Windows Services Configured With Delayed Start Never Go Crit

[jimmlegs]

Good Day,

My NRPE Windows services check never goes critical when the service is configures for start type: Automatic (Delayed) it transitions to warning and stays that way. I've played around with the syntax but cannot figure out how to get it to work, can someone assist?

This is the service definition

Code: Select all

define service {
    service_description      NRPE Check Service States - Alert
    use                      aa-windows-production-standard-alert
    display_name             NRPE Check Service States - Alert
    check_command            check_nrpe!check_service "top-syntax=%(list)" "detail-syntax=%(name):%(state)"!-a "exclude=gupdate" "exclude=edgeupdate" "exclude=clr_optimization_v4.0.30319_32" "exclude=clr_optimization_v4.0.30319_64" "exclude=MMCSS" "exclude=sppsvc" "exclude=RemoteRegistry" "exclude=stisvc" "exclude=CDPSvc" "exclude=tiledatamodelsvc" "exclude=ShellHWDetection" "exclude=WbioSrvc" "exclude=MapsBroker" "exclude=wuauserv" "exclude=TBS" "exclude='NetBackup SAN Client Fibre Transport Service'" "exclude=TrustedInstaller" "exclude=NetBackup Vault Manager" "exclude=NetBackup Key Management Service" "exclude=BMR Master Service" "exclude=SolarwindsSyslogService" "exclude=SolarWindsTrapService" "exclude=BMR Boot Service" "exclude=iQLManagementAgentJava" "exclude=QLManagementAgentJava" "exclude=QLogicManagementSuitenQLRemote" "exclude=Audiosrv" "exclude=SNARE" "exclude=BITS" "exclude=MSExchangeNotificationsBroker" exclude="BOEXI40Agent" exclude="BOEXI40AutomationFramework" exclude="SVNSubversion" exclude="VMwareIDMService" exclude="MSComplianceAudit" "filter=start_type = 'auto' and name not like 'OneSyncSvc_' and name not like 'CDPUserSvc_'"!!!!!!
    check_period             24x7
    event_handler_enabled    0
    register                 1
}

[vtrac]

Hi,
What is the output of your check_nrpe command? .... please upload screenshot or results.

What is the output of the following command:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H x.x.x.x -c check_service

I tried your command on my Nagios XI VM, but looks like it is not working for me, I got:

Code: Select all

CRITICAL: Intel(R) TPM Provisioning Service=stopped (auto), delayed (dmwappushservice=stopped (delayed), edgeupdate=stopped (delayed), gupdate=stopped (delayed), MapsBroker=stopped (delayed), sppsvc=stopped (delayed))

Regards,
Vinh

[jimmlegs]

Here is the output:

/usr/local/nagios/libexec/check_nrpe -H SRV-vINFRAOPS -c check_service -a "exclude=gupdate" "exclude=edgeupdate" "exclude=clr_optimization_v4.0.30319_32" "exclude=clr_optimization_v4.0.30319_64" "exclude=MMCSS" "exclude=sppsvc" "exclude=RemoteRegistry" "exclude=stisvc" "exclude=CDPSvc" "exclude=tiledatamodelsvc" "exclude=ShellHWDetection" "exclude=WbioSrvc" "exclude=MapsBroker" "exclude=wuauserv" "exclude=TBS" "exclude='NetBackup SAN Client Fibre Transport Service'" "exclude=TrustedInstaller" "exclude=NetBackup Vault Manager" "exclude=NetBackup Key Management Service" "exclude=BMR Master Service" "exclude=SolarwindsSyslogService" "exclude=SolarWindsTrapService" "exclude=BMR Boot Service" "exclude=iQLManagementAgentJava" "exclude=QLManagementAgentJava" "exclude=QLogicManagementSuitenQLRemote" "exclude=Audiosrv" "exclude=SNARE" "exclude=BITS" "exclude=MSExchangeNotificationsBroker" exclude="BOEXI40Agent" exclude="BOEXI40AutomationFramework" exclude="SVNSubversion" exclude="VMwareIDMService" exclude="MSComplianceAudit" "filter=start_type = 'auto' and name not like 'OneSyncSvc_' and name not like 'CDPUserSvc_'"
CHECK_NRPE: Invalid packet version received from server.
WARNING: , delayed (VeeamMountSvc=stopped (delayed))|

[vtrac]

Hi,
I ran the same command you did and here's my results.
I add the "-2" so that I don't get the "CHECK_NRPE: Invalid packet version received from server" warning.

