous version case-sensitivity was eliminated which allowed for the service match where the same service name is different on different versions of Windows.

Even from the GUI macth-search works as long as you do not create a Nagios Check...which is where it hangs and fails with the following Error in the log. I've attached several screen shots as examples...

2021-02-05 12:47:46,933:INFO:handler:128.208.169.18 - - [2021-02-05 12:47:46] "GET /api/services?service=Sophos&match=search HTTP/1.1" 200 630 0.149000
2021-02-05 12:55:01,197:ERROR:app:Exception on /api/services [GET]
Traceback (most recent call last):
File "C:\Python27\lib\site-packages\flask\app.py", line 1817, in wsgi_app
File "C:\Python27\lib\site-packages\flask\app.py", line 1477, in full_dispatch_request
File "C:\Python27\lib\site-packages\flask\app.py", line 1381, in handle_user_exception
File "C:\Python27\lib\site-packages\flask\app.py", line 1475, in full_dispatch_request
File "C:\Python27\lib\site-packages\flask\app.py", line 1461, in dispatch_request
File "C:\ncpa\agent\listener\server.py", line 292, in token_auth_decoration
File "C:\ncpa\agent\listener\server.py", line 1099, in api
File "C:\ncpa\agent\listener\services.py", line 365, in run_check
ValueError: 'Sophos System Protection Service' is not in list

If I perform these exact same procedures on the version 2.2.0 NCPA and it all works and returns the expected results...but somewhere between 2.2.0 and 2.3.0 something broke. The server I had with the 2.2.0 agent did not have Sophos so I used policy instead and it resulted in the correct returns...no hangs.

Please let me know if you don't see the failure, its obvious to me...
Thanks,
Danny

[benjaminsmith]

Hi Danny,

Thanks for the clarification on this one, I was able to replicate the issue and I've filed a bug report on it. It's under review right now by the development team and should be fixed in the next maintenance release.

Let me know if you have any questions. Also, I'll have more details on possible release dates sometime next week.

Best Regards,
Benjamin

[onegative]

@benjaminsmith

Thanks Benjamin,

Yes please let me know if the developers can provide an eta on the a release date if possible...I will try and delay the big push to get all our Windows systems under the NCPA model...I really don't want to fall back to 2.2.0 if possible.

Thank you very much,
Danny

[benjaminsmith]

Hi Danny,

The issue has been fixed and the plan is to get it 2.3.1 out this week (depends on qa testing). The GitHub repo will probably be updated before the official builds are out on the downloads page.

https://github.com/NagiosEnterprises/ncpa


Reference:
https://github.com/NagiosEnterprises/ncpa/issues/742

[onegative]

@benjaminsmith

That's great news Benjamin, thanks for the rapid response to the team on this issue.

Appreciate y'all,
Danny

p.s. Lock this thread.TY

[benjaminsmith]

Your welcome!

We'll lock this up, but feel free to open another if you have any new issues or questions.