Unconfigured objects not showing up

[johndoe]

Hi Scott,

Below as requested

Code: Select all

# ps -ef |grep feedproc
nagios   12898 12887  0 09:07 ?        00:00:00 /bin/sh -c /usr/bin/php -q /usr/ local/nagiosxi/cron/feedproc.php > /usr/local/nagiosxi/var/feedproc.log 2>&1
nagios   12904 12898  0 09:07 ?        00:00:00 /usr/bin/php -q /usr/local/nagiosxi/cron/feedproc.php
root     13569 13403  0 09:07 pts/0    00:00:00 grep feedproc

Code: Select all

# tail -f /usr/local/nagiosxi/var/feedproc.log
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.
PROCESSED 0 COMMANDS
tail: /usr/local/nagiosxi/var/feedproc.log: file truncated
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.
PROCESSED 0 COMMANDS
You have new mail in /var/spool/mail/root

PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.
PROCESSED 0 COMMANDS
tail: /usr/local/nagiosxi/var/feedproc.log: file truncated
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.
PROCESSED 0 COMMANDS
tail: /usr/local/nagiosxi/var/feedproc.log: file truncated
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.
PROCESSED 0 COMMANDS
tail: /usr/local/nagiosxi/var/feedproc.log: file truncated
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
.
PROCESSED 0 COMMANDS

[abrist]

Was php upgraded on this server?

[johndoe]

Code: Select all

php -v
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
PHP 5.3.23 (cli) (built: Mar 15 2013 11:53:16)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2013 Zend Technologies

Code: Select all

Mar 26 13:55:08 Updated: php-common-5.3.23-16.el6.art.x86_64
Mar 26 13:55:11 Updated: php-pdo-5.3.23-16.el6.art.x86_64
Mar 26 13:55:16 Updated: php-cli-5.3.23-16.el6.art.x86_64
Mar 26 14:05:51 Updated: php-gd-5.3.23-16.el6.art.x86_64
Mar 26 14:06:19 Updated: php-snmp-5.3.23-16.el6.art.x86_64
Mar 26 14:09:07 Updated: php-5.3.23-16.el6.art.x86_64
Mar 26 14:10:46 Updated: php-mysql-5.3.23-16.el6.art.x86_64
Mar 26 14:12:22 Updated: php-pgsql-5.3.23-16.el6.art.x86_64
Mar 26 14:12:23 Updated: php-mssql-5.3.23-16.el6.art.x86_64
Mar 26 14:12:30 Updated: php-xml-5.3.23-16.el6.art.x86_64
Mar 26 14:12:42 Updated: php-mbstring-5.3.23-16.el6.art.x86_64
Mar 26 14:12:43 Updated: php-ldap-5.3.23-16.el6.art.x86_64
Mar 26 14:12:45 Updated: php-mcrypt-5.3.23-16.el6.art.x86_64

[johndoe]

Tried this from another fix that had to do with them not deleting and noticed the file doesn't exist ...

Code: Select all

# chown nagios:nagios /usr/local/nagiosxi/var/corelog.newobjects && chmod 777 /usr/local/nagiosxi/var/corelog.newobjects
chown: cannot access `/usr/local/nagiosxi/var/corelog.newobjects': No such file or directory

so i created it and gave it the appropriate permissions...

Code: Select all

# touch /usr/local/nagiosxi/var/corelog.newobjects
# chown nagios:nagios /usr/local/nagiosxi/var/corelog.newobjects && chmod 777 /usr/local/nagiosxi/var/corelog.newobjects

... still didn't help but makes me wonder why the file isn't created...

[scottwilkerson]

Can you show the following permissions

Code: Select all

ls -ld /usr/local/nagiosxi/var
ls -ld /usr/local/nagiosxi
ls -ld /usr/local/nagiosxi/scripts
ls -l /usr/local/nagiosxi/scripts/parse_core_eventlog.php

[johndoe]

Code: Select all

[root@mon ~]# ls -ld /usr/local/nagiosxi/var
drwxr-xr-x 4 nagios nagios 4096 Apr 30 15:05 /usr/local/nagiosxi/var
[root@mon ~]# ls -ld /usr/local/nagiosxi
drwxr-xr-x 10 nagios nagios 4096 Oct 24  2011 /usr/local/nagiosxi
[root@mon ~]# ls -ld /usr/local/nagiosxi/scripts
drwxr-xr-x 2 nagios nagios 4096 Apr 10 16:55 /usr/local/nagiosxi/scripts
[root@mon ~]# ls -l /usr/local/nagiosxi/scripts/parse_core_eventlog.php
-rwxr-x--- 1 nagios nagios 4592 Mar 26 13:28 /usr/local/nagiosxi/scripts/parse_core_eventlog.php

[scottwilkerson]

Can you run

Code: Select all

cat /etc/php.ini|grep ixed
cat /etc/php.d/sourceguardian.ini

[johndoe]

Code: Select all

[root@mon ~]# cat /etc/php.ini|grep ixed
extension=ixed.5.3.lin
[root@mon ~]# cat /etc/php.d/sourceguardian.ini
extension=ixed.5.3.lin
[root@mon ~]# php -v
PHP Warning:  Module 'SourceGuardian' already loaded in Unknown on line 0
PHP 5.3.23 (cli) (built: Mar 15 2013 11:53:16)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2013 Zend Technologies

[abrist]

Can you also run:

Code: Select all

cat /etc/php.d/mcrypt.ini

Are the missing objects brand-new hosts with unconfigured ips, or are they extra checks for already configured hosts?
Additionally, are all the missing unconfigured objects send directly to the XI server, or is there an intermediary nsca/nrdp/trap forwarding server?

[johndoe]

Code: Select all

[root@mon ~]# cat /etc/php.d/mcrypt.ini
; Enable mcrypt extension module
extension=mcrypt.so

The missing object are on both existing hosts and new hosts.

there are no machines in-between, just an stunnel connection however as mentioned previously, the NRDP packets DO REACH the nagiosXI server, they are just nor being processed somehow