Code: Select all

/usr/local/nagios/libexec/check_nrpe -2 -H x.x.x.x -c check_service -a "exclude=gupdate" "exclude=edgeupdate" "exclude=clr_optimization_v4.0.30319_32" "exclude=clr_optimization_v4.0.30319_64" "exclude=MMCSS" "exclude=sppsvc" "exclude=RemoteRegistry" "exclude=stisvc" "exclude=CDPSvc" "exclude=tiledatamodelsvc" "exclude=ShellHWDetection" "exclude=WbioSrvc" "exclude=MapsBroker" "exclude=wuauserv" "exclude=TBS" "exclude='NetBackup SAN Client Fibre Transport Service'" "exclude=TrustedInstaller" "exclude=NetBackup Vault Manager" "exclude=NetBackup Key Management Service" "exclude=BMR Master Service" "exclude=SolarwindsSyslogService" "exclude=SolarWindsTrapService" "exclude=BMR Boot Service" "exclude=iQLManagementAgentJava" "exclude=QLManagementAgentJava" "exclude=QLogicManagementSuitenQLRemote" "exclude=Audiosrv" "exclude=SNARE" "exclude=BITS" "exclude=MSExchangeNotificationsBroker" exclude="BOEXI40Agent" exclude="BOEXI40AutomationFramework" exclude="SVNSubversion" exclude="VMwareIDMService" exclude="MSComplianceAudit" "filter=start_type = 'auto' and name not like 'OneSyncSvc_' and name not like 'CDPUserSvc_'"

My output:

Code: Select all

CRITICAL: gpsvc=stopped (auto), Intel(R) TPM Provisioning Service=stopped (auto), delayed (dmwappushservice=stopped (delayed))

Looking at your output (below), not sure why its started with a comma "," and ended with a pipe "|", my output did not. I'm not sure what server is your "SRV-vINFRAOPS".

Code: Select all

WARNING: , delayed (VeeamMountSvc=stopped (delayed))|

Regards,
Vinh

[jimmlegs]

NagiosXI is at version 5.8.1, the agent is on Windows Server 2016 Standard with NSClient++ v 0.5.0.62. I have tested with v 0.5.2.35 and the behavior is the same. The output of the 0.5.2.35 version is:

Standard autostart service:
CRITICAL: W32Time=stopped (auto), delayed ()
Delayed autostart service:
WARNING: , delayed (W32Time=stopped (delayed))

[vtrac]

Hi,
I am lost here!!!
What results are you expecting?

I tested your exact command on my Windows 10 and here was the results:

Code: Select all

CRITICAL: gpsvc=stopped (auto), Intel(R) TPM Provisioning Service=stopped (auto), delayed (dmwappushservice=stopped (delayed))

The output you got back from you running the command was NOT an error, which tell not the script works fine.

I would suggest that you start out with a small number of "exclude" options and then add more as you go ... (example):

Code: Select all

/usr/local/nagios/libexec/check_nrpe -2 -H x.x.x.x -c check_service -a service=nscp "crit=state = 'stopped'" warn=none

Regards,
Vinh

[jimmlegs]

The desired/expected output is:
CRITICAL: W32Time=stopped (auto), delayed ()

Same results with a basic check.

/usr/local/nagios/libexec/check_nrpe -H BOS-vBPIT3 -c check_service -a service="PhoneSvc"
CHECK_NRPE: Invalid packet version received from server.
WARNING: , delayed (PhoneSvc=stopped (delayed))|'PhoneSvc'=1;0;0

define service {
host_name BOS-vBPIT3
service_description TEST Phone Service
display_name TEST Phone Service
check_command check_nrpe!check_service "top-syntax=%(list)" "detail-syntax=%(name):%(state)"!-a service="PhoneSvc"!!!!!!
max_check_attempts 2
check_interval 1
retry_interval 1
check_period 24x7
event_handler Handler Windows - Service Restart
event_handler_enabled 1
notification_period none
_service spooler
register 1
}

[vtrac]

Hi,
Please try this:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -2 -H x.x.x.x -c check_service -a service=PhoneSvc "crit=state = 'stopped'" warn=none

The output is:

Code: Select all

CRITICAL: PhoneSvc=stopped (demand), delayed ()|'PhoneSvc'=1;0;0

Regards,
Vinh

[jimmlegs]

Thanks Vinh! That did it. You can lock this thread

[vtrac]

Great!! .... ticket closed/locked.