Monitoring remote windows server using NSCA

[HAL]

You need to add a rule to your IPtables to allow traffic to port 5667

Hi ,
Can you tell me how to add the route to IPTable?

[scottwilkerson]

You can modify iptalbes doing the following:

Open the iptables-config in a text editor:

vi /etc/sysconfig/iptables-config

...and change these two lines:

IPTABLES_SAVE_ON_STOP="no"
to:
IPTABLES_SAVE_ON_STOP="yes"

and
IPTABLES_SAVE_ON_RESTART="no"
to:
IPTABLES_SAVE_ON_RESTART="yes"

Save the file and exit.

Run this command:

iptables -I INPUT -p tcp --dport 5667 -j ACCEPT

Check if these rules have been added:

iptables -L -n

[HAL]

we have run the below command and now see the nsca port in the iptables-config as below

ACCEPT tcp -- anywhere anywhere tcp dpt:nsca

we now see the below message in the nsclient log

error:modules\NSCAAgent\NSCAThread.cpp:286: <<< Could not connect to: ipaddress:5667 10061: No connection could be made because the target machine actively refused it.

[scottwilkerson]

This is leading me to believe you have another firewall in between these 2 machines that is blocking port 5667.

Is there a firewall device between these machines?

[HAL]

Hi
There is a firewall in between but we have open the port 5667 bidirectional between Nagios and remote machine.

[scottwilkerson]

from the remote machine can you telnet to the XI server on port 5667 ?

Code: Select all

telnet XI_IP_ADDRESS 5667

If not I would guess the firewall is still blocking it

[HAL]

HI Let me explain ,

Now firewall all ports are open between Nagios server and remote machine behind the firewall.

Telnet to 5667 is OK from Remote machine to Nagios server
Telnet to 5667 is not working from Nagios to Remote machine
Self telnet to NAgios server working on 5667
Self telnet to Remote machine not working

We did lot of testing today , I am attaching ini file and log file of remote machine

[lmiltchev]

Can you, please, check your unconfigured objects? It seems like that after restart of nsclient++ service, the windows machine started to send data to your Nagios XI server (at around 2012-10-24 13:45:05 - please, check your log).

[HAL]

Dear Support ,
I was not expecting this basic question at this time.

Already there is a time difference between our replies so please provide the proper solution and ask as much as information in one thread only.

We are running out of time and already wasted few days in this.

I appreciate if you could provide the solution on this ASAP.

[scottwilkerson]

As lmiltchev has pointed out, the nsclient.log is showing that NSClient++ successfully sent the data to the server, it would be at this time if the host/service wasn't configured yet, it would appear in the unconfigured objects

2012-10-24 13:45:05: debug:CACHEmodules\NSCAAgent\NSCAThread.cpp:77: Time difference for NSCA server is: 0
2012-10-24 13:45:05: debug:CACHEmodules\CheckSystem\PDHCollector.cpp:131: Found countername: UPTIME: \System\System Up Time
2012-10-24 13:45:05: debug:CACHEmodules\NSCAAgent\NSCAThread.cpp:87: Only reporting: ok,warning,critical,unknown
2012-10-24 13:45:05: debug:modules\CheckSystem\PDHCollector.cpp:132: Found countername: MCL: \Memory\Commit Limit
2012-10-24 13:45:05: debug:NSClient++.cpp:709: NSCLient++ - 0.3.9.327 2011-08-16 Started!
2012-10-24 13:45:05: debug:modules\NSCAAgent\NSCAThread.cpp:188: Drifting: 0
2012-10-24 13:45:05: debug:modules\CheckSystem\PDHCollector.cpp:133: Found countername: MCB: \Memory\Committed Bytes
2012-10-24 13:45:05: message:NSClient++.cpp:461: Using settings from: INI-file
2012-10-24 13:45:05: message:NSClient++.cpp:462: Enter command to inject or exit to terminate...
2012-10-24 13:45:35: debug:modules\NSCAAgent\NSCAThread.cpp:206: Executing (from NSCA): #All Drive Space Usage
2012-10-24 13:45:35: debug:NSClient++.cpp Injecting: CheckDriveSize: MinWarn=10%, MinCrit=5%, CheckAll, FilterType=FIXED
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Result: OK 'OK: All drives within bounds.'
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Performance Result: ''C:\ %'=24%;10;5 'C:\'=7683.3MB;998.57;499.28;0;9985.68 'D:\ %'=96%;10;5 'D:\'=472.69MB;999.3;499.65;0;9993'
2012-10-24 13:45:35: debug:modules\NSCAAgent\NSCAThread.cpp:206: Executing (from NSCA): C:\ Drive Space Usage
2012-10-24 13:45:35: debug:NSClient++.cpp Injecting: CheckDriveSize: MinWarn=10%, MinCrit=5%, Drive=c:\, FilterType=FIXED
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Result: OK 'OK: All drives within bounds.'
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Performance Result: ''c:\ %'=24%;10;5 'c:\'=7683.3MB;998.57;499.28;0;9985.68'
2012-10-24 13:45:35: debug:modules\NSCAAgent\NSCAThread.cpp:206: Executing (from NSCA): CPU Usage
2012-10-24 13:45:35: debug:NSClient++.cpp Injecting: checkCPU: warn=90, crit=95, time=20m, time=10s, time=4
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Result: OK 'OK CPU Load ok.'
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Performance Result: ''20m'=0%;90;95 '10s'=0%;90;95 '4'=0%;90;95'
2012-10-24 13:45:35: debug:modules\NSCAAgent\NSCAThread.cpp:206: Executing (from NSCA): Memory Usage
2012-10-24 13:45:35: debug:NSClient++.cpp Injecting: checkMem: MaxWarn=90%, MaxCrit=95%, ShowAll
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Result: OK 'OK memory within bounds.'
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Performance Result: ''
2012-10-24 13:45:35: debug:modules\NSCAAgent\NSCAThread.cpp:206: Executing (from NSCA): NSClient Service Status
2012-10-24 13:45:35: debug:NSClient++.cpp Injecting: checkServiceState: nsclientpp
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Result: CRITICAL 'CRITICAL: nsclientpp: stopped (critical)'
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Performance Result: ''
2012-10-24 13:45:35: debug:modules\NSCAAgent\NSCAThread.cpp:206: Executing (from NSCA): Pagefile Usage
2012-10-24 13:45:35: debug:NSClient++.cpp Injecting: checkMem: MaxWarn=80%, MaxCrit=90%, ShowAll, type=page
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Result: OK 'OK: page file: 525M'
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Performance Result: ''page file %'=49%;80;90 'page file'=524.57MB;852.37;958.91;0;1065.46'
2012-10-24 13:45:35: debug:modules\NSCAAgent\NSCAThread.cpp:206: Executing (from NSCA):
2012-10-24 13:45:35: debug:NSClient++.cpp Injecting: CheckOK: Machine, is, okay
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Result: OK 'Machineisokay'
2012-10-24 13:45:35: debug:NSClient++.cpp Injected Performance Result: ''
2012-10-24 13:45:35: debug:modules\NSCAAgent\NSCAThread.cpp:272: Sending to server...
2012-10-24 13:45:35: debug:modules\NSCAAgent\NSCAThread.cpp:279: Looked up 10.202.21.19 to 10.202.21.19
2012-10-24 13:45:36: debug:modules\NSCAAgent\NSCAThread.cpp:356: Finnished sending to server...

If this host/service has already been configured, it would update the status....