Possible client issues?

[slansing]

So what Nmap is telling you here is that there is a firewall, filter, or something between XI and the scanned system that is blocking port traffic, so that is the cause of this issue with check_nt not being able to get through.

[mobiledataforce]

Yes, "something". I would love help in trying to identify what that something may be.. I have been convinced from the start that it has to be something on the local windows servers I am trying to monitor. To retierate, I have one host that shows everything in a down/critical state. I have another host that sometimes monitors correctly in a up/ok state, sometimes monitors in down/critical state, and most often monitors in a warning state. There has to be something going on locally with these two hosts. I have them configured EXACTLY as every other host I am monitoring successfully, plus I have disabled local firewalls, av, allowed the service to interact with the desktop, tried both x86 and x64 installs, several reinstalls, etc. Again, something is going on with the local windows servers I am trying to monitor. Let's please start looking in to what that may be.

[lmiltchev]

You need to find out what is blocking the ports you need (12489 and 5666). This is definitely a firewall issue, and you will have to solve it on your end.
You can see if these ports are open with nmap (as you already did), use telnet or nc:

Code: Select all

telnet <client_IP> <port_number>
nc -zv <client_IP> <port_number>

[mobiledataforce]

What does this mean? It looks like nagios is trying to use more than one port?

d NSCLIENT++.cpp<1007> Loagind plugin: NSClient server..
e \Socket.h<691> bind failed: 10048: Only one usage of each socket address <protocal/network address/port> is normally permitted.
d NSClient++.cpp<709> NSClient++ - 0.3.9.328 2011-08-16 Started!
e \Socket.h<691> bind failed: 10048: Only one usage of each socket address <protocal/network address/port> is normally permitted.
e \Socket.h<722> Socket did not start properly, we will now do nothing...
l NSClient++.cpp<461> Using settings from: INI-file
e \Socket.h<722> Socket did not start properly, we will now do nothing...

Thanks.

[slansing]

No.. what it looks like is you "may" have two versions of NSClient++ running. Or.. do you have something mapped to use ports 5666 and 12489?.. The "something" is what is always hard for us on our end to figure out as we did not configure that server.. Was that log dump you showed right after you restarted the NSC service? Or have you tried stopping the service, then starting it again? When did you install NSclient++ 3.9? Was it when the client version was current? AkA pre-0.4? Or was it the latest version of 3.9? It looks like there was a bug "from searching their site," regarding this. Though it may just be that you have multiple things using the same port as NSClient, which would be strange, or that you have multiple instances running.

[mobiledataforce]

It seems to me the best way to resolve this, would be to remote to this server and see that I have everything configured properly. Can we do that? There are no duplicate installs, nothing else trying to use ports. That log is from running NSClient++ (x64, test). I have restarted the entire nagios server several times, that should cover restarting services. I installed using the latest version.

[slansing]

Unfortunately this is only something that we do as the end all be all to a support request, and at that, only offered to those who have purchased a support contract / XI. This is indeed a strange problem which is of course made worse since we cannot access your system to verify what we need to. So from our end it does look like some piece of software, or a device is blocking or using the same port, this may or may not be the case but due to what we have had you do so far that is how it looks being that you simply cannot connect to port 5666 from the Nagios server.

[mobiledataforce]

Here is the list of all the ports on this host. You will see there is no port conflict.

Proto Local Address Foreign Address State
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:2439 0.0.0.0:0 LISTENING
TCP 0.0.0.0:2440 0.0.0.0:0 LISTENING
TCP 0.0.0.0:2638 0.0.0.0:0 LISTENING
TCP 0.0.0.0:2639 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5666 0.0.0.0:0 LISTENING
TCP 0.0.0.0:12489 0.0.0.0:0 LISTENING
TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49158 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49161 0.0.0.0:0 LISTENING
TCP x.x.x.x:80 x.x.x.x:1957 ESTABLISHED
TCP x.x.x.x:80 x.x.x.x:61147 TIME_WAIT
TCP x.x.x.x:139 0.0.0.0:0 LISTENING
TCP x.x.x.x:2638 x.x.x.x:49157 ESTABLISHED
TCP x.x.x.x:2638 x.x.x.x:49160 ESTABLISHED
TCP x.x.x.x:2639 x.x.x.x:49156 ESTABLISHED
TCP x.x.x.x:2639 x.x.x.x:49159 ESTABLISHED
TCP x.x.x.x:3389 x.x.x.x:54757 ESTABLISHED
TCP x.x.x.x:3389 x.x.x.x:1614 ESTABLISHED
TCP x.x.x.x:49156 x.x.x.x:2639 ESTABLISHED
TCP x.x.x.x:49157 x.x.x.x:2638 ESTABLISHED
TCP x.x.x.x:49159 x.x.x.x:2639 ESTABLISHED
TCP x.x.x.x:49160 x.x.x.x:2638 ESTABLISHED
TCP [::]:80 [::]:0 LISTENING
TCP [::]:135 [::]:0 LISTENING
TCP [::]:445 [::]:0 LISTENING
TCP [::]:2439 [::]:0 LISTENING
TCP [::]:2440 [::]:0 LISTENING
TCP [::]:2638 [::]:0 LISTENING
TCP [::]:2639 [::]:0 LISTENING
TCP [::]:3389 [::]:0 LISTENING
TCP [::]:47001 [::]:0 LISTENING
TCP [::]:49152 [::]:0 LISTENING
TCP [::]:49153 [::]:0 LISTENING
TCP [::]:49154 [::]:0 LISTENING
TCP [::]:49155 [::]:0 LISTENING
TCP [::]:49158 [::]:0 LISTENING
TCP [::]:49161 [::]:0 LISTENING
UDP 0.0.0.0:161 *:*
UDP 0.0.0.0:500 *:*
UDP 0.0.0.0:4500 *:*
UDP 0.0.0.0:5355 *:*
UDP 127.0.0.1:2638 *:*
UDP 127.0.0.1:2638 *:*
UDP 127.0.0.1:2639 *:*
UDP x.x.x.x:137 *:*
UDP x.x.x.x:138 *:*
UDP x.x.x.x:2638 *:*
UDP x.x.x.x:2638 *:*
UDP x.x.x.x:2639 *:*
UDP [::]:161 *:*
UDP [::]:500 *:*
UDP [::]:4500 *:*
UDP [::1]:2638 *:*
UDP [::1]:2638 *:*
UDP [::1]:2639 *:*

[abrist]

What does this mean? It looks like nagios is trying to use more than one port?
d NSCLIENT++.cpp<1007> Loagind plugin: NSClient server..
e \Socket.h<691> bind failed: 10048: Only one usage of each socket address <protocal/network address/port> is normally permitted.
d NSClient++.cpp<709> NSClient++ - 0.3.9.328 2011-08-16 Started!

This error happens when a socket is not released. Either you have a second application (duplicate nsclient included) that is using port 12489/5666 or the nsclient process never released the socket. You may be able to kill the nsclient process and restart it to release the socket. You could also bring networking down and back up on the system. Worst case: reboot windows.

[mobiledataforce]

There are no duplicate nsclients running. I have reinstalled the client multiple times. I have also rebooted the host.