Some Windows Processes Always Appear As Stopped

[jimmlegs]

Good day,

check_process appears to not be able to poll the status of certain processes like csrss.exe, or mssense.exe. These processes run under the SYSTEM account as does NSClient++ and I have confirmed that all users have read access to the process.

The output of: ./check_nrpe -H $HOSTNAME$ -c check_process -a process=MsSense.exe
Is: CRITICAL: MsSense.exe=stopped|'MsSense.exe state'=0;0;0 'count'=1;0;0

Thanks in advance for any assistance.

[gsmith]

Hi

One solution would be to monitor using NCPA. If you are open to doing
this let me know and I can send you some docs describing how to do this.

If you want to stay with NRPE/NSClient++ please let me know what Windows OS
you are monitoring and which NSClient++ agent (32 bit or 64 bit) you have installed.

Thanks

[jimmlegs]

The preference is to stay with NSClient++/NRPE. The client is running 64-bit NSClient++ 0.5.2.35

Thank you

[gsmith]

Hi

What Windows OS are you monitoring?

Thanks

[jimmlegs]

Windows Server 2019 Standard, build 17763.2213

[gsmith]

Hi

Thanks for that info - I am going to set up some test machines and investigate.

Will let you know what I find.

Thanks

[gsmith]

Hi,

Thanks for your patience as I am having trouble getting my environments working correctly.

In the meantime please send me a System Profile.

To send us your system profile.
1. Login to the Nagios XI GUI using a web browser.
2. Click the "Admin" > "System Profile" Menu
3. Click the "Download Profile" button
4. Save the profile.zip file and share the file in a private message and then reply to this post to bring it up in the queue.

Thanks

[jimmlegs]

I believe I have attached the file properly to a PM, let me know if you don't get it.

Thanks

[gsmith]

Hi,

Yes - I got the file - thank you.

I am able to duplicate your issue with csrss.exe now. I need to do some troubleshooting
and will let you know what I find out.

Thanks

[gsmith]

Hi,

This is what I was able to find out.

Apparently it's an NSClient++ bug: https://github.com/mickem/nscp/issues/580

The cause of the bug appears to be that NSClient++ is checking the command line of each process to locate the process name, and since Server 2012 R2/Windows 8.1, the command line for these processes is suppressed.

Here is what I ran in PowerShell on my system to see what the Name and Command Line for all the running processes are:

nsclient_bug.jpg

As you can see there are no values for "Command Line" for:

• smss.exe
  csrss.exe
  services.exe

Please run:

Code: Select all

gwmi win32_process | Select Name, Command Line

on the Windows machine you are trying to monitor and see what value, if any, is returned for MsSense.exe


Thanks