Check Windows Processes

[ofadl]

yes, but it doesnt list all of the processes, it just checks to see if they are working. The check is called " Check processes are running". The command check on the windows server is called :

command[check_procs_from_file]=cscript.exe //NoLogo //T:60 c:\nrpe_nt\check_process_instances_from_file.wsf $ARG1$

this file is located in the nrpe.cfg file which is located in the nrpe_nt folder, which is on the windows server


the service definition on the nagios host machine, looks like so :

define service{
use comtex-service-template-vna ; Name of service template to use
host_name vnainp109
service_description Check processes are running
check_command check_nrpe!check_procs_from_file!c:\\nrpe_nt\\host.proclist.txt
}

This method was used on windows servers

i also found these commands definitions, but i am not sure if they are relative or help the service definition above run:


# 'check_winproc' command definition
define command{
command_name check_winproc
command_line $USER1$/is_process_running $HOSTADDRESS$ $ARG1$
}

# 'check_winproclist' command definition
define command{
command_name check_winproclist
command_line $USER1$/are_processes_running $HOSTADDRESS$ $USER3$/$ARG1$
}

# 'check_multiwinproc' command definition
define command{
command_name check_multiwinproc
command_line $USER1$/are_multi_processes_running $HOSTADDRESS$ $USER3$/$ARG1$
}

[slansing]

this file is located in the nrpe.cfg file which is located in the nrpe_nt folder, which is on the windows server

So you are using NRPE_NT instead of NSclient? These are the details we need to know. If you are not doing this then it is suggested you completely remove NRPE_NT as trying to run them side by side is going to cause issues since both with use port 5666 for traffic. If you are trying to use that command definition you can try to copy it from that .cfg to the nsc.ini file of nsclient, change this portion of the copied command definition to match the new location of that script once you move it to the "nsclient++/scripts/" directory:

Code: Select all

 c:\nrpe_nt\check_process_instances_from_file.wsf

then restart the nsclient service and try to call the command from the nagios server as was demonstrated earlier.

[ofadl]

no, the old nagios is using the nrpe_nt. The new nagios, which im trying to work on now, will use NSClient. Is there a way i can suspend the nrpe_nt without removing it?

[slansing]

You can stop its service in windows services.msc. That will suspend it from sending or receiving data. Except that the other nagios server will try to connect to the same port that nrpe_nt uses so you could run into some issues unless you disable it's checks.

[ofadl]

yes that is what i have done, i have disabled the service check on the windows server to stop the nrpe_nt from working. I am trying to run this now:

./check_nrpe -H 10.100.50.15 -p 5666 -c check_procs_from_file -a c:\\nrpe_nt\\host.proclist.txt

and am getting this error from prompt

Could not construct return packet in NRPE handler check client side (nsclient.log) logs...

and i go into the windows server, and check the nsclient.log file and get this:

2013-07-11 11:15:53: error:modules\NRPEListener\NRPEListener.cpp:422: Request contained arguments (not currently allowed, check the allow_arguments option).
2013-07-11 11:15:53: error:modules\NRPEListener\NRPEListener.cpp:320: Exception handling NRPE packet

but i dont understand, because i enabled allow_arguments to true, for both the nrpe section and nsclient section. Even when i try to make one or the other work individually, still get the same error no matter what

[yancy]

Uncomment and change the following lines the following lines in NSC.ini under the [NRPE] section

Code: Select all

;# COMMAND ARGUMENT PROCESSING
;  This option determines whether or not the NRPE daemon will allow clients to specify arguments to commands that are executed.
allow_arguments=1
;
;# COMMAND ALLOW NASTY META CHARS
;  This option determines whether or not the NRPE daemon will allow clients to specify nasty (as in |`&><'"\[]{}) characters in arguments.
allow_nasty_meta_chars=1

restart the service and that should do the trick.

-Yancy

[ofadl]

ok did as you said, ran this:

./check_nrpe -H 10.100.50.15 -p 5666 -c check_procs_from_file -a c:\\nrpe_nt\\host.proclist.txt


and got this:

UNKNOWN: No handler for that command

inside the nsc.ini file beholds this:


2013-07-11 12:01:50: message:NSClient++.cpp No handler for command: 'check_procs_from_file'
2013-07-11 12:01:50: message:include\NSCHelper.cpp:238: No handler for command 'check_procs_from_file'.\



Ok, so i did a little investigating and came across this in the nsc.ini file:

; Script to check external scripts and/or internal aliases.
CheckExternalScripts.dll

and did an uncomment for CheckExternalScripts.dll, and ran

./check_nrpe -H 10.100.50.15 -p 5666 -c check_procs_from_file -a c:\\nrpe_nt\\host.proclist.txt

and got :

ExternalCommands: failed to create process (scripts\cscript.exe //NoLogo //T:60 scripts\check_process_instances_from_file.wsf $ARG1$): 2: The system cannot find the file specified.


I dont know if that helps, or i should comment it back out?

[yancy]

Where is the file check_process_instances_from_file.wsf located? It should be in the Nsclient++ scripts directory.

[ofadl]

I have this defined in the "External Scripts" section, like i was told to do earlier in this threat.

check_procs_from_file=scripts\cscript.exe //NoLogo //T:60 scripts\check_process_instances_from_file.wsf $ARG1$

[yancy]

Yes, but where is the file check_process_instances_from_file.wsf located on the windows machine? what is it's path location